Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502256
MD5:	8ed23a69e2084e1a94597c441658254e
SHA1:	d1870fdc6b3e94c3b4c606d314790748b84d4b5b
SHA256:	b37d3956036d1708f0338dfb76e1e65141401cb82c245da89b66b17927712393
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7280 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8ED23A69E2084E1A94597C441658254E)

msedge.exe (PID: 7296 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7544 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2096,i,18383972108529384836,11793983287344144029,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7556 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7868 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8720 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7760 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3436 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8808 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8828 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9208 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7604 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4080 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 7200 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5984 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8336 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5984 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 2504 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=1960,i,15799680679975826435,5556209134532581845,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8252 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2108,i,1270928443281422738,12119147721520445280,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5580 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2088,i,1395523319678171847,346153623225115163,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2905311999.00000000012A0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2905311999.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.12.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.12.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: b5af0d87-0fd1-43a2-9e9d-3debfefeedfd.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.12.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: b5af0d87-0fd1-43a2-9e9d-3debfefeedfd.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.12.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2905291240.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content.js.12.dr, content_new.js.12.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: b5af0d87-0fd1-43a2-9e9d-3debfefeedfd.tmp.13.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49796 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0016EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0016EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0016ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0016ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0016EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0015AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0015AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00189576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00189576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1652180265.00000000001B2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_6d221d7b-e
Source: file.exe, 00000000.00000000.1652180265.00000000001B2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a1ebe4f1-b
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9583899c-9
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_00a90072-b

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0015D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0015D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00151201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00151201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0015E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0015E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00162046	0_2_00162046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F8060	0_2_000F8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00158298	0_2_00158298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012E4FF	0_2_0012E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0012676B	0_2_0012676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00184873	0_2_00184873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011CAA0	0_2_0011CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000FCAF0	0_2_000FCAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0010CC39	0_2_0010CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00126DD9	0_2_00126DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0010B119	0_2_0010B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F91C0	0_2_000F91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00111394	0_2_00111394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00111706	0_2_00111706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011781B	0_2_0011781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000F7920	0_2_000F7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0010997D	0_2_0010997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001119B0	0_2_001119B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00117A4A	0_2_00117A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00111C77	0_2_00111C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00117CA7	0_2_00117CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0017BE44	0_2_0017BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00129EEE	0_2_00129EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00111F32	0_2_00111F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00110A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0010F9F2 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@98/525@22/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001637B5 GetLastError,FormatMessageW,

0_2_001637B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001510BF AdjustTokenPrivileges,CloseHandle,		0_2_001510BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001516C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_001516C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001651CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_001651CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0017A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0017A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0016648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0016648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_000F42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\20ffcf51-1aba-411b-b2d3-b68a54622c20.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.12.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2096,i,18383972108529384836,11793983287344144029,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7760 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3436 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4080 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5984 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5984 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=1960,i,15799680679975826435,5556209134532581845,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2108,i,1270928443281422738,12119147721520445280,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2088,i,1395523319678171847,346153623225115163,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2096,i,18383972108529384836,11793983287344144029,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7760 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3436 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4080 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5984 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5984 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=1960,i,15799680679975826435,5556209134532581845,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=1960,i,15799680679975826435,5556209134532581845,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2108,i,1270928443281422738,12119147721520445280,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2088,i,1395523319678171847,346153623225115163,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000F42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00110A76 push ecx; ret

0_2_00110A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0010F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0010F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00181C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00181C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95665

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6500

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 7284

Thread sleep time: -65000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6500 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0015DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0015DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001668EE FindFirstFileW,FindClose,	0_2_001668EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0016698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0015D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0015D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0015D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0015D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00169642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00169642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0016979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0016979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00169B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00169B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00165C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00165C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000F42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-95879

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0016EAA2 BlockInput,

0_2_0016EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00122622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00122622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000F42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00114CE8 mov eax, dword ptr fs:[00000030h]

0_2_00114CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00150B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00150B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00122622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00122622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0011083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0011083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001109D5 SetUnhandledExceptionFilter,	0_2_001109D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00110C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00110C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00151201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00132BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00132BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0010F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_0010F98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001722DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_001722DA

Source: C:\Users\user\Desktop\file.exe

0_2_00150B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00151663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00151663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00110698 cpuid

0_2_00110698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00168195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00168195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0014D27A GetUserNameW,

0_2_0014D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0012BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0012BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000F42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_000F42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00171204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00171204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00171806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00171806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Virustotal		Browse
https://drive.google.com/	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Virustotal		Browse
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Virustotal		Browse
https://www.google.com/chrome	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://msn.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content.js.12.dr, content_new.js.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	b5af0d87-0fd1-43a2-9e9d-3debfefeedfd.tmp.13.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2905291240.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.65.238	unknown	United States	15169	GOOGLEUS	false
23.223.209.207	unknown	United States	16625	AKAMAI-ASUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.81.228	unknown	United States	15169	GOOGLEUS	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.65.206	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502256
Start date and time:	2024-08-31 20:41:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@98/525@22/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 308
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 66.102.1.84, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 142.250.186.99, 142.250.186.67, 2.23.209.140, 2.23.209.182, 2.23.209.185, 2.23.209.179, 2.23.209.135, 2.23.209.130, 2.23.209.189, 2.23.209.181, 2.23.209.187, 20.199.58.43, 199.232.214.172, 172.217.16.142, 192.229.221.95, 142.250.184.234, 142.250.186.106, 172.217.16.138, 172.217.18.10, 216.58.206.74, 142.250.185.202, 142.250.186.170, 142.250.185.170, 142.250.185.138, 142.250.186.74, 216.58.212.170, 172.217.16.202, 142.250.181.234, 142.250.186.42, 142.250.185.106, 142.250.185.234, 142.251.32.99, 142.250.80.99, 142.250.80.67, 142.251.40.163, 142.251.40.99, 142.250.65.227
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, iris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.com, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:42:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
19:42:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
19:42:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
19:42:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Order enquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://security-azure.b-cdn.net/	Get hash	malicious	Unknown	Browse	13.107.246.60
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Win64.MalwareX-gen.30136.14956.exe	Get hash	malicious	Unknown	Browse	172.65.154.135
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	162.159.134.233
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	play.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	BankPaymAdviceVend.Report.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	Order enquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	aisuru.arm5.elf	Get hash	malicious	Unknown	Browse	51.120.241.156
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	13.107.21.239
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
EDGECASTUS	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	Order enquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	aisuru.arm5.elf	Get hash	malicious	Unknown	Browse	51.120.241.156
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	13.107.21.239
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://sin1.contabostorage.com	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://grand-pika-f642c4.netlify.app/#mthatha@africawsp.co.za	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.589823162559687
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0aflpkXFa6bukHB+idrxCRvByzljqRy1aJkXDcEwlR4X3xB0:Xq8NkC1fleJbRBrwvkz8ygJkTcpCxq
MD5:	A458AED26B4539608585060698BBCB5D
SHA1:	510D14DF78B58B5A67867E0398DDC2E81389156F
SHA-256:	B6AB1B778C974B74616D3F3376422566E0DA76851ECEC97AAF72F67B054F8D8F
SHA-512:	A1C47010A236835490A9C37654728472A13FF96BA397A5D0C682EA15C8E045DBB48E4BA21304DDD8A22EBA679B767828075A1277CF75323BB3DC3BE94E9852A6
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"policy":{"last_statistics_update":"13369603313620872"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2a82bf36-3109-499c-a09b-dd0f41a0a5df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.611012400754255
Encrypted:	false
SSDEEP:	96:0q8NkC1fleJbV5mBrwvkzjjOJkTcVSDS4S4SDS7eI4a:/8NbfQyJjjqkTf
MD5:	65AE27D8B3D1C26719CD726CFB847230
SHA1:	033ED53EF1FE85726AFFC62051CD12C3334FC661
SHA-256:	77578782CF9B2104E82664AAECC5C36FF28B77B53D4A1ADFB5D7D1B942057B7D
SHA-512:	5D11893ACE27413AFD4A4747E110FB4AD53D9AA7BE7CBDD70B5C4529445CC5D88EE7EB4CB34B67F4B890AED87DBE4F46B01AD204030C0AF83907975DC797C7A0
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\47155aac-479d-4ec1-84f4-f9c668b9bec4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20971
Entropy (8bit):	6.0654227052373075
Encrypted:	false
SSDEEP:	384:gtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSEDGiwpTXe1h0FoN6ONMg0r:AMGQ7FCYXGIgtDAWtJ4nYClpTs/N6ONs
MD5:	65CC754869CBF55E35EEB1A295C6E570
SHA1:	36CEF995A957F2AC4561B7B00AE11BA23F23596B
SHA-256:	CA32CE063C0780B6A433CCE3FD544D07AE4680B1FDEA7CA488B52E42C7FAD6BE
SHA-512:	6651E8D50F378F9EBE5822C4C7DC9F759CE268C7EFC0A7998DB088012BC5157D0C34F2761915941087E8235D961B1C8520DC6F74B93A7F8DC1DFDD1EDBE3BBDE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603315630539","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\55671503-efd2-4539-a0c0-4338fd35365c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71089
Entropy (8bit):	6.073720669763807
Encrypted:	false
SSDEEP:	1536:AMGQ5XMBG4aYCq06ISJGURHqiswh4qHrlj4ftcPt4z5LkzRbQ:AMrJM8Rp7P+Zowh4qHrOel4z5LkzJQ
MD5:	3DBA5D5C85C0F62A6398624D7DB1A018
SHA1:	2BBB506299B6B54A27C26CBF77FDFD1E0C7BBF9E
SHA-256:	34B91BB77530267C54383899339071101F654B371E0A25E26EF95326C9463D62
SHA-512:	09DD596404722764863831E9F5D76BE1F8FCCBB4385490C35B0D738FD6430BDE1879FDCB31053E8D53119CE21820F180F41419CCEF292EFD2742EDEE94669362
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603315630539","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\574b6902-6bad-4524-b9b8-522d1058595e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24303
Entropy (8bit):	6.056552128433077
Encrypted:	false
SSDEEP:	384:gtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGELGiy3qdpVE4zk9MLk9e1h0FoN6ONMb:AMGQ7FCYXGIgtDAWtJ4nG6l94zk9MLkf
MD5:	0FFBE860476873D3273AE2AC7816CC7C
SHA1:	25BD84C2E2DEB53CC299ED0D0EAA736CBBC23639
SHA-256:	5F5EDEFFB4460191A7329003C29A428964EE0DF641BC8DAE3CD110F3C3FE4A02
SHA-512:	57F6F4A503DE60FF8EA01266E52895CC4EAE5667C639548CC3EB5EBE4D16323715331CDC8B7DF0868DF14DB9884F1155C5272ADDBB9C7BD9472846C0DBFB0C54
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603315630539","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\58bf19db-d52e-4607-8b79-3c50f8d40d55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71128
Entropy (8bit):	6.073793565842869
Encrypted:	false
SSDEEP:	1536:AMGQ5XMBGzaYCq06ISJGURHqiswh4qHrlj4ftcPt4z5LkzRbQ:AMrJM82p7P+Zowh4qHrOel4z5LkzJQ
MD5:	1B50BD2DBB4EBF60B40FA499FB0238FC
SHA1:	03510886828E1698BE40F19CE08531BB8F44675E
SHA-256:	EEFF1A2C7184FDD3CA6EEEE78CF7C7BA15CE453439A6D44F61356B7DB856FBBB
SHA-512:	9733D5AEB985B00B5219D18A932C6A04CF3F8A58F0C31D18A88B61A24CFD83D8DF41EF60AF965975E81F434099C579C74BE84AC7B4BA41357DF9BAAC23404053
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603315630539","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\b7657620-5c5d-465b-8de5-7c4edd145049.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D363F1-1C80.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0404867398908399
Encrypted:	false
SSDEEP:	192:OVUjLYiVWK+ggCdwhbJtD+1X9XgLEoUgV8vYhXxNEq4b8GRQMj2Ln8y08Tcm2RGY:8UjjlGB6a/nhBCdP2L08T2RGOD
MD5:	93B07AEFA66288EF3F1F7820AD573AE2
SHA1:	7767C160B970C94EF7CDA748F9BD7CD4A239D031
SHA-256:	A7C9B55F9738A1E226758652D328327117759CFCB293DADC188CCD013AF6F9DB
SHA-512:	A571F05C8EDD17F342AEAB319D27384FEF67FB78FA09D23A14EDB649E2A5D4CA73FC7008BB6F0E66D09CC8662E12CA120963667DD818B76B6C98888D56D2CA39
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".himgbp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............'.....................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...e..X...@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D363F1-1D84.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4571687769226726
Encrypted:	false
SSDEEP:	3072:OLthRvWV4VfgMjvKAtTwtld9nYhf0Z3SBeBnhjg1HFNt68HtNt8+J6qi+8f3JMfk:CpW991nhjaHEfULuV+6aHnhod
MD5:	4C2C5447899A1C2827D026268ADF2256
SHA1:	BFF870F0452B9B3567226DD161A1CC0F5A19CF3C
SHA-256:	6B7B85846BFA705EECF1C3AD8E67A841C1D8F9EA59E2520E48B47AF3C997FFA1
SHA-512:	AE86A8F9272BD2F5519351CD650F2DC6512E9AC8E6F72C1E15EB33E64B3B427D53E3317F83F5C9C16116D72F66F7A3403DC8F6A56389C5CC03831071FD4E56B1
Malicious:	false
Preview:	...@..@...@.....C.].....@................S...;..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".himgbp20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.178781712977407
Encrypted:	false
SSDEEP:	3:FiWWltl12vdW0BIHSRqOFhJXI2EyBl+BVP/Sh/JzvZW1IkxBsZWXAnlsl:o11ILBIyRqsx+BVsJDZgbx97
MD5:	BA914C41FBD6A225BAC445BF500E56D6
SHA1:	A2594FE086B654D33DB00A5A394CD7A14640BA33
SHA-256:	E7043D1DE6145F9225289E194CB799176693F9DA61A1AD33752A1274D2BFBF7E
SHA-512:	A099FBFA380AA59EB02E12941ED63981696135CE8C54776A9723BC71962A57028AD70731CB807785E3A65492B1F64FE2CD266E42AA45AD4798ACABBAB5058F85
Malicious:	false
Preview:	sdPC...........................I.5!9..."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................d7769f3f-5c9a-43d8-b98e-0d203ca032e8............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1337456d-e740-471d-b72b-0924a5afacbe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6426
Entropy (8bit):	4.972096583631257
Encrypted:	false
SSDEEP:	96:stiPqf7is1w+b9sOK1NN8zjs85eh6Cb7/x+6MhmuecmAezCQd2Mh/EJ:stSFssh1NNkjs88bV+FiAUPhMJ
MD5:	342EE0723648B8CF2DED5AAA1E06EB55
SHA1:	7E2A240C4CD72A91234BAD7B39B5E248BFAB9768
SHA-256:	6535AEBA0EFD2A018F3A8C8843088E354C66B708252B7EC4520032A51AFCBA13
SHA-512:	19D08EC9C0BFD3F3F910FB9B1A4F4D23AE13BFB21E9C68D6A2E3386ABD80869B229F350F51C1BF70D253A24224218A3E6E42E9EEEDD4000E59FF495A5E77558B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369603315272001","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369603315271489"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\522ecc12-af21-4c9a-bd54-b5dc7f9f285c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.565578259809615
Encrypted:	false
SSDEEP:	768:3CUGAbWPS8f+M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVo5EIdrwW0pGtuP:3CUGAbWPS8f+Mu1jahqImKtI
MD5:	FE9D2E9BCE0CEA1886E19D61E02270DB
SHA1:	DA433103ACED841E6317EAB26C56D633D7E5824C
SHA-256:	2FFF8910B846557888FD45CF57B67EEC5862985CA3CC707188DD0B11D80A2A62
SHA-512:	8D9F80842C9A48B3615C79D8435CFC5F20E9C21D49EFED6EC3E64E4D3F8CF1F4BBA0EE4E4872F26D4BEDD57439B98E9A130B8088DA903618CC2DBA88CCA11099
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369603314165704","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369603314165704","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\5e28b23a-fb8b-4067-b53a-0a6766b9947e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6cad41c5-f774-4a76-8839-31ec1d79c7c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565539210736804
Encrypted:	false
SSDEEP:	768:3CUGAbWPS8f5M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVo5EIdrwWypGtuz:3CUGAbWPS8f5Mu1jahqImotM
MD5:	AD48A5BE9732A6DB467BF7B88BA9DB4C
SHA1:	66E33CEE31179C98649C82C43C6F7B628CEE31BE
SHA-256:	B471B2FB64BB4A4D9ADAA46767BB3CF08A90AC1CCA03DE314A5E21E5A07BE807
SHA-512:	DE1346023B6E246BED4DF6FB23F9C7106741132B4410C5CDAEA3095F1F7A269398351BB6D9C44649AB41A224CFEAEBBEF9692D60D4F0054CCDB3310BCB95A6AE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369603314165704","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369603314165704","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7c73e3d7-f548-4460-9041-1a99173fca7f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.964953862039002
Encrypted:	false
SSDEEP:	96:stiPqf7is1w+b9sOK1NN8zjs85eh6Cb7/x+6MhmuecmAeznV2Mh/EJ:stSFssh1NNkjs88bV+FiAQPhMJ
MD5:	9590B9ABF78FCFC0D9872587A8FFD3D1
SHA1:	69A081AA045485FBCD0214395A497CA0FBD5EA7E
SHA-256:	F38FA3130DFA2ADEC8F92CCA1BBB3138B9F776B958B9EC2F4FA04CFD76644813
SHA-512:	F85E5563CD69F12B816A939855DEEA442466657DE1C23386B2831005A78BAA67E0B276E0ABD7A9521ACF034D7B9C0E495F61806A7078FDA354AD5CA92A9D1055
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369603315272001","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369603315271489"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320648293621681
Encrypted:	false
SSDEEP:	192:nAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:AOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	32FCA7E46F5D2FAC61CAA22BBA3F3252
SHA1:	7D08EF6E05FF4D0CF241117A87A61115F8CCF72C
SHA-256:	067F54AD92DBBBF45F1F52FD9F2B267C24B40F7AC087F95647EF90C139010E52
SHA-512:	7BF7D83DBE0C5759361317973349D183DD0E98943221C155B60D5CC4FE6A0DC77B1D26991F14F019C9E39D45B85D488466C8441C693B58A7660D61ABA79210B8
Malicious:	false
Preview:	...m.................DB_VERSION.10}%.................QUERY_TIMESTAMP:arbitration_priority_list4...13369603320144524.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.156888770661449
Encrypted:	false
SSDEEP:	6:h5f1wkn23oH+TcwtOEh1ZB2KLlH5vAVq2Pwkn23oH+TcwtOEh1tIFUv:h5OfYebOEh1ZFLZ5v4vYfYebOEh16FUv
MD5:	A4AF23C3FF028FB87DB9E15CB40ACE54
SHA1:	BEE55AA89EF808539F13802F954B2B09F6950FCA
SHA-256:	F3042DE72C1BECA1A3CEE3F874D907269B1FBDA70DCE97DF62DF2F2613365AC2
SHA-512:	6B53FEDD03C0DF396DD9EAC9713780D1AEF2A9BB73B14A5B1EE940533ED050EB6A07BE37313EF62AE51FA22E2DAF8BB709FFF32D9764AC8B7E6087B039106D89
Malicious:	false
Preview:	2024/08/31-14:41:59.345 2230 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/31-14:41:59.473 2230 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04421967863959478
Encrypted:	false
SSDEEP:	6:/Fii2dl29SltUkM/l2vNa1Sw60k/GN6YliklibaTn/lPl:deaWt9E2VakGDliklWYt
MD5:	EB5F6818AC2989BE9442B86C94EF2CF2
SHA1:	14C83EED945581BD2FDDFBF42A4121C2FC910EE1
SHA-256:	48DB076E5E002A708B8E483CB847DD46168020B8EF4790504C57BC894809B56C
SHA-512:	72D304D41572B17E840913DD858569C4A6A04431EEA3BEA8C57E150320ADC5A980420578EC1333A16432DC89F49AF5DCB0AFF8656FD8CE8D81A9E08892CB2668
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09564860692739607
Encrypted:	false
SSDEEP:	48:wiV4A3esPV4Xesz5T3lWp4HA8k6NUeGFM:wiV4A33PV4X3z93LHA56NLGFM
MD5:	0DF350FA3ABD2361AAFE6132515CBA6A
SHA1:	23FF9BD243DF4D4DF10D91CEEE676BF4E4E544CB
SHA-256:	BF30A9236D7212799B382256D74D0143EAEBFB1B808A0830E96198F518259382
SHA-512:	656F8591286398B9DCDE5BBC43389BB60A3C5E54E89AA4D399D95B2DF38E3DAB2D9C2E939549FE746A2699D7710AA3E43E8126E634F0CE9151BDC91D43A60E01
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28344960312846357
Encrypted:	false
SSDEEP:	384:Z/UxJtMP/UxJtMBi1JtbIbZ5VJtPB1Jtp:Z/UxJt8/UxJtV1JtkZHJtp1Jt
MD5:	7482E94E825E6284221552D1160B80F1
SHA1:	F3EFE6510A498E4DE003439DBA13BA1B89C6DDAD
SHA-256:	5D1C26403C68D3AED2B49F13D99B279F682196A9261919616AD104BF6B1D9F24
SHA-512:	0F7A104BF1691A37BEF9D8D01FA078A35247B5BDCB947BCB6E829B5F1EC20A68C5C52483F46576E305982471A011302E580BD7C253A3FEC6B7E98D5A2CA89C88
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:LsulR/:Lsu/
MD5:	F848E1DE7914C82B730D8D3BF4B090E8
SHA1:	6B8F2973CB3F88EE6E1BAECD4180609135325432
SHA-256:	5739B7A86C639E2A247E5A83252B9E279CF76A61B63F39019AB8048FEAF0319B
SHA-512:	BB7C428B52CC5CCD69FBBC08421858573B0DE4B0E6F9D03AFDDEA8288B4C28ED2EADCC5821A6FBE1D6CA4C00FEF0AF8E7E4DC724FE165B551006692BCE70BC47
Malicious:	false
Preview:	..........................................bX../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:M4BtTEKx9W:M+tgp
MD5:	B359B766A9E180436D01F7DA7676D419
SHA1:	4DDE57EF3A799CE3BADEFC0254E7C930DC2C236C
SHA-256:	1EB76C4F6147320DBDA67771CB8601292FA0B6C09E69F17BB1F840E2989FF5C4
SHA-512:	454538625E14F2D72A34DC9B0B4A783528DEDE2C74D39F3E569C0CFA720C09D1E0B330143050692D2D5C858D997253FC45F23C672999C5ECEE500817D8332B8C
Malicious:	false
Preview:	(......Poy retne.........................xVX../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:M4BtTEKx9W:M+tgp
MD5:	B359B766A9E180436D01F7DA7676D419
SHA1:	4DDE57EF3A799CE3BADEFC0254E7C930DC2C236C
SHA-256:	1EB76C4F6147320DBDA67771CB8601292FA0B6C09E69F17BB1F840E2989FF5C4
SHA-512:	454538625E14F2D72A34DC9B0B4A783528DEDE2C74D39F3E569C0CFA720C09D1E0B330143050692D2D5C858D997253FC45F23C672999C5ECEE500817D8332B8C
Malicious:	false
Preview:	(......Poy retne.........................xVX../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:M4BtTEKx9W:M+tgp
MD5:	B359B766A9E180436D01F7DA7676D419
SHA1:	4DDE57EF3A799CE3BADEFC0254E7C930DC2C236C
SHA-256:	1EB76C4F6147320DBDA67771CB8601292FA0B6C09E69F17BB1F840E2989FF5C4
SHA-512:	454538625E14F2D72A34DC9B0B4A783528DEDE2C74D39F3E569C0CFA720C09D1E0B330143050692D2D5C858D997253FC45F23C672999C5ECEE500817D8332B8C
Malicious:	false
Preview:	(......Poy retne.........................xVX../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:M4BtTEKx9W:M+tgp
MD5:	B359B766A9E180436D01F7DA7676D419
SHA1:	4DDE57EF3A799CE3BADEFC0254E7C930DC2C236C
SHA-256:	1EB76C4F6147320DBDA67771CB8601292FA0B6C09E69F17BB1F840E2989FF5C4
SHA-512:	454538625E14F2D72A34DC9B0B4A783528DEDE2C74D39F3E569C0CFA720C09D1E0B330143050692D2D5C858D997253FC45F23C672999C5ECEE500817D8332B8C
Malicious:	false
Preview:	(......Poy retne.........................xVX../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl3a+l/:Ls33a+l/
MD5:	BD69658D0A4DC2304526DA83E9129879
SHA1:	6A65C797788164E2BF7DE61FA1A24A102EAEA3BF
SHA-256:	D4EF1BB3F4916EE1B60ABC4885CF47EB9F4AD4F900689F1ECE1C0AE9DA34A161
SHA-512:	F66FC5C448333CE586646B4A28F509A6122538507373C38A196BADB8F465FE6366D62579A269950666D0316BA41FC8E5D440566D0DABD35FCFFBCDCA38C62867
Malicious:	false
Preview:	........................................(.oX../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354059079917174
Encrypted:	false
SSDEEP:	6144:mA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:mFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	89C3C21A2B91B6BC3C9DE0AD80D776AC
SHA1:	F8CADDC32F5DE9EDD4042FA89A5A6ECB79D959F9
SHA-256:	AF3C32CB519F5D0B86E0E60A2BDFEF85C00A71D6456421D21211A500D64A749D
SHA-512:	FB308994948AAE31C386FEEEAE1470563C1550B32DADA3751EC0B79D58C8BBA5208893274ED0972AFAE2BCCF65A45827B86E77D13AB5E65F5AF52EA40E99963B
Malicious:	false
Preview:	...m.................DB_VERSION.1k.]vq...............&QUERY_TIMESTAMP:domains_config_gz2...13369603320289841..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2396080306660675
Encrypted:	false
SSDEEP:	6:h5jms1wkn23oH+Tcwtj2WwnvB2KLlH5Hthq2Pwkn23oH+Tcwtj2WwnvIFUv:h5j0fYebjxwnvFLZ5bvYfYebjxwnQFUv
MD5:	ED4F7FC22C7895D1F0CAED5D5AC45B06
SHA1:	C6363D36E033B5172C3C1FF260C94FCE892B9C28
SHA-256:	F709B6210C5AB6C191A47BCBBBB5E08ECB0C68295B6A603112EC3C6C985FF340
SHA-512:	709AAE7F58C46A02EFBB0ED16C557CB83B129F72C876A52F469075C87BD875EE17785C992ED637B5334DE6302C6D7D08D894B56D840DE1EEE8566616467C0AB9
Malicious:	false
Preview:	2024/08/31-14:41:59.378 2250 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/31-14:41:59.517 2250 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324617455153364
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RK:C1gAg1zfvC
MD5:	1639AEFF095818B9F837454F55127861
SHA1:	877A3C9BDD701CA12AA37430D38693C0C21D16CF
SHA-256:	4792549B1F19633EDB10ED3CD26AAACD358E88925429763BB48BEE38A26953B9
SHA-512:	E9361CD9C2CF0ADF30A99CAE662FCFC7AC289E0FCA78CC0274539D249B368BE1E331CC8E803B32BBE00675BB5105A8DF96D4A8D74512BACB75FA689D164551A3
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.166599778761067
Encrypted:	false
SSDEEP:	6:h5qDmRq1wkn23oH+TcwttaVdg2KLlH5nu+q2Pwkn23oH+TcwttaPrqIFUv:h5KyfYebDLZ5fvYfYeb83FUv
MD5:	89727FDBDCE8FF002A19D38D90D17725
SHA1:	A967F70AD9D33FCD34E0D23A9F45BA1093AC51D9
SHA-256:	90DAC63F95C1ABFE8D5526048196FE1C95C231895E9DB2F6AA9BABA12E23BB10
SHA-512:	A539FDD5DFCF9A51D1114C0A855822185E4BDA3820E3BDF0752FE71800F150332C0ECC6B6C256D6425E29CE5079B75161DB573A70AFEED68492AA4ECBA128912
Malicious:	false
Preview:	2024/08/31-14:41:54.224 1e38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/31-14:41:54.440 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.177053303914074
Encrypted:	false
SSDEEP:	6:h5lBRq1wkn23oH+Tcwtt6FB2KLlH5Ct+q2Pwkn23oH+Tcwtt65IFUv:h5lpfYeb8FFLZ5CovYfYeb8WFUv
MD5:	E4AC7EEBDCDC75EFEE3090F423518E1D
SHA1:	01D3A32C64F146795B67D1D9B5A71DC7E503816D
SHA-256:	B69C76B3BE79585294D1F96C8EF898B825F0A668D53D484494A23402E4659B27
SHA-512:	009D85170F693EF5C7D21A47F48FD0DA9EBC39F8E3A32D6A9A0C2205DF011E3169E0573981F30169761BE3DB20C5E0855DA33F90EE0D0F6B723751FD01CB109F
Malicious:	false
Preview:	2024/08/31-14:41:54.442 1e38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/31-14:41:54.457 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.192244660398723
Encrypted:	false
SSDEEP:	6:h5CRq1wkn23oH+TcwttYg2KLlH5HxFN+q2Pwkn23oH+TcwttNIFUv:h5mfYebJLZ5ROvYfYeb0FUv
MD5:	87DB11EFC8498084B3B3784ABE7791F0
SHA1:	A085CED819A92745C73C1E3DC8499C62EC90DA2E
SHA-256:	0A8D99043DCBD56388C088AA8489F61C43A92A3B7E85D24B2270D83C3C0A9C6D
SHA-512:	51A94873F80F1CF4F4341066C1D6914396A9C8C780923043EDC978DEAE5F5194D440614690E30E35B2E48292A2CEBBD4FF72D7E8F9C3A53E1988C18223EBB649
Malicious:	false
Preview:	2024/08/31-14:41:55.721 1e38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/31-14:41:55.729 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNls//:Ls3M/
MD5:	8B5CE2CAB1867599585C2445C7AE5120
SHA1:	680461EB372E19FC29C6A27E7BE16FC9FE3BDAEF
SHA-256:	8B5D02232A7C58D58F57C2526CDA8D663CF34A0AABC4671F896DBEBB3F41758B
SHA-512:	F5B818330F0072BDCDF2C031D02F928507D578B8E2B6C67781A34CFD70F9EFBC675DA2B5EBCA17E614300D3B82DF2E39C3CE0BE32D44FBC3FB482C7F3AA77B93
Malicious:	false
Preview:	..........................................nX../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21838546206064954
Encrypted:	false
SSDEEP:	3:J8VxvtFlljq7A/mhWJFuQ3yy7IOWU5Mv4dweytllrE9SFcTp4AGbNCV9RUI9:yVxk75fOov4d0Xi99pEYT
MD5:	3C8AE0A4B3663427EB3C5D022FA30ACD
SHA1:	3667E8DCF8B7997965B2FE2EFF2ACAF49DDCE835
SHA-256:	D69AE2200B4BBDF07C486365D90D3472B1089637909F340EE855DB5D6DC8A7BC
SHA-512:	5616E73B2F1659F6BD0EA9F1729C4D006E4E2F9C663658269833D523669B0008F0ED4267A7EFD5EF6CFEEA946589844FCA82754BE3549D91A6E417A8843B0003
Malicious:	false
Preview:	............d.p...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.255267592494377
Encrypted:	false
SSDEEP:	6:h55uM1wkn23oH+TcwtRage8Y55HEZzXELIx2KLlH5GJElyq2Pwkn23oH+TcwtRai:h55urfYebRrcHEZrEkVLZ5GWlyvYfYep
MD5:	F1D7F0B5399E132AA1086F7B8D561FD6
SHA1:	4B2490916F09DD08B2851EFABF976156844946FF
SHA-256:	B50D4CEDCC2DC21038E2A9C1CD77C182757BDBA769B0158960AE426558479FA5
SHA-512:	3E3A2A72B8438E99DC2EAB566CBDB3D3EB78A0C2FC1B7EF18A692696284C1D2DC0F72305B86B73DCD161CE7F7736C8D986D4445D9C479D1664D036E2DC50E6AA
Malicious:	false
Preview:	2024/08/31-14:41:56.694 1e34 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/31-14:41:56.706 1e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.229848771923401
Encrypted:	false
SSDEEP:	6:h5taj1wkn23oH+TcwtRa2jM8B2KLlH5HAQ+q2Pwkn23oH+TcwtRa2jMGIFUv:h5oSfYebRjFLZ5gVvYfYebREFUv
MD5:	1D0390C0CA2E16A850421EC155E43885
SHA1:	E7E2D980A738C81805FCC43F84493D1E789F20F4
SHA-256:	D1EF7A2561FB93E7F0BB919FC2ACB3893CEADC8862F59BA07D14BE6B28C4C141
SHA-512:	5BEEBB5D6B442CC0BA47B5E44F5229B9C90AAFB124D8CBDCDE9AE6357721A4EB2225A0633436F27B0CEDB6C4908BF3A2C0A8C2E8DE2F57A7E50CC884A065ADCD
Malicious:	false
Preview:	2024/08/31-14:41:54.619 1f48 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/31-14:41:54.649 1f48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\444e2a0d-b3c2-4950-b501-2f53c8f4cc3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\723585bf-b55c-4e63-a113-0a857d4cba18.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3b2b7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7608777165440965
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkar:uIEumQv8m1ccnvS6t
MD5:	E44165F435324E5747FBDB608E780D48
SHA1:	61C2C7C26A5F4677A3180F90CA31197BDEE13F12
SHA-256:	350FDC672DDF657A2E41F1699DF2801F4C91818E615017DDE5CF09CB5E3C525A
SHA-512:	1A040FC0B46F4EC1582455979CAA436665FC7AF7406321F640207F15CF5449E74B7961C84BEE3A7B007B9BB2FB4C47A6E9BB738214F8B5C832BAC8D7B15E9776
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF2938b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\a60bc9e2-33c6-4ee2-ad1e-4314037fcc22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\a7312b5d-cf47-4c90-b0e5-3d0812e4c795.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\d54b867b-a0ca-435b-abb4-36f5f4220635.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.964953862039002
Encrypted:	false
SSDEEP:	96:stiPqf7is1w+b9sOK1NN8zjs85eh6Cb7/x+6MhmuecmAeznV2Mh/EJ:stSFssh1NNkjs88bV+FiAQPhMJ
MD5:	9590B9ABF78FCFC0D9872587A8FFD3D1
SHA1:	69A081AA045485FBCD0214395A497CA0FBD5EA7E
SHA-256:	F38FA3130DFA2ADEC8F92CCA1BBB3138B9F776B958B9EC2F4FA04CFD76644813
SHA-512:	F85E5563CD69F12B816A939855DEEA442466657DE1C23386B2831005A78BAA67E0B276E0ABD7A9521ACF034D7B9C0E495F61806A7078FDA354AD5CA92A9D1055
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369603315272001","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369603315271489"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF32481.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.964953862039002
Encrypted:	false
SSDEEP:	96:stiPqf7is1w+b9sOK1NN8zjs85eh6Cb7/x+6MhmuecmAeznV2Mh/EJ:stSFssh1NNkjs88bV+FiAQPhMJ
MD5:	9590B9ABF78FCFC0D9872587A8FFD3D1
SHA1:	69A081AA045485FBCD0214395A497CA0FBD5EA7E
SHA-256:	F38FA3130DFA2ADEC8F92CCA1BBB3138B9F776B958B9EC2F4FA04CFD76644813
SHA-512:	F85E5563CD69F12B816A939855DEEA442466657DE1C23386B2831005A78BAA67E0B276E0ABD7A9521ACF034D7B9C0E495F61806A7078FDA354AD5CA92A9D1055
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369603315272001","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369603315271489"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF39991.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.964953862039002
Encrypted:	false
SSDEEP:	96:stiPqf7is1w+b9sOK1NN8zjs85eh6Cb7/x+6MhmuecmAeznV2Mh/EJ:stSFssh1NNkjs88bV+FiAQPhMJ
MD5:	9590B9ABF78FCFC0D9872587A8FFD3D1
SHA1:	69A081AA045485FBCD0214395A497CA0FBD5EA7E
SHA-256:	F38FA3130DFA2ADEC8F92CCA1BBB3138B9F776B958B9EC2F4FA04CFD76644813
SHA-512:	F85E5563CD69F12B816A939855DEEA442466657DE1C23386B2831005A78BAA67E0B276E0ABD7A9521ACF034D7B9C0E495F61806A7078FDA354AD5CA92A9D1055
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369603315272001","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369603315271489"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565539210736804
Encrypted:	false
SSDEEP:	768:3CUGAbWPS8f5M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVo5EIdrwWypGtuz:3CUGAbWPS8f5Mu1jahqImotM
MD5:	AD48A5BE9732A6DB467BF7B88BA9DB4C
SHA1:	66E33CEE31179C98649C82C43C6F7B628CEE31BE
SHA-256:	B471B2FB64BB4A4D9ADAA46767BB3CF08A90AC1CCA03DE314A5E21E5A07BE807
SHA-512:	DE1346023B6E246BED4DF6FB23F9C7106741132B4410C5CDAEA3095F1F7A269398351BB6D9C44649AB41A224CFEAEBBEF9692D60D4F0054CCDB3310BCB95A6AE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369603314165704","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369603314165704","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2f310.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565539210736804
Encrypted:	false
SSDEEP:	768:3CUGAbWPS8f5M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVo5EIdrwWypGtuz:3CUGAbWPS8f5Mu1jahqImotM
MD5:	AD48A5BE9732A6DB467BF7B88BA9DB4C
SHA1:	66E33CEE31179C98649C82C43C6F7B628CEE31BE
SHA-256:	B471B2FB64BB4A4D9ADAA46767BB3CF08A90AC1CCA03DE314A5E21E5A07BE807
SHA-512:	DE1346023B6E246BED4DF6FB23F9C7106741132B4410C5CDAEA3095F1F7A269398351BB6D9C44649AB41A224CFEAEBBEF9692D60D4F0054CCDB3310BCB95A6AE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369603314165704","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369603314165704","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.16210102913845
Encrypted:	false
SSDEEP:	6:hJ871wkn23oH+TcwtSQM72KLlHJ8gsAQ+q2Pwkn23oH+TcwtSQMxIFUv:hJ9fYeb0LZJbhVvYfYebrFUv
MD5:	F7E377BE8499E4B5B9C0820F74683339
SHA1:	FCA8ACE1376C557979C633BA1100A11FADBA2086
SHA-256:	5EACC1274E4424613985CFFC597A8E10FC20BFDC9F4803E14AEAFD0F33916632
SHA-512:	A55EA12FB7AD8332A262A326D11C83FD98E3AF727C914861EBEDD56EFB3FDF324AF6E3A054E2CD335554E3D2B9790470FD3722C3FCCFB25F9FB5CBA1028B40D0
Malicious:	false
Preview:	2024/08/31-14:42:11.569 1f48 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/31-14:42:11.590 1f48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.118803698277065
Encrypted:	false
SSDEEP:	6:h591wkn23oH+TcwtgUh2gr52KLlH5CMSQL+q2Pwkn23oH+TcwtgUh2ghZIFUv:h5AfYeb3hHJLZ5yQ+vYfYeb3hHh2FUv
MD5:	4D26468F00F7AC6A36346AD7FAAD1BF7
SHA1:	268AFB34CD2FC6048F6289A9E64206BD2A178FA2
SHA-256:	B7A2ED514352BD5C9457B47E4E4020EB3075346996F2386D7AAE2934B5178C15
SHA-512:	FAE4FE7E0AA73953C9200F0B152EB5D259046212B138298343206C6C030B34AE2CD8305C987B6C8D76B9DAEEFBDD18917138CDDC091824A5CD87C0D207F8C0DB
Malicious:	false
Preview:	2024/08/31-14:41:54.189 1e5c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/31-14:41:54.260 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsulzi/:LsV/
MD5:	233E5C4EC424366B3A479AC0D58F5842
SHA1:	2F1A681A0BAEFE8978F36DF6948FC95DAECEAC59
SHA-256:	0FE2E9A4EF9F5232A68D0AFD68C3FE7CB513C4E4B973E1A7685F1E5640E35D99
SHA-512:	8B4211637851EF9D0F845D335F5B6B9E49809BC90E2F94C53EFB7F2F0C2C06E5760E4F85F1133C40F031766F03539312E4DECF888E342F7E7D95120EF81CCEF4
Malicious:	false
Preview:	..........................................X../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:+6FEi9s:+bt
MD5:	BCC4BEEF5E93FDFC18FABB242ECD9153
SHA1:	9CCA358DCBECE06D59F94D01A22A6358BE6422BE
SHA-256:	ABE914F3C00D2A4C444EB4799C66AF121BF45A5249A8FFB192605DFC6D7C3EC4
SHA-512:	1F7C3550CB620082AE73067CC83A30EB6CF29DCA14483A9933282FDC4115763AF52CB521CE9E78D1CE74C2B473739367EECD75B9FC54BA11551C071E34AEB7F0
Malicious:	false
Preview:	(.....8.oy retne..........................kX../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:+6FEi9s:+bt
MD5:	BCC4BEEF5E93FDFC18FABB242ECD9153
SHA1:	9CCA358DCBECE06D59F94D01A22A6358BE6422BE
SHA-256:	ABE914F3C00D2A4C444EB4799C66AF121BF45A5249A8FFB192605DFC6D7C3EC4
SHA-512:	1F7C3550CB620082AE73067CC83A30EB6CF29DCA14483A9933282FDC4115763AF52CB521CE9E78D1CE74C2B473739367EECD75B9FC54BA11551C071E34AEB7F0
Malicious:	false
Preview:	(.....8.oy retne..........................kX../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:/U8JHFE0EGSOSBl:cYHqDl
MD5:	526FAF0A5F3E2AE60D6BC72A3E9B26E2
SHA1:	DF9BB9088586CDFBDAFFEAA0AC8C9980937C7E9B
SHA-256:	80128F1F31AB3588A61D21D2EB3CE5D565F553C024470D06F6C309CDF1AA900C
SHA-512:	A4B88A72B23B25E47887543739ABC17C200943EFD33585A07E32B61BCBC8C88F153AADFD8D259399189493BD0FC813D4BDA2E1148C0382AFC7DDC05292D1AEDA
Malicious:	false
Preview:	(.......oy retne.........................kX../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:/U8JHFE0EGSOSBl:cYHqDl
MD5:	526FAF0A5F3E2AE60D6BC72A3E9B26E2
SHA1:	DF9BB9088586CDFBDAFFEAA0AC8C9980937C7E9B
SHA-256:	80128F1F31AB3588A61D21D2EB3CE5D565F553C024470D06F6C309CDF1AA900C
SHA-512:	A4B88A72B23B25E47887543739ABC17C200943EFD33585A07E32B61BCBC8C88F153AADFD8D259399189493BD0FC813D4BDA2E1148C0382AFC7DDC05292D1AEDA
Malicious:	false
Preview:	(.......oy retne.........................kX../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlC9S//:Ls3Ck//
MD5:	5E453286B711C614938E02160C097BC4
SHA1:	2D6271F3832AB9C2FD63003F3BC1494AC8D5A87B
SHA-256:	D47AC2222CBF2CE8C5795DFCA9FD8F825C2B23C15E2A032DA1C67C3BDF3C2C7C
SHA-512:	CABB343274FF3F6B14F190215D7ECD888BE7771C42578551E99BDF379E295F369EF69135212661BEF3BA8AA1378840675AD77B2741FA47BE7E41ED7940157E21
Malicious:	false
Preview:	..........................................pX../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlYmi/:Ls3YJ/
MD5:	534ECD4BD648746AC70105D4FC9A3391
SHA1:	CD5DC0BC75A24B8D952EC2C895547EA0CF686FD1
SHA-256:	842CB8B182382DA450EABC476E18DFE7B75D4F67EC1A87E905A2D974FC9F8F8A
SHA-512:	7CA24187AF3905987D7FB7D145D07DB0C6C18447B38F587B1B0E2B45D2C79274EDFA1368C51BA15021E9C5954EB26A6B90823786D8B268B442AFD3DA6D22AB81
Malicious:	false
Preview:	..........................................oX../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.225070313377933
Encrypted:	false
SSDEEP:	6:h5hHM1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlH5dN4q2Pwkn23oH+Tcwt0jqEKj3V:h5hHrfYebqqBvFLZ5ovYfYebqqBQFUv
MD5:	CAC7F54E21571B83A889C9301AE8B268
SHA1:	68981C28821219DCCCA9235371E1E5A8839F5F4F
SHA-256:	5815881F72A78BF1F22159A49F0974DCBFCA1735D9AF8ACCB3E33368E754D518
SHA-512:	BD14674CA2C6375C7885746FE3E1DB7E18337CC2EAB295789FDB2B21E03DA43DE7AD7CB9E7543DF587AB4163E3EB9C6E15F79E69804E2558C15B9F4E111C6118
Malicious:	false
Preview:	2024/08/31-14:41:55.803 1f84 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/31-14:41:55.828 1f84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1f75e147-9357-4361-8cc6-4fc2e04f2caa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\708cf4c3-6169-4b32-8212-2ad3bff69c52.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3b2c7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bae4c345-9561-48da-b9bc-0c4333d60931.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e73ac06e-4a02-4a2e-9709-6ecb37133469.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.192208955080722
Encrypted:	false
SSDEEP:	6:hJ8o61wkn23oH+Tcwt0jqEKj0QM72KLlHJ8M0AQ+q2Pwkn23oH+Tcwt0jqEKj0Qe:hJTFfYebqqB6LZJj5VvYfYebqqBZFUv
MD5:	D1911E6780651C8C6419371EEB56FF37
SHA1:	17D2B0624C341C89D39348021CD890427245A3CC
SHA-256:	48589FF64963A38AD5F0FA172630282913DA802EFE0411394ED86C483887F6DE
SHA-512:	B475AEDEDCE55C55CA5B3CF52EA0A4B6C35B76240CFA3EC4B3ED8DB481D7374BE41067151053C938BF1BF358A51979C0F27B8575455F869262F475BD55497121
Malicious:	false
Preview:	2024/08/31-14:42:11.518 1f48 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/31-14:42:11.543 1f48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.220184080926326
Encrypted:	false
SSDEEP:	6:h5Hq1wkn23oH+Tcwtkx2KLlH5MtVOq2Pwkn23oH+TcwtCIFUv:h5H1fYebkVLZ5MtAvYfYebLFUv
MD5:	E38CC8BDBCA7A7278C05385C80702BED
SHA1:	CE2173E2C3DC7986BE77D240568B10210948F3FF
SHA-256:	C92ED5E536E431F6CF54C9697E267A7737F0EB30A2FEF2BA9D148079A12561B6
SHA-512:	E9111C3F486E26413F4A07D904EA19954F3F24291E979A776831F83436AEE2B8DAE7B6FC8D17C5E533E32A419DC9656B1B58C4CC8F366931B90AAB55598F4D7B
Malicious:	false
Preview:	2024/08/31-14:41:54.218 1e60 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/31-14:41:54.564 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0019698841236789875
Encrypted:	false
SSDEEP:	3:ImtVd6F//:IiVUN/
MD5:	D94361E3D542A387266BFE4D8C042770
SHA1:	D0BB851F9F0109151A7FEFFD0FB6FDA7F5FF95AD
SHA-256:	00334CE868AB77A1ED3A836690C6FA3140DE52A6E17D3EA9CD56398B91987B77
SHA-512:	3875A0BECC013E09478A953221F83215358717A8AB4A251611EE66E072D1029324F22F7403E80E6EC46B36B28749323D4449B35816E8AEAC025C5D2B992A3FA8
Malicious:	false
Preview:	VLnk.....?...........#.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0769985631523178
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOKSAE+WslKOMq+vVumYEyn66:e/2qOB1nxCkOKSAELyKOMq+vVum+p
MD5:	A969A2BA5A7E7160925191C7DE89D1E6
SHA1:	0DFE1F2A4DC176C27092BB69CCD02F2087E1C31D
SHA-256:	AD77FD6CC3CF531D71D1AFE180CBBEB6E3433A2345987B28044893599D0FF7F0
SHA-512:	CD6EFFE9FFBCBFE6E93BA36323C33A8E386B20876FA3B87A8B70B4AFF2A735D93EA24025FF83A9B9393786C1FEC8F039B76A05408FAF9F898553A468542D1825
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ba9fa407-8d67-4509-a246-dd7ce4bdcf9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\f5f01fd5-5362-45a0-bd8b-2ef0b9f62487.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6527
Entropy (8bit):	4.973582742610591
Encrypted:	false
SSDEEP:	96:stiPqf7is1w+b9sOK1NN8zjs85eh6Cb7/x+6MhmuecmAezoTQd2Mh/EJ:stSFssh1NNkjs88bV+FiA3uPhMJ
MD5:	BDDC450C8E3959290EFE5D34C83C133E
SHA1:	7E3DCFBD6449D48880B90D5C9573F6A80A3987E0
SHA-256:	4EE17B3B055C21D5573B776609267D16193BB2573942F9CDABA30C7CC2C1D820
SHA-512:	3E4BCC69AAD220E961BEF738DE903F0D06F3BD8169A448F5172823667117EAD9C91E428C8428CB337367D1BE22F23B9F9CA61BD3F97D52E912094F0157856F6B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369603315272001","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369603315271489"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/cMRl/FlFll:7+/l/v
MD5:	DFDFA7F6C92CD6E4A08C53EA9F1528BB
SHA1:	98666B39BADA671068B1AD5B3CAB30187AD90813
SHA-256:	3D8D27CC1EB551333595B211AB201F25D27763203B8F28E464689D559EFC6DEB
SHA-512:	FB040B75FC0BCD41B5AAD4B83BE1DE047DF0E51478580836C826B5EED434B346A48A9A49499C625428677CDEF90B5D41158A3E13EE7F880B7B31AE2CD095A536
Malicious:	false
Preview:	.... .c.....y8k.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.049693729172318395
Encrypted:	false
SSDEEP:	6:GLW0wDU6I/RW0wDUwkL9X8hslotGLNl0ml/XoQDeX:awDs/ZwDBAGEjVl/XoQ
MD5:	5FDF9FB68E07C35EC0233BCE060AC853
SHA1:	D6032BCBFEA080F6B948FCD06A81EBB86239A8E2
SHA-256:	E5548149816E2B7D599D988A1FB8863D3BE7CDEF55179E7688F9FA6ED9296ED8
SHA-512:	467F9C83EF90C9C0CB7ACCBE575D2157448D9EE7DFD2CCFD66AC9A573E3BB070DFB2D5F3F259B037A4C524E795C4869A9DDCE397A288AB7A1BB8C58BD9A2EBC6
Malicious:	false
Preview:	..-.......................$...B..8.W...iC.>...@...-.......................$...B..8.W...iC.>...@.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9964264115213367
Encrypted:	false
SSDEEP:	48:9WzxsFslO+XIcbX+On9VAKAFXX+Q2VAKAFXX+vxOqVAKAFXX+ynUYVAKAFXX+bSc:9OxsFwy3Ns8NspO5NsdNsbd
MD5:	B7802FACF6BDFD6D6B6DC61A639BAAE8
SHA1:	B0C4AEA733DD6717DC1DA9714EB71D5F6835E5E1
SHA-256:	F525C77E43F148B2AEFB1B9D8D9F669F29CA953A8EA79EE21B24178A56CF52D8
SHA-512:	4D4B88EE78A4773850294A1DB4F6C4B61D92356DFC2F0F094E7B405452B35A54B852EF52D5E2BE2DB66072DB1502CA0675AD8FAA0ACFCDFB40854C82BE1E4113
Malicious:	false
Preview:	7....-...........8.W...i,.;.N@...........8.W...i.Q.1b{bSQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.47691705672037
Encrypted:	false
SSDEEP:	48:e8SSBStVgQAPkuHRHXxtIYjIYzzVFqk2MYjMYjyMAlkfAlk43:J0t+QzkIYjIYzzjb2MYjMYFYcY93
MD5:	C0ECD0DF0E6843E4466D5DF5657019B7
SHA1:	B1C4E2CC6AA38BFEB7F8D5DA2D891000B61200E8
SHA-256:	2D3E01FD2F8759C5BE4FBE9238956B48809502E25BA144CEF13F603A5D88FE05
SHA-512:	33FE17344A213A57C4EB1B746E262F691EA5DC08981C01D1D1C5A82F3BF488D7325ED98613226C2039B15CD70B218D569EFA8BE94D72CA4268763907A95F4359
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1Cc.T.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.259675899826322
Encrypted:	false
SSDEEP:	6:h54z+q1wkn23oH+Tcwt0rl2KLlH53Iq2Pwkn23oH+Tcwt0rK+IFUv:h5M+1fYebeLZ5YvYfYeb13FUv
MD5:	C91035A38300C8FF33415581BDFBCC0A
SHA1:	198A5C4C911A1E42B3BF137F7738E2BB834E337B
SHA-256:	34B8552F2F3A944D3E8CC8C8173FF7B2BCFEDDC37D43D2CC83A236A2DC77C015
SHA-512:	3BFAAEF878BF501B97D7A11234343A50EEB5FDD8CF73C36B4E8BCBB19D3395AC9A51D32D136B196CCBE75F1A4C0F97A4FE292E0576AA974C4AC24D5C0A8B4EB8
Malicious:	false
Preview:	2024/08/31-14:41:54.757 1e60 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/31-14:41:54.840 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.958141412815535
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wui+it/4JbZfPStub/RG0lbANqa:G0nYUtypD3RXi6FZfc25m
MD5:	FBC524D02048C176A0A5D1B8B752932A
SHA1:	294C48557549A4C978326D9B7969E293A024F157
SHA-256:	F3FC95AE128DB918FC126F15CD9D96618482BA6ACCC622AAA19B10CE80B15EA0
SHA-512:	9B6434442E11610B8B5DDA43AA56656599925C9C8F0A364DDB69D15B37A912D223EE600012468E0DB723CAF3546FFBDF56F085A0159EA7968BBACE894AAFF856
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.224051805969777
Encrypted:	false
SSDEEP:	6:h5Yyq1wkn23oH+Tcwt0rzs52KLlH54q2Pwkn23oH+Tcwt0rzAdIFUv:h5x1fYeb99LZ54vYfYebyFUv
MD5:	5A1A8A3DDC5D6D99AF6388F84DE7ED99
SHA1:	202756DD5318195B22DBB41B372A7E1E301D41E6
SHA-256:	8905A3870959B03C1E69921C65C10B54B6456DDA484E9F3E070704C395CD0E26
SHA-512:	33AA27B0F3DB2F7B449683A8339F2CEED70D47AEE8A1E5D6D5DC1B2A26CCB8EA0D1AC3E92C2F5B3D941AF21252360B3BD435AC8A1694B6834A4E86D8C0D89E91
Malicious:	false
Preview:	2024/08/31-14:41:54.731 1e60 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/31-14:41:54.754 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlNDTt:Ls3xTt
MD5:	24A3F868CAB5AB2A0705B6202EAEE480
SHA1:	B4AF06D97297E62DA6262FC1A1F4AE0815F84CD4
SHA-256:	9DA0454BF8F3A573FE0E83F5DCD076514D7241DF29DE75F5516A00BD37F43043
SHA-512:	F8A6298F5E3E895FA5FDC2F42E8F6AD1BDDAE67BD66A88354950C2ACA0FD3AA27592AFE66FE02BE85429DAE48E12CAB6FCEC345243F5609D4A161D09502CBA34
Malicious:	false
Preview:	..........................................kX../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlrq:Ls3rq
MD5:	23C481AC9094FD5D6A4C7023AF8A2813
SHA1:	2E8C91B737EB7743AD4755E2EE8DCF24110A1936
SHA-256:	1496BF75F239057A8E082B5EE172C73BB24E0FCCA0C32967E1F4B02A4C8FF3A0
SHA-512:	743B2159809C9B04B69C4A503D08452F82A390B26544F51A118897DE0F64561C461159D51C66F88358FA54AF2B5EBA44FF2E4AB8931E679300DF4DEEDF987062
Malicious:	false
Preview:	.........................................{mX../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF286f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF288ed.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF288fc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2afce.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2f6f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF34b81.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF37243.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF39972.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3fb68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlfu/:Ls3W/
MD5:	3AED8319EF792CB36A19BED341E95C7C
SHA1:	328251E81EE06D487B65FFF3620F9E3993062CAB
SHA-256:	78A759A2ADBD5CC803711CC763D842BA7434C39574FA21552BBD3DBC94DCDB58
SHA-512:	F3DB1F882B30AAAAA18F52F32DC920E7333389440AF24D5E5D3AD9509ECAF62357092E0E51196B97E956F203AA2A38ADAA867C181E729CC2D088B7FBB408A436
Malicious:	false
Preview:	.........................................'LX../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\beb9b3d0-c6ba-4902-9628-4b5b0f4da751.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20971
Entropy (8bit):	6.065424304846476
Encrypted:	false
SSDEEP:	384:gtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSELGiwpTXe1h0FoN6ONMg0r:AMGQ7FCYXGIgtDAWtJ4nY6lpTs/N6ONs
MD5:	F3D4A1216CC00D0ED4168AA80C58FB94
SHA1:	93DC06B4BD0EA50BF7D5EDF58A04B277F9AB39D3
SHA-256:	4BFEB5AC18A02F4580DDAD1F84487D0136FE58C373536026991FE92AF062696C
SHA-512:	5CF85121F443B696724CB4AFDF12C2823506C2C00004DAEF7EDC30CA5748909A407C42F971A65A069AF12A907949601D4B283AE34912ACAF701461766B97AB59
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603315630539","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\dbaa9f8d-b7ec-49ef-91cb-cbd371fa333b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20971
Entropy (8bit):	6.065427543473789
Encrypted:	false
SSDEEP:	384:gtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSENGiwpTXe1h0FoN6ONMg0r:AMGQ7FCYXGIgtDAWtJ4nYglpTs/N6ONs
MD5:	FA2BB802CEF062B5D4E0C557F2933F19
SHA1:	CE9AEA6D5703D0E35AE10D3D1518954E15216795
SHA-256:	5E9C8215F07C931BBF6153E063FB3047FC1946CB4CF2F12FCDAC741ED32773D6
SHA-512:	31D73B4209BE1F0B8445BA6741979CA8C8CE284FE01201ED3B873E1CBB221094FE31AD901906DDFA999DED6EFD5DD95CFC34B0A1B20604E9F27982863B659D3F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603315630539","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e0e1524f-f840-49e8-9279-cf9a93f4392a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.589823162559687
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0aflpkXFa6bukHB+idrxCRvByzljqRy1aJkXDcEwlR4X3xB0:Xq8NkC1fleJbRBrwvkz8ygJkTcpCxq
MD5:	A458AED26B4539608585060698BBCB5D
SHA1:	510D14DF78B58B5A67867E0398DDC2E81389156F
SHA-256:	B6AB1B778C974B74616D3F3376422566E0DA76851ECEC97AAF72F67B054F8D8F
SHA-512:	A1C47010A236835490A9C37654728472A13FF96BA397A5D0C682EA15C8E045DBB48E4BA21304DDD8A22EBA679B767828075A1277CF75323BB3DC3BE94E9852A6
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"policy":{"last_statistics_update":"13369603313620872"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e32383c4-1894-4cc3-920b-cb9447e559d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.544264591038721
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtBdpkCYVFcPyau6yikSKxJdXBuBuwBcraQlONhMoXfW/QQRCYh:YuBqDPaflpkXFapbugBzByzlIMovWYB0
MD5:	47569BD87AD387646754F3BF6C5893F5
SHA1:	C7D2E07685D42F9AC6C575BB66E62B5726C9EF2B
SHA-256:	CB8FC75564FFC02BC150F5844FB92DD97A7CFDE0CF32DDA6641D0E096AF2C57B
SHA-512:	F3105CE8382978F4001CA3DCEAE62DFC2CC2F597C68171240FA8C8C3D9A7F5539E11F5652693F14F6360F59A6C9765D4BE7BEA3C584BE906008FAD0E7E12DE51
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR4EaUw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369603313579351","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725129713"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\fd99e337-746a-43d6-8cd4-775674b362dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.496849069233924
Encrypted:	false
SSDEEP:	96:0q8NkGS1fleJ58rh/cI9URoDotolAsXBrwvkzjjOJkTcVSDS4S4SDS7eI4a:/8NBSf3eoDUwXJjjqkTf
MD5:	B92DF47BD4E68E00D71D34E783CA7435
SHA1:	B6488ED9C8A77592C4B4405BA26156D5BE156945
SHA-256:	47F7D83BF3D5BBD8D99500A8AAC910C01EDD5F24E6424B353DA96F826AAAC51E
SHA-512:	B4FDDBDD8163A4F173B580699C3B6BEDC4465FA0D60A9F52632AF09DEDB113206AEC748F02DA360BCBFD6471FDD725293A0566980B7FA5828B28F2B3231E3BFB
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAD2yknUtjWXT6dTrhvdlmFCYzYC2TNjYWj5kiHYoma5hwAAAAAOgAAAAAIAACAAAAAGv0zp200DL8SNvDE9SkXcRRWsGO7kAw6EwtonO58izDAAAABzvqERZOdgpVE8wYJh+9f6TfgOjhqGezHhPvKEIMQ5kuu747ObJiDVrE7lYFOTGulAAAAAVPjWwemUGVcJlP1jU4a8l3gKJKfJ99zR0QZjqZeEELiC4v34DfmOfZ2j8R4PzTmK1VWpwQv3IJbcyL4UR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\177adf83-5957-434f-8316-2f729e397320.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9456
Entropy (8bit):	5.840388250139565
Encrypted:	false
SSDEEP:	192:fsNwttTXeiRU5QxQ/2jkkT896qRAq1k8SPxVLZ7VTiB:fsNwnTLAUQ0/T896q3QxVNZTiB
MD5:	E9E28429FC31D80B143AB156CDC34F94
SHA1:	A9E9798CB18B8E21C13B5EB83C5127C25D2C45C1
SHA-256:	E4FD3B0CCCE873036565D5F945C6D3B23DF963C14CDB306D2DFB08378859B6A0
SHA-512:	04A3DA2DB3F8C93811EFB8D134FCD34BD59A4ADA24664BD16F77F1AEDEB141CDB555ADCB73BBA4701190E6D821FC955848328B83DD7031610036B0A9137C42CA
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\20f7a189-ea90-4911-89fd-5597aea7a488.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59867
Entropy (8bit):	6.081452380824043
Encrypted:	false
SSDEEP:	1536:aMGQ5XMBGvzaf8dP0SXn0acUAiTHg1rszFl:aMrJM8+kdP0SENU9H0rszFl
MD5:	0411F305836B497335B0B3DE8BFF90BC
SHA1:	52A26430CCC1B4DE6A328D15E6AC4FA7C12F8830
SHA-256:	C5A93D4C3EC28C9BFF1B6014E92D135A2183064D6556DD0615C2CB88D322E2B1
SHA-512:	92E5487E4DD5BA82ED7E0F2F810A78B880014EAFDC28AE8B46DC0D72462297548031A452B22595D6481E7FC51AFD3AA26EB031467BBE6E139ED235BAD27BB4D1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603332999101","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4a6620f0-8903-411c-b8db-1367f9a488b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9440
Entropy (8bit):	5.839319962071954
Encrypted:	false
SSDEEP:	192:fsNwttTXeiRU5QxQ/o1+kT496qRAq1k8SPxVLZ7VTiB:fsNwnTLAUQYNT496q3QxVNZTiB
MD5:	E9929CA6977CD79AF97CB98F4529EFFB
SHA1:	73A568A6C8F0824EFD2E06BCA95C2873DC3B93D9
SHA-256:	94C5FF10CD8F64E0AE952184A2378DCDC62A60F576B689AA3C1438B8578FB650
SHA-512:	AA0825D9009BB6E0EEADA481004527C2103539900FBEC990EB67FA4A7E347F12EA93B0F2DC1394589D383C2D09DF0135271A3C9648DDE9DD460D7C7E64E778C9
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\576948ec-286f-4fa1-934a-efb74accc4a8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22019
Entropy (8bit):	6.058567252690762
Encrypted:	false
SSDEEP:	384:WtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNw0T4V0CTw+Mh0lkdHd5qy:aMGQ7FCYXGIgtDAWtJ4nwT80CTgh02tj
MD5:	93519278458E7B32688AC29FF566E41F
SHA1:	A3CDEC7C17E2ADCCE23CC527068523F3DE31FF60
SHA-256:	0CA208B1AC84CE8EB81C69F54E5B9777D183FA1123CC97DDF9741CDDE8A27BCD
SHA-512:	6470F28FD70CD9EB04194438F4276B166256875C2213C312B95279C05F5481C0F6065AE44ED1A1BD3DF113C0EA9C6E25EA7009963C97DCE125AB7AAB4A497A48
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603332999101","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\626d694a-4754-4b93-ba8e-c2efb2a92713.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9440
Entropy (8bit):	5.839319962071954
Encrypted:	false
SSDEEP:	192:fsNwttTXeiRU5QxQ/o1+kT496qRAq1k8SPxVLZ7VTiB:fsNwnTLAUQYNT496q3QxVNZTiB
MD5:	E9929CA6977CD79AF97CB98F4529EFFB
SHA1:	73A568A6C8F0824EFD2E06BCA95C2873DC3B93D9
SHA-256:	94C5FF10CD8F64E0AE952184A2378DCDC62A60F576B689AA3C1438B8578FB650
SHA-512:	AA0825D9009BB6E0EEADA481004527C2103539900FBEC990EB67FA4A7E347F12EA93B0F2DC1394589D383C2D09DF0135271A3C9648DDE9DD460D7C7E64E778C9
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7bf1f06c-d804-40af-bb8d-d0976532d843.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9440
Entropy (8bit):	5.839308476468457
Encrypted:	false
SSDEEP:	192:fsNwttTXeiRU5QxQ/FyMkT496qRAq1k8SPxVLZ7VTiB:fsNwnTLAUQAHT496q3QxVNZTiB
MD5:	8B442E95090ACC42BD68961876CB6D81
SHA1:	CBE2BD427F87A94A64318C83C4A1B33D3148593C
SHA-256:	69F0CCC658548EF55D522C07D9407EEA72BF35329AD5FD2AC718BF3C44B762DE
SHA-512:	5158AE9358CADC1BBECFB64647D1EC54B8734405E9BBCD0C0A062D022E1D1F5EF9FC84CBCF504A463FAEB1A5351753DDAA6F5C4B592E26B6B9521DBE1ED7705F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\865d5336-d9de-4676-a303-c53539becabc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59828
Entropy (8bit):	6.0814616387628915
Encrypted:	false
SSDEEP:	1536:aMGQ5XMBG2baf8dP0SXn0acUAiTHg1rszFl:aMrJM8/kdP0SENU9H0rszFl
MD5:	A1BCD85AA2C4A88B026F6055EA0C720C
SHA1:	771965E11D23405C8D5A1D9B59A1195A6571B6B5
SHA-256:	D553515ED6E4977E96C17C41A5B50BCCF9B53ED563289311417FE2F00A57FDFB
SHA-512:	462ED8B92100DB842FE29B5AD640F6C7931DAD558EA8FFA9ADCC1E3973CEC3B4DACCC020C58E41F760751794610873DA0E208422460F550B722E0E94C9388F84
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603332999101","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\1442123d-1b63-4224-953f-d34c4014ef27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D36404-23F8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3123519015378672
Encrypted:	false
SSDEEP:	3072:vUWzdq//ixe2nX8DAXquikMEZkQEXf4m2facM05jVjLBkkXyUgdqOygfr59OEpQe:Bse3BEXf4nlakEXaHlm/
MD5:	68422AB17A7CE4F004E0B1E9709728D6
SHA1:	5491E0FAEF14F5260758ADD7B9281054562D439C
SHA-256:	056655CADA039E858DE84BD0E05234A36E990FD06EA9F547924CEB2DF07436CC
SHA-512:	F80C407C2FE2FD7DA4F78EF98B74CCC28A43DCA37353EACD40437059A7018769D5E10EF80C93E959D534672C3CC911F6CFED7F9E8C53872B88232EA3487F3F4B
Malicious:	false
Preview:	...@..@...@.....C.].....@................R...Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".himgbp20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3640C-9C8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03974969604962081
Encrypted:	false
SSDEEP:	192:D00EbtmqvDtKX7SJEa3XxxTVwg7XGiV0DA5DhAVNTU+O1gQtm3rtq01n8y08TcmQ:I0EtleQtnnhU1ag93ZX108T2RGOD
MD5:	366C7488626100611C9661B0E125DBFC
SHA1:	1E36424C24EBEA90A04813D976E877384B351A22
SHA-256:	859FF860354587F79FFC175E0EA4CC5BE9E28BD5F422732389351B6AC4CB6F21
SHA-512:	515A368D108A095F65FF732036C53E41CFC6362E843F755B10B066784F0453CF91458A960078B48D10169AE42CF63B7491EC2AB44935D88C2C62CBE132BD613C
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".himgbp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D36414-193C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03877156562072818
Encrypted:	false
SSDEEP:	192:tU0EbtmqvD3KX7bJEa3Xxx7UpXxgg6zfhj1NErZGtM1gQMC3Olfqln8y08Tcm2Rl:C0EtmeZVQh5WWsg+3MS08T2RGOD
MD5:	451A36B6A4D1DACC64712ECA3E26951D
SHA1:	C931A533693CBBD3F090AECD62107C8057B61EA1
SHA-256:	A281FDD1818386EE1BDE87BED5B601082177F364158F48B81C0521E123F5AA58
SHA-512:	98B647BAA5534FBDD0C22153A5D0C4382485A087F364C127515D73E9F239FE65DB3BF884AA41A8F2EA199D4FE99EF87CDCD178BF62528A21631725E923058575
Malicious:	false
Preview:	...@..@...@.....C.].....@................\..PL..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".himgbp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D36422-15CC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03916076578704139
Encrypted:	false
SSDEEP:	192:ND0EbtmqvDHKX7xJu3BhESXBtghwwhEgrTNEAJvs1gQMlaJCfqYn8y08Tcm2RGOD:N0EtItX7hXFtMgBa2n08T2RGOD
MD5:	A060682F22DE531FC05372BAEAC95F73
SHA1:	B474A956FA20AC067A9FCD5778F8E8655B896CD3
SHA-256:	98A807F9D0809BEA4AA47B18DDD26AC29833E63BECD70C73A2BE02B3598AA06D
SHA-512:	E96CD8EB6FAD1106442A6926EA2BEA9DC3E7A41F3B0B2982E48EAE9A11916A4D9CDC341D1D839CA6276935EA15A171119193C50E206BA0D8320DEF2DBE914952
Malicious:	false
Preview:	...@..@...@.....C.].....@................^...N..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".himgbp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0d8ac55e-f3f3-4cee-85dd-501c8a6a4fb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.184137452987188
Encrypted:	false
SSDEEP:	96:sVwqlRJ1vb9siKdYuX7kxoSSvYvqsY5Th6Cp9/x+6M8muecmAeCj/e4zvr+2X6gM:sVwuJsFdP8evYvqsYPpj+FVAn+FBf
MD5:	65F5EDF08286F5F81DC0D96485C6E2F7
SHA1:	76111F24FBFC0AE623685F15638E5BD5F26AB1AA
SHA-256:	11782D3FFF254231236782360D46400C4A4F7663405BA352B2B0DC7816E86AAE
SHA-512:	A92E52301F99FF247232017AFCC25482B8B2E71714278E65E165790EAA001B3DD4D7AE434B20E19E22AFB88CCB0A480C6D5A8C0E3A1C1B7B8BDF5994ECA0F7FC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369603333061218","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\158705c2-1f64-4b60-ae86-8c52606d335f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\60d57c62-4208-4799-9283-ab5d25f7c8fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\70aeab96-f7db-4a11-a98a-be792909b176.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0646151692291355
Encrypted:	false
SSDEEP:	96:sVwqlRJ1vb9siKdYuX7kxqYvqsY5Th6Cp9/x+6M8muecmAeCOe4zvr+2X6gE5Aty:sVwuJsFdP8qYvqsYPpj+FVA4+FBf
MD5:	67543B6092AEEFF1D149D85662FE1C42
SHA1:	146DC3B1F6EA0743D059B07298A43440099D5A46
SHA-256:	669C8012A9EFD606494679B44537EECBA0559C19A30195BDC47A68683B630BE4
SHA-512:	4F15783BFD423BE93D0FC95CCBE5E875CAB4BCC24F6514077CF6D1677180EC7260991FDD97C8526A0F3D330F2CE71A7FDAEAC0B2E3177F445D1573C062DE9D1A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369603333061218","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321411947811153
Encrypted:	false
SSDEEP:	192:8AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:/OEOKSXs/J7mGnQmLu5/5eNdl
MD5:	668EFCFA36663698B41BE5729A3AAEE2
SHA1:	36B0FF50E5F9C5318FECD3DDCE930E8AB149CCEF
SHA-256:	B5F701CF196F4DB44B20A4A732C09EFB90B85451D270A78D522A2F0502935966
SHA-512:	890D89B798F7477586F16E09D9504BBA2FC3F18CE9B73EAC303CBC3C4B698B8468FAE4B236C5C6DF48FCFD97AE87322D8018FE3C309D0E63892D7537B000D745
Malicious:	false
Preview:	...m.................DB_VERSION.1..X.................QUERY_TIMESTAMP:arbitration_priority_list4...13369603335213557.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.099889546425631
Encrypted:	false
SSDEEP:	6:hJ8RQMq1wkn23oH+Tcwt9Eh1ZB2KLlHJ8R4tfSQ+q2Pwkn23oH+Tcwt9Eh1tIFUv:hJAz1fYeb9Eh1ZFLZJA4tGvYfYeb9Ehp
MD5:	BCA74AA5C5881E58B0F4446F76D4D28B
SHA1:	3219F0AF53D10AA8CA7A5E36F95B856AB9CE079B
SHA-256:	DE8A75B77AEAF46C3B8292CC323F0155C9D8C25580F15884C22CC0674AEEA0AE
SHA-512:	216BC24194B32D0B321FBFB033C427A58363081087D84C146462D257AD937268F94361FE9F682C556BE05590EC0536338E7C1FA661AE68B55527DEBCDD7C7661
Malicious:	false
Preview:	2024/08/31-14:42:14.162 288 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/31-14:42:14.351 288 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlYpll/:Ls3YpX
MD5:	A8865FC35572CD942EBFAF284F64856B
SHA1:	CEB5CBB4278BF28C0EED15378D908ED1F4ECFFF5
SHA-256:	73A3D7B8DD523288D7D1BEA321D085C1A0B5BE9595C5BD7DAC72C352D989FEA4
SHA-512:	289A9DB18884A108E9212C8593BEA0429A15932D41841619BC247693F5D4E20119C87203409F99BF389E6CD6258ABC275091F6F672EA29E5CA0554B513CF0CB2
Malicious:	false
Preview:	........................................u.xY../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.182629017956631
Encrypted:	false
SSDEEP:	6:hJ8X/9s1wkn23oH+TcwtnG2tbB2KLlHJ8OBlM+q2Pwkn23oH+TcwtnG2tMsIFUv:hJWfYebn9VFLZJhM+vYfYebn9GFUv
MD5:	54672D0A147E8664B37184E13E7DFF48
SHA1:	DE32A9183DF923401911707AD02F90E0FA1272BC
SHA-256:	5D40216328733999B87D56DFBABC7D2D66933A1A427C9BB2D48F9087BAFFF14B
SHA-512:	1DCDAC1E75FF2AECCC2544AC1188FD4BE9E7317375287027CDD32F28F6548A8A3396BF58EE94BF9B8EFCCC94FBE37FA35DA5981AA00DADA28EC6E32B8F643727
Malicious:	false
Preview:	2024/08/31-14:42:12.919 1cac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/31-14:42:13.025 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.152792735003465
Encrypted:	false
SSDEEP:	6:hJ8XOFUH0RM1wkn23oH+Tcwt8aVdg2KLlHJ8XsVq2Pwkn23oH+Tcwt8aPrqIFUv:hJU0RrfYeb0LZJvvYfYebL3FUv
MD5:	AADE28F015686B2715B39E5438FC7261
SHA1:	2944FB0E05FFEAA45E1C4088AC4DEBFD54C606DC
SHA-256:	3A96B639DB91F5525FCC0611032B24C47D289B2F4B3320921C4387EF4EBE971F
SHA-512:	34BC91A2FA60D88C859FBD7721C39377A2BB5AACAE05276B06AA3C5C4CA8367C9A27ABAB4A421F05A16421CEB2C9916AFE0ACC4A204202129A60362811C106AC
Malicious:	false
Preview:	2024/08/31-14:42:12.920 1d24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/31-14:42:12.939 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.147013550485691
Encrypted:	false
SSDEEP:	6:hJ8XU5RM1wkn23oH+Tcwt86FB2KLlHJ8XyVq2Pwkn23oH+Tcwt865IFUv:hJp5RrfYeb/FFLZJdvYfYeb/WFUv
MD5:	B76E8BC3EA527EB367978B8211245F50
SHA1:	429BD320F1D7C116023DDE582FBF08F54D9F05B9
SHA-256:	022365C4C1418240F8961BEBF9443B72F70FF644A8BDEE91B0FAA2863B5C2F18
SHA-512:	D804C69DEEE340624DF6BD8AECE28C445F6E23C2582370F1D9F5E4823E381FDAF14376317B6F890FD78AE126757AF8338ACB41D7F287E9A7C1223BA41449B538
Malicious:	false
Preview:	2024/08/31-14:42:12.940 1d24 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/31-14:42:12.951 1d24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.154111483333705
Encrypted:	false
SSDEEP:	6:hJ8l3+q2Pwkn23oH+Tcwt8NIFUt8QJ8EgWZmw+QJ8EXVkwOwkn23oH+Tcwt8+eLJ:hJS3+vYfYebpFUt8QJB3/+QJBXV5JfYN
MD5:	1F1D51B824F3FE17D9F1BC306E56675B
SHA1:	442AB0AF7925F3D90A93F09679F2DEE5BC656837
SHA-256:	10F65F45A3E3874FCA49F078BF38162FCEC61316AE7E1FC7465BB353DDEA92E3
SHA-512:	D0309F09C257B3951EA4585C07B230AB5BBDEB542023480CEE5E9430913DBCE281433FDDE940CC98629CEDCB282F5FC03C0BE9AB3B7D5E7053A92510391E2C58
Malicious:	false
Preview:	2024/08/31-14:42:13.076 210c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-14:42:13.077 210c Recovering log #3.2024/08/31-14:42:13.077 210c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.154111483333705
Encrypted:	false
SSDEEP:	6:hJ8l3+q2Pwkn23oH+Tcwt8NIFUt8QJ8EgWZmw+QJ8EXVkwOwkn23oH+Tcwt8+eLJ:hJS3+vYfYebpFUt8QJB3/+QJBXV5JfYN
MD5:	1F1D51B824F3FE17D9F1BC306E56675B
SHA1:	442AB0AF7925F3D90A93F09679F2DEE5BC656837
SHA-256:	10F65F45A3E3874FCA49F078BF38162FCEC61316AE7E1FC7465BB353DDEA92E3
SHA-512:	D0309F09C257B3951EA4585C07B230AB5BBDEB542023480CEE5E9430913DBCE281433FDDE940CC98629CEDCB282F5FC03C0BE9AB3B7D5E7053A92510391E2C58
Malicious:	false
Preview:	2024/08/31-14:42:13.076 210c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-14:42:13.077 210c Recovering log #3.2024/08/31-14:42:13.077 210c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3281731663735024
Encrypted:	false
SSDEEP:	6:6A/J3+t76Y4QZZofU99pO0BYpqR4EZY4QZvGln:rhHQws9LdRBQZGln
MD5:	27540EA5E4B1FD57593D2DB91796CB8D
SHA1:	8F790DB0A18DF880BC4364271E163F6379875B19
SHA-256:	4D348400E4A23CD3D8A1B23DCD1C8441F5B89ED2A04711E4045F19FEEC65F21D
SHA-512:	687E52A38DA813B19A4B26C7B835599D5992A14765F5184E49716E962067E8D4A7E53480DB52FE6D08B661BC11BE5F124A4589C8FF112C89117E5B910AD6B68C
Malicious:	false
Preview:	..............#....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.224314066939193
Encrypted:	false
SSDEEP:	12:hJZG+vYfYeb8rcHEZrELFUt8QJZj/+QJZTV5JfYeb8rcHEZrEZSJ:hTYfYeb8nZrExg8QxXJfYeb8nZrEZe
MD5:	AF576E0B9A509E3397BB521B55414D3A
SHA1:	63B2F2F5BE75BCE5842F921D578BB09E1FE5D8EB
SHA-256:	2E8886C7210244879842FC25E3452072EC498D342AB177E98E74DFAA1CA4E30B
SHA-512:	FD20E2313AFCBFA53F0D89D7C2ECE80F0CD4528185E8B23348A9E86930EFAA9A60D1C7E9C9924F05C2344A2DE5D5093E776F8F7A62F6310ADF494FCED7BDFEBD
Malicious:	false
Preview:	2024/08/31-14:42:13.823 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-14:42:13.824 1cac Recovering log #3.2024/08/31-14:42:13.824 1cac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.224314066939193
Encrypted:	false
SSDEEP:	12:hJZG+vYfYeb8rcHEZrELFUt8QJZj/+QJZTV5JfYeb8rcHEZrEZSJ:hTYfYeb8nZrExg8QxXJfYeb8nZrEZe
MD5:	AF576E0B9A509E3397BB521B55414D3A
SHA1:	63B2F2F5BE75BCE5842F921D578BB09E1FE5D8EB
SHA-256:	2E8886C7210244879842FC25E3452072EC498D342AB177E98E74DFAA1CA4E30B
SHA-512:	FD20E2313AFCBFA53F0D89D7C2ECE80F0CD4528185E8B23348A9E86930EFAA9A60D1C7E9C9924F05C2344A2DE5D5093E776F8F7A62F6310ADF494FCED7BDFEBD
Malicious:	false
Preview:	2024/08/31-14:42:13.823 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-14:42:13.824 1cac Recovering log #3.2024/08/31-14:42:13.824 1cac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.1912436061675304
Encrypted:	false
SSDEEP:	6:hJ8kGFwDM+q2Pwkn23oH+Tcwt8a2jMGIFUt8QJ8uPgZmw+QJ8BFdDMVkwOwkn234:hJ/pQ+vYfYeb8EFUt8QJ9Pg/+QJgFdQW
MD5:	B4C8EEEACE2C6F5EDF0EFC17EE5A68A1
SHA1:	057FB28E95262A3DCEEE0DB011940C2D87254406
SHA-256:	FC30904027F5A80E322735EFEF813BA2EBD4F9CD4F607096F4118A900FD4A850
SHA-512:	7CA42342754E850FACB7090C611129B474E1A6F4FEA838547F230EDF0AE47AB21E2396F3AA379877F7C639A142DE35B08324D36082F1E00819EE5CE1F8079416
Malicious:	false
Preview:	2024/08/31-14:42:13.677 31c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-14:42:13.682 31c Recovering log #3.2024/08/31-14:42:13.791 31c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.1912436061675304
Encrypted:	false
SSDEEP:	6:hJ8kGFwDM+q2Pwkn23oH+Tcwt8a2jMGIFUt8QJ8uPgZmw+QJ8BFdDMVkwOwkn234:hJ/pQ+vYfYeb8EFUt8QJ9Pg/+QJgFdQW
MD5:	B4C8EEEACE2C6F5EDF0EFC17EE5A68A1
SHA1:	057FB28E95262A3DCEEE0DB011940C2D87254406
SHA-256:	FC30904027F5A80E322735EFEF813BA2EBD4F9CD4F607096F4118A900FD4A850
SHA-512:	7CA42342754E850FACB7090C611129B474E1A6F4FEA838547F230EDF0AE47AB21E2396F3AA379877F7C639A142DE35B08324D36082F1E00819EE5CE1F8079416
Malicious:	false
Preview:	2024/08/31-14:42:13.677 31c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-14:42:13.682 31c Recovering log #3.2024/08/31-14:42:13.791 31c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\102066f4-e8d2-43c3-ae92-d8507ebf35ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\23a14588-d4eb-465a-9330-862f77463478.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9c42a6c1-1720-4eee-ba7e-a5e0be0a0a10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9e0b9240-1ff5-4758-bb25-ab6066ea58c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2fda0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3ec07.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d73b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2e5a3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2fdde.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b5af0d87-0fd1-43a2-9e9d-3debfefeedfd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.29699255069391
Encrypted:	false
SSDEEP:	24:YXsUZVMdBswZFRudFGcs1ZFGJ/dbG7nby:YXsM8swfcdsDgzbZ
MD5:	5CBEF784A78A001190E985096BBE4E4B
SHA1:	ECC1742C61DC8D46A8CC7DAFD90A6C0C177CACD0
SHA-256:	49C959E7DD42A4A607F898E26C3EF1A9D8DFC3E72DCBA743D07BAECE666D1C83
SHA-512:	E775B56B32B7A65B2738D6DD6FBA7E87DF1EF910FFF0A95928B32E2C9DD54064A0CF2D70FC97BB661166F1A8AD06BF7FF16F817067D4B5A2D271F9D711B8BC7A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372195335142737","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372195336236619","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372195339053050","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c5919c72-1653-4abe-add2-36bc772ab95a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fe69cd4e-7ec7-489a-bc29-3ca04510dd9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0646151692291355
Encrypted:	false
SSDEEP:	96:sVwqlRJ1vb9siKdYuX7kxqYvqsY5Th6Cp9/x+6M8muecmAeCOe4zvr+2X6gE5Aty:sVwuJsFdP8qYvqsYPpj+FVA4+FBf
MD5:	67543B6092AEEFF1D149D85662FE1C42
SHA1:	146DC3B1F6EA0743D059B07298A43440099D5A46
SHA-256:	669C8012A9EFD606494679B44537EECBA0559C19A30195BDC47A68683B630BE4
SHA-512:	4F15783BFD423BE93D0FC95CCBE5E875CAB4BCC24F6514077CF6D1677180EC7260991FDD97C8526A0F3D330F2CE71A7FDAEAC0B2E3177F445D1573C062DE9D1A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369603333061218","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF352a5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0646151692291355
Encrypted:	false
SSDEEP:	96:sVwqlRJ1vb9siKdYuX7kxqYvqsY5Th6Cp9/x+6M8muecmAeCOe4zvr+2X6gE5Aty:sVwuJsFdP8qYvqsYPpj+FVA4+FBf
MD5:	67543B6092AEEFF1D149D85662FE1C42
SHA1:	146DC3B1F6EA0743D059B07298A43440099D5A46
SHA-256:	669C8012A9EFD606494679B44537EECBA0559C19A30195BDC47A68683B630BE4
SHA-512:	4F15783BFD423BE93D0FC95CCBE5E875CAB4BCC24F6514077CF6D1677180EC7260991FDD97C8526A0F3D330F2CE71A7FDAEAC0B2E3177F445D1573C062DE9D1A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369603333061218","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e2b0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.0646151692291355
Encrypted:	false
SSDEEP:	96:sVwqlRJ1vb9siKdYuX7kxqYvqsY5Th6Cp9/x+6M8muecmAeCOe4zvr+2X6gE5Aty:sVwuJsFdP8qYvqsYPpj+FVA4+FBf
MD5:	67543B6092AEEFF1D149D85662FE1C42
SHA1:	146DC3B1F6EA0743D059B07298A43440099D5A46
SHA-256:	669C8012A9EFD606494679B44537EECBA0559C19A30195BDC47A68683B630BE4
SHA-512:	4F15783BFD423BE93D0FC95CCBE5E875CAB4BCC24F6514077CF6D1677180EC7260991FDD97C8526A0F3D330F2CE71A7FDAEAC0B2E3177F445D1573C062DE9D1A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369603333061218","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557124759606829
Encrypted:	false
SSDEEP:	768:HrtinS7pLGLvbeWPDDfXq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTeAvgrwFpbtu6:HrtinqcvbeWPDDfXqu1jayRvRvtF
MD5:	F13582E35ACCB81DDEF3B9524C02ADBB
SHA1:	DF98B2104A3E88FF7EA3F9958356BEE5C0E7AA2A
SHA-256:	D8170F310EFBEC9667CB9D880B5810500592897436AEC2EAE6D37A1A31150981
SHA-512:	217809657FFDE1547794DEC98C4D2314925B065B35121AF852E60DA5E370CDC4D727ABBA8375B80F018AFED40E68C0D80F5E6E75D28877280709C264C0F3E969
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369603332826481","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369603332826481","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF33818.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557124759606829
Encrypted:	false
SSDEEP:	768:HrtinS7pLGLvbeWPDDfXq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTeAvgrwFpbtu6:HrtinqcvbeWPDDfXqu1jayRvRvtF
MD5:	F13582E35ACCB81DDEF3B9524C02ADBB
SHA1:	DF98B2104A3E88FF7EA3F9958356BEE5C0E7AA2A
SHA-256:	D8170F310EFBEC9667CB9D880B5810500592897436AEC2EAE6D37A1A31150981
SHA-512:	217809657FFDE1547794DEC98C4D2314925B065B35121AF852E60DA5E370CDC4D727ABBA8375B80F018AFED40E68C0D80F5E6E75D28877280709C264C0F3E969
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369603332826481","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369603332826481","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.103999294632594
Encrypted:	false
SSDEEP:	6:hJQfDM+q2Pwkn23oH+TcwtrQMxIFUt8QJRgZmw+QJUeADMVkwOwkn23oH+Tcwtrb:hJQfQ+vYfYebCFUt8QJRg/+QJUfQV5Jv
MD5:	6CB0B56D1EB19904E3A519DB13E6996A
SHA1:	09AD0C670A410D858786C80CCCDF59F74D846A8D
SHA-256:	8F36AC7A6C6A6A3C1BE80019DFF7BD4404CF2140FD4C6DD782A4DB380A43239D
SHA-512:	AD9381F30B21D113A3425CA076455149C7943ADC2D193B7AC57E8AE7A76E5FB43512CE4D34FB113905F2E29AD914C53908BFBC96ECEF05098676811AA0596174
Malicious:	false
Preview:	2024/08/31-14:42:28.810 31c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-14:42:28.811 31c Recovering log #3.2024/08/31-14:42:28.814 31c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.103999294632594
Encrypted:	false
SSDEEP:	6:hJQfDM+q2Pwkn23oH+TcwtrQMxIFUt8QJRgZmw+QJUeADMVkwOwkn23oH+Tcwtrb:hJQfQ+vYfYebCFUt8QJRg/+QJUfQV5Jv
MD5:	6CB0B56D1EB19904E3A519DB13E6996A
SHA1:	09AD0C670A410D858786C80CCCDF59F74D846A8D
SHA-256:	8F36AC7A6C6A6A3C1BE80019DFF7BD4404CF2140FD4C6DD782A4DB380A43239D
SHA-512:	AD9381F30B21D113A3425CA076455149C7943ADC2D193B7AC57E8AE7A76E5FB43512CE4D34FB113905F2E29AD914C53908BFBC96ECEF05098676811AA0596174
Malicious:	false
Preview:	2024/08/31-14:42:28.810 31c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-14:42:28.811 31c Recovering log #3.2024/08/31-14:42:28.814 31c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.13741448550476
Encrypted:	false
SSDEEP:	6:hJ8XyRyq2Pwkn23oH+Tcwt7Uh2ghZIFUt8QJ8XyH1Zmw+QJ8XyUHRkwOwkn23oHT:hJCvYfYebIhHh2FUt8QJB1/+QJs5JfYz
MD5:	3D1344EA9EC86450E4458E8C49EBE448
SHA1:	DFB8E1C7FC11E620CE85FBD77BE36EB7292B0E33
SHA-256:	28B71B5AFE86BC3570BCBDB4FDF7B508A4F70AFD3009395F0184B035062A9E89
SHA-512:	EB8A4F1F3BAF14BBFF7CAC12816CE32F2E65F5563E4C710A2D9EB0CAB267AA08A2C4C01C6D9416D40D14482DEF59D43B65676F132F746C17D25CD7FD1D1551F5
Malicious:	false
Preview:	2024/08/31-14:42:12.890 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-14:42:12.890 1d30 Recovering log #3.2024/08/31-14:42:12.891 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.13741448550476
Encrypted:	false
SSDEEP:	6:hJ8XyRyq2Pwkn23oH+Tcwt7Uh2ghZIFUt8QJ8XyH1Zmw+QJ8XyUHRkwOwkn23oHT:hJCvYfYebIhHh2FUt8QJB1/+QJs5JfYz
MD5:	3D1344EA9EC86450E4458E8C49EBE448
SHA1:	DFB8E1C7FC11E620CE85FBD77BE36EB7292B0E33
SHA-256:	28B71B5AFE86BC3570BCBDB4FDF7B508A4F70AFD3009395F0184B035062A9E89
SHA-512:	EB8A4F1F3BAF14BBFF7CAC12816CE32F2E65F5563E4C710A2D9EB0CAB267AA08A2C4C01C6D9416D40D14482DEF59D43B65676F132F746C17D25CD7FD1D1551F5
Malicious:	false
Preview:	2024/08/31-14:42:12.890 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-14:42:12.890 1d30 Recovering log #3.2024/08/31-14:42:12.891 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.6377872329235307E-4
Encrypted:	false
SSDEEP:	3:Lsul9SX:LsUy
MD5:	E877A5AF41A2B905063CCF3D2B4DCC3A
SHA1:	51E67EB8FF988BA5679601FF6E9B99B268E8EC77
SHA-256:	F44F24F92312C5E642C3E510A607C50205F012748DB817CCD51A8EC900D96CD5
SHA-512:	E38D53D2378E1258AAC4BAF99A6B6CD600A6939E286F05F25E9D988DFA0DE66E40A7BEB8BF1DD25A76BA077FE893FC1E76070FDF4C24963C32F025A4526BE4FA
Malicious:	false
Preview:	.........................................I.Y../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlU8Wl/:Ls3URt
MD5:	9D2DE0F7C9B9B26CEE21084EBF399BED
SHA1:	086337CF8805314B0BC23DC45AA07204A40D94A0
SHA-256:	9D041F0222F951A567A4B90E7804F3BDACAEB6A6012C40DD740D94992BE92550
SHA-512:	8FB796D0D71D2D98DF0903788D54987570DF5A9FB1F66CE4EF31B98B85FC7296EA2CC258821F9D646BB2425123AA272D554B9773187258EEE7C827A82C5D14A2
Malicious:	false
Preview:	.........................................>yY../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.234046860179433
Encrypted:	false
SSDEEP:	12:hJZuvYfYebvqBQFUt8QJZp/+QJZ65JfYebvqBvJ:hwYfYebvZg8Qf4JfYebvk
MD5:	4B1840498F8815576335379989C270C2
SHA1:	4C0200A4646C60BBEB1D23C17D443F0EE3900824
SHA-256:	7D0F88AE921CCBDD4B5E622DC783C18B4B0E50E80FBBFA59473308DD23C94424
SHA-512:	7A41C6BE1E39F464B1B84F5A4DC51FD5608DA4C728192F59CE34E32BCCEDE78336B448EBB8B07A22201C32DAED3A5B490D20142C8D11C7510AC7B3CEECF28262
Malicious:	false
Preview:	2024/08/31-14:42:13.823 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-14:42:13.825 2388 Recovering log #3.2024/08/31-14:42:13.828 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.234046860179433
Encrypted:	false
SSDEEP:	12:hJZuvYfYebvqBQFUt8QJZp/+QJZ65JfYebvqBvJ:hwYfYebvZg8Qf4JfYebvk
MD5:	4B1840498F8815576335379989C270C2
SHA1:	4C0200A4646C60BBEB1D23C17D443F0EE3900824
SHA-256:	7D0F88AE921CCBDD4B5E622DC783C18B4B0E50E80FBBFA59473308DD23C94424
SHA-512:	7A41C6BE1E39F464B1B84F5A4DC51FD5608DA4C728192F59CE34E32BCCEDE78336B448EBB8B07A22201C32DAED3A5B490D20142C8D11C7510AC7B3CEECF28262
Malicious:	false
Preview:	2024/08/31-14:42:13.823 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-14:42:13.825 2388 Recovering log #3.2024/08/31-14:42:13.828 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\19bb8608-2dc6-4931-89cc-f7c471fc0a9a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\23d5c383-d4bc-4ee8-8da8-0c1d2c0142b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\761f4463-4665-42ea-95be-4a5da2ea782b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3fb97.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2e5b3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d5c8f0e2-24dc-46fb-93de-d8c58dc88bf3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.247466206131241
Encrypted:	false
SSDEEP:	12:hJ3Q+vYfYebvqBZFUt8QJmSwg/+QJiQV5JfYebvqBaJ:hF5YfYebvyg8Q6aMSJfYebvL
MD5:	E1B328A62A61A2B73389AE868C53941C
SHA1:	5D7A65F377C1C9FE274DB7C3252B69B88A6F52CA
SHA-256:	2E57F52683E161A5268E8EA28C9B6E24CF839EE60443DF2409EE32FBEF2D8909
SHA-512:	1B34BE746E36E54F586F02B26379BD56E6E116013FA068AC37210A79D0492E15CAC9E1C54909922653BBE6D8DB921D0A92B0060D533DA80B98A046E5457E7F35
Malicious:	false
Preview:	2024/08/31-14:42:29.070 31c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-14:42:29.071 31c Recovering log #3.2024/08/31-14:42:29.073 31c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.247466206131241
Encrypted:	false
SSDEEP:	12:hJ3Q+vYfYebvqBZFUt8QJmSwg/+QJiQV5JfYebvqBaJ:hF5YfYebvyg8Q6aMSJfYebvL
MD5:	E1B328A62A61A2B73389AE868C53941C
SHA1:	5D7A65F377C1C9FE274DB7C3252B69B88A6F52CA
SHA-256:	2E57F52683E161A5268E8EA28C9B6E24CF839EE60443DF2409EE32FBEF2D8909
SHA-512:	1B34BE746E36E54F586F02B26379BD56E6E116013FA068AC37210A79D0492E15CAC9E1C54909922653BBE6D8DB921D0A92B0060D533DA80B98A046E5457E7F35
Malicious:	false
Preview:	2024/08/31-14:42:29.070 31c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-14:42:29.071 31c Recovering log #3.2024/08/31-14:42:29.073 31c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.212620020904397
Encrypted:	false
SSDEEP:	6:hJ8XuxQ+q2Pwkn23oH+TcwtpIFUt8QJ8XuxgZmw+QJ8XuxQVkwOwkn23oH+Tcwt7:hJW+vYfYebmFUt8QJ6/+QJWV5JfYebaQ
MD5:	CCE2B575C213809AF800D9A98005DD58
SHA1:	44EF4ADB59FF7371302475034A4790CE32381298
SHA-256:	1C73C9E1578352E2EED438B0BF954F0C7961286E07BECFC41032E7AEF455CDEA
SHA-512:	B13950D74D74C1AF8C558C120137AFC19D4EDDB39A2BABDC184368F778005EE2471DBE873495F13B64600F6E3091A0911C4E07A81E1F3A690348C611D9023FB3
Malicious:	false
Preview:	2024/08/31-14:42:12.906 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-14:42:12.906 1cdc Recovering log #3.2024/08/31-14:42:12.906 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.212620020904397
Encrypted:	false
SSDEEP:	6:hJ8XuxQ+q2Pwkn23oH+TcwtpIFUt8QJ8XuxgZmw+QJ8XuxQVkwOwkn23oH+Tcwt7:hJW+vYfYebmFUt8QJ6/+QJWV5JfYebaQ
MD5:	CCE2B575C213809AF800D9A98005DD58
SHA1:	44EF4ADB59FF7371302475034A4790CE32381298
SHA-256:	1C73C9E1578352E2EED438B0BF954F0C7961286E07BECFC41032E7AEF455CDEA
SHA-512:	B13950D74D74C1AF8C558C120137AFC19D4EDDB39A2BABDC184368F778005EE2471DBE873495F13B64600F6E3091A0911C4E07A81E1F3A690348C611D9023FB3
Malicious:	false
Preview:	2024/08/31-14:42:12.906 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-14:42:12.906 1cdc Recovering log #3.2024/08/31-14:42:12.906 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:V+6Hl1lhtlLK:Uc32
MD5:	1F80E742F2949AFE90F975B28B9381B0
SHA1:	A365B73AB71279BF609D685E910AE27963DED37C
SHA-256:	8AA780F1755BD52B6534A2C2D0CA81F197ED99265158AFFCA21CD9BF0B8DCD03
SHA-512:	9F48CB84DD6824CCB2538CADF4DB5A1EC4B01F1A2F6CB8111C35F6A006CB8CF82276134A18C600A957CAC99846B4F4323E201526DCD619D53BE9025E77DC873F
Malicious:	false
Preview:	.............?9....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a261bd52-285f-40a0-b334-fcfd5dd4b98c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.183300559385355
Encrypted:	false
SSDEEP:	96:sVwqlRJ1vb9siKdYuX7kxoSSvYvqsY5Th6Cp9/x+6M8muecmAeCs/e4zvr+2X6gM:sVwuJsFdP8evYvqsYPpj+FVAY+FBf
MD5:	C98A2BF6BF15AED1DC94DCCC2322FC59
SHA1:	C20707A969BDA4F7BF0AFCF33C9D53DC1236B2F0
SHA-256:	D327F7119FAA52593C661EADD4D0998209CE473A0B031449049BFA93AA95BE33
SHA-512:	061C0D65B3FDE005B07E45574689714951DB87B7E403EE99AED3740C3D6FA8B9BCDFD4747FB9B69A47504C18848B808B0D1D4272762E45F2B52743B5316ADF7F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369603333061218","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bc4145fe-6a9c-4c49-8ff8-7dfada9c5703.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557124759606829
Encrypted:	false
SSDEEP:	768:HrtinS7pLGLvbeWPDDfXq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTeAvgrwFpbtu6:HrtinqcvbeWPDDfXqu1jayRvRvtF
MD5:	F13582E35ACCB81DDEF3B9524C02ADBB
SHA1:	DF98B2104A3E88FF7EA3F9958356BEE5C0E7AA2A
SHA-256:	D8170F310EFBEC9667CB9D880B5810500592897436AEC2EAE6D37A1A31150981
SHA-512:	217809657FFDE1547794DEC98C4D2314925B065B35121AF852E60DA5E370CDC4D727ABBA8375B80F018AFED40E68C0D80F5E6E75D28877280709C264C0F3E969
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369603332826481","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369603332826481","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f1113fb8-4df6-4d25-9241-f361e065cf8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.565164775744354
Encrypted:	false
SSDEEP:	768:HrtinS7pLGLvbeWPDDfMq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFLEeAvgrwXpbtc:HrtinqcvbeWPDDfMqu1jasLERvR9tc
MD5:	A15E67BBF5254018CF01A7EDD690008C
SHA1:	0B55075C32498FF3C217357F30718D4AB40505ED
SHA-256:	A63C37921DDF0BD5FA346A391275E7D2AE81536416E50CC90C9DC11883095435
SHA-512:	BBC07B57D3FF6D231479E8EC20D02C41635CD4045522ED3C50A6DF3A6F4218460958512C5AC74B2AB0CA0BF83096123BC3DE12295F2887EA645B517FB3A0C651
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369603332826481","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369603332826481","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.23058650428269
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxljlPBvtl3seGKT9rcQ6xVU:/XntM+4ljlfl3sedhO+
MD5:	626C09ABF29EF6DD284060831AD2EA46
SHA1:	7A39153EECBF0B5886DE2B5C3A6B3776576A8A73
SHA-256:	5D67DF4AF9DC4EC73CC430797671AB59896393C52E1F7590572B53F47ABF3619
SHA-512:	BA38D0F8584F31FD312F5C0CDB6321E04F35E2C969DF32ABD1DE03ED696CF9464979EDB9B7701DE3D780E4D8B5F97FF86CB4141CFCDC38AE0558289D6FFED4A9
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f...............8j..0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.208160940169209
Encrypted:	false
SSDEEP:	6:hJ8VK81wkn23oH+Tcwtfrl2KLlHJ8CN+q2Pwkn23oH+TcwtfrK+IFUv:hJLbfYeb1LZJXN+vYfYeb23FUv
MD5:	E4AE79F2893B7660441B3AC8DC16FAE4
SHA1:	7364243303F1C0AABD14F4949544FD7EC3C920FE
SHA-256:	C6D1F8CBE6AA7A21DF3EE342A1A531EEF7E85A232D7D36C7319A38817D0449C1
SHA-512:	516C03DA3426AE80044EED3AA63E062376222E27E1944D995EAAA5A9000C2CFF7F44F1D58DC1D25ACD8912950335F7E6C6433B3B35A7CD274C33DECE04933424
Malicious:	false
Preview:	2024/08/31-14:42:13.305 1d3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/31-14:42:13.438 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9275169283101077
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZi+5uh/2Rdj0QWQ0:G0nYUtPrPJ6B/XMtzNP9i+4hORdZx0
MD5:	A21ADD072F290BB8025555CE1EF9014C
SHA1:	BC07D222EF610DCE637F72866D14D7560926EB5C
SHA-256:	1D64B6F3EBA3FC479C8A8A34AB1D17D263E71AC35707450E323DA7E482E48195
SHA-512:	164C693EE34EE72E4401DFF69B7E4CFE2BA100E7F3C8D2665B91BFC200011F808FEF9EB878656CE54478EF7F6B814EAD722C4EDC74F7300BA5E1B696F6CA1CCF
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.176534583984117
Encrypted:	false
SSDEEP:	6:hJ8M81wkn23oH+Tcwtfrzs52KLlHJ8D+q2Pwkn23oH+TcwtfrzAdIFUv:hJLbfYebs9LZJ8+vYfYeb9FUv
MD5:	45EFDC0E165620F5AA2B1E01E91943F3
SHA1:	B4C2E5D1BC8EF522936BFD176BB1A264CFC08969
SHA-256:	E6A7D1E48E1E692BD36C5E3E44813E7892CBBAC403BD6D252AAE7F9ABFF9EE58
SHA-512:	E63DD98BDFEA7BB2B873367325B1C18EBF7C02A4565756CA37B0C37AE4924CFCF4CA3F6EFC1D11EDF07A00B3B417372C4BFD1E629FDB31BA7DCF6579D45F9CFE
Malicious:	false
Preview:	2024/08/31-14:42:13.037 1d3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/31-14:42:13.194 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlja/:Ls3jq
MD5:	9DA78093AA4D13FDBDDB8DE21FB5E8EB
SHA1:	D520C63C591C6CC47C3F6C613FEC3B3812DD16D8
SHA-256:	242C3AB8FBA61670C80AE4BDAF628CC6F25D49A218A1B25D39F43D96A6179200
SHA-512:	F88D9F6945A9080AB1CFF58664476362B8BB23A6434CF6A62EA4F5FAA4EF954C2A304BCC4DC90CF60644AB3457D1134975603F1C6054D07D6D14C7924ABCC0DA
Malicious:	false
Preview:	.........................................\|.Y../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlywBll/:Ls3jR
MD5:	E81954B9DC07A6EF7EDCA10E11B4B81F
SHA1:	07240ED8CE9802E0363D954FAC4E6BA15D4CBAB0
SHA-256:	642FB48F65991BD151C0F0A389ADF3DB88286F681BC5895862BCF8A570A7CF99
SHA-512:	AC1FA7C5D9D713DBF40809468CFB1B90780EC4AE42D502F9C4C710B725112498E241F77448AA488169AC871AB05955B804B608DEF6A62BFB67C3205D99014649
Malicious:	false
Preview:	........................................_A.Y../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d17f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d18e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f0ce.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f0ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f0fd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3105c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3106c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF343c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bb71.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e2b0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF409d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF431e9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2031281
Entropy (8bit):	4.001532179014389
Encrypted:	false
SSDEEP:	49152:pgPh2N/MR+DgVFIlq6hTN7X4Vrg+k+lzKVSf4YVxeqOWlcKRayjH09bnwBXQ0a/E:Q
MD5:	CA095618608BFC7939BB36D273635DF5
SHA1:	12BD896A016E5F987B700CD5FFB89C8D51D8D8F1
SHA-256:	CA653667207BA8CF264C2B7B2C833868EA68B373D41D45F24BAA48CE26A93CD9
SHA-512:	0294EA39C37AA125348272DEFA940FE520D836B1BF8BF11C5EB5AA393660783BF333864EFC870591A842A6C77E34A72D4DE35142E3A75349E7D27D23C361EF67
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2031281
Entropy (8bit):	4.001532179014389
Encrypted:	false
SSDEEP:	49152:pgPh2N/MR+DgVFIlq6hTN7X4Vrg+k+lzKVSf4YVxeqOWlcKRayjH09bnwBXQ0a/E:Q
MD5:	CA095618608BFC7939BB36D273635DF5
SHA1:	12BD896A016E5F987B700CD5FFB89C8D51D8D8F1
SHA-256:	CA653667207BA8CF264C2B7B2C833868EA68B373D41D45F24BAA48CE26A93CD9
SHA-512:	0294EA39C37AA125348272DEFA940FE520D836B1BF8BF11C5EB5AA393660783BF333864EFC870591A842A6C77E34A72D4DE35142E3A75349E7D27D23C361EF67
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlpX:Ls3pX
MD5:	6D061189CED9057BB829EC07C29CF0C2
SHA1:	E7DE1632CA5821E9ED8E06DE12E00DB21BA68935
SHA-256:	2C5A14AC34FE57C10746BA46CB971601AEC16D32786DFE7D43EAD39AA2DCCC82
SHA-512:	ECCA42F6331EA66F5DE02E95A9C792FD9F573B4C723FFBAFBA3D010468B18BAD00AF51C1761592202F8012C5570BE12017D71B3BC478ABF52FF5DA05158BF8DE
Malicious:	false
Preview:	.........................................$pY../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a7372aba-563d-4e57-ad93-1a8e65d6bc7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8349
Entropy (8bit):	5.798109102600205
Encrypted:	false
SSDEEP:	192:fsNwttTXeiRU5EQ3lkTZ6qRAq1k8SPxVLZ7VTiB:fsNwnTLAp32TZ6q3QxVNZTiB
MD5:	D685E794509CE0D64287FD953E77D7D9
SHA1:	23F542565C8217B476F4EF0CF0176AACEFF5D831
SHA-256:	62209CAA6349A43FFCE487706C84850D01678D54AB63FD7FABEEF91023E91A4E
SHA-512:	FE07C0DFE582A3AAAFFC2008BE70E30F6D0AD4DAEBB877D80D21E7CFB119B3DE29944A2F7325F465A8AB665CA9ED53AD2C1FB6F9389EFC490DBA6F57A230A561
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bff8486a-a5b4-49e6-93d0-376668b1200c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8349
Entropy (8bit):	5.798236898665233
Encrypted:	false
SSDEEP:	192:fsNwttTXeiRU5ZQRkTZ6qRAq1k8SPxVLZ7VTiQ:fsNwnTLAmCTZ6q3QxVNZTiQ
MD5:	E65817117A4067211960B8000F45F5B8
SHA1:	1836CBA199181A93AF5EEE6A08A4A2E88E757DDA
SHA-256:	807391886A7D993322843E1143D6913E9674A16164D5963AF614A0D5BBA19B95
SHA-512:	35F493B97CB3F2F8A03769D6B2A99E232DF5C29D2F25DD161FC4BD7534143A33EFB89D2FCFCEBABBA049A1F4FCB4F0C6270788FD89E053E648BEDAC2994492B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cb23c675-b93b-49ff-8e30-4a38cbc50b99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59828
Entropy (8bit):	6.081465120845885
Encrypted:	false
SSDEEP:	1536:aMGQ5XMBG2zaf8dP0SXn0acUAiTHg1rszFl:aMrJM8vkdP0SENU9H0rszFl
MD5:	9E513AEB5E4BCA0A583DBE4B4E5347BE
SHA1:	AC24258DD84DD9DC7C29CE895064AC94A30A5FA2
SHA-256:	CB23657EF66FFC735A3CAA659D455DD0C5114BC2F0024A94C0BDDA55ACE05B85
SHA-512:	FDA44E762020DDE3D89B7344B54F31FA8933A12C0414D6D687C99764D4280A11D72D040BBD7F1046C31494E8D57EB0B13BC1CFE8AE2A456FB310784D980ABC5C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603332999101","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d5bb70d6-7ef7-4e1d-a00e-63f9002f558f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8267
Entropy (8bit):	5.804450102262866
Encrypted:	false
SSDEEP:	192:fsNAttTXeiRUAZQRkTZ6qRAq1k8SPxVLZ7VTiQ:fsNAnTL7mCTZ6q3QxVNZTiQ
MD5:	F1AEE993A5DDBC70C1787F24E85352BE
SHA1:	66FBEC42409157AED7577E32535B8571501059A0
SHA-256:	EF342CE2885D4348CE3EB4A92040BF0DC5DDAF8B323A5D2030ED54FA16734A67
SHA-512:	DD5BC865F1E9C1C1E07CA97E6409CC220C8AB2330474E1605A128CC5CAB3F0B05C9BF118FE105875D1D030DEB759CD5459E7084F889DF1DA2F18A0AEB1937A64
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d7a1c89c-edda-4c1f-9cf6-190a5183fb37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9440
Entropy (8bit):	5.839308476468457
Encrypted:	false
SSDEEP:	192:fsNwttTXeiRU5QxQ/FyMkT496qRAq1k8SPxVLZ7VTiB:fsNwnTLAUQAHT496q3QxVNZTiB
MD5:	8B442E95090ACC42BD68961876CB6D81
SHA1:	CBE2BD427F87A94A64318C83C4A1B33D3148593C
SHA-256:	69F0CCC658548EF55D522C07D9407EEA72BF35329AD5FD2AC718BF3C44B762DE
SHA-512:	5158AE9358CADC1BBECFB64647D1EC54B8734405E9BBCD0C0A062D022E1D1F5EF9FC84CBCF504A463FAEB1A5351753DDAA6F5C4B592E26B6B9521DBE1ED7705F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\de4cb353-5dee-455d-a130-1e45ddc20db5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9456
Entropy (8bit):	5.840388250139565
Encrypted:	false
SSDEEP:	192:fsNwttTXeiRU5QxQ/2jkkT896qRAq1k8SPxVLZ7VTiB:fsNwnTLAUQ0/T896q3QxVNZTiB
MD5:	E9E28429FC31D80B143AB156CDC34F94
SHA1:	A9E9798CB18B8E21C13B5EB83C5127C25D2C45C1
SHA-256:	E4FD3B0CCCE873036565D5F945C6D3B23DF963C14CDB306D2DFB08378859B6A0
SHA-512:	04A3DA2DB3F8C93811EFB8D134FCD34BD59A4ADA24664BD16F77F1AEDEB141CDB555ADCB73BBA4701190E6D821FC955848328B83DD7031610036B0A9137C42CA
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e4437ba3-6355-440a-a2e2-c3ad4e1209cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.790553178335858
Encrypted:	false
SSDEEP:	96:iaqkHfltTi5ih/cI9URLl8RotovMFVvlwhYe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akttTbeiRUAh46qRAq1k8SPxVLZ7VTiq
MD5:	00091CD2B1904CF76337CFB1AB4D7B9B
SHA1:	21F8173F8E1B07E04F35C6C39C851E18834DF1CD
SHA-256:	80F6F2AF771CB9E266A676F468AE0C2EBD96AA941ED82E4C6127C0AC860AD020
SHA-512:	3C223DF659EEB2ED50FBB69DEEDD1E937F0F2126B4BC2EC2D22953ACF8456F7A32CB3394152FF9FAF85A175C3AC80AE5D11E1872837AF5198EFAFD3BD9F85149
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACa16byjvANR52TAcE4IEXPEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC4GZfOoKagoXhDirZ29TTcunFxMuMfLe9UqetRow32SAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fed26de3-13a1-4d22-80f3-abb14efc5c66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24722
Entropy (8bit):	6.053603720018543
Encrypted:	false
SSDEEP:	768:aMGQ7FCYXGIgtDAWtJ4n2T8RNszv4h02td9:aMGQ5XMBG2Gszsl
MD5:	E2E25DCC736EDF5EF34D347913C0AF03
SHA1:	F28517A7C5E63D36E86F356B6D521F29E3341B7A
SHA-256:	DF599B1188E1E66528D884698BB1D3FF328B9635ABBDC9B46DC349F2A0BD28D2
SHA-512:	67B277ABA36B9028F8BCE53E75EA7A188FEB6DEDC61FE686783EDFF9300CB87C14580C97714FEAFBABDEC2C8E4BCEEBC042ACE2FE1D1D500485DD65502497AC6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369603332999101","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.844338490013375
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxxxl9Il8usfovXHTJJgTdZui2+d1rc:mUYqGNJECi2V
MD5:	E943E683588A8A1714E3E818449B7F1D
SHA1:	E06E7D1BA6F7E1E00937BD7ED64AE0BA6C17D5AB
SHA-256:	8509BC7E3BC84BE9EC2BC583F49913C43D21FD771CD7C722936B57BF8380CC4D
SHA-512:	B8B357D94FDC8DB496558098D0A6CC95650CEDA74E0903E546E476062BF187BBC646B65AD0C1215EF068F9A68379871FE1AAA9A0D4C9190CED22A079E1D19CB4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.o.l.1.t.3.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.t.e.m.8.o.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9997050102488574
Encrypted:	false
SSDEEP:	96:VYqbMOlm+r2uXW8guXPg4Op/aEl6J30bljWKdqVH:VYOlm9uFOc+65rVH
MD5:	2D5E247A816139882162DDE7AA1DB318
SHA1:	6CC3130C06CA5C3D859937E35E966617419BB689
SHA-256:	CC45F03E693DDE7761E8B26D3516E5B7C933755D7FB5FAFBBBCF53D6AD79CF06
SHA-512:	33F8C2F733E1D0319C66FA29DD97BF5225131B9C201E13DBED6F4C032EF3A02A6F063061EE7DB2BB6630F6D2111F67C42BE41086FBE5B2F09DE7D06D5F8EF328
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.D.d.1.v.N.X.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.m.t.e.m.8.o.

C:\Users\user\AppData\Local\Temp\1725735e-29de-425f-8e73-1af5ea33081e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\7827935c-f04a-4cf0-be0b-5daacd06ca56.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\84cd0da3-091c-49cd-8f05-4fa717d4e6eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\b5406a74-a832-43b7-b2ce-941e74982668.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.3869310980129415
Encrypted:	false
SSDEEP:	12:YpY11rXnB0Dkv/PYmLyjj56s/PYx11FzL0Dkv/PYx1kTHEw56s/C:YpmVB08fK5x019080c5M
MD5:	BC89C525CDBCDB64929597255C7A0075
SHA1:	4028742499E205702342482E9F8DB535541297CA
SHA-256:	64FEB654F63E53E93F58FC1AC0370FC2A0BD1766465BFF14D5FCA5F80EF2339E
SHA-512:	3F06C0B7F8DF652EAAD85A1891CBCDD6E0E36E151DD5E94B00D2D2459F4886416536BD12E0241A73351D7F39F863A4AED14C2F5BC83350BBD51C9EA8B4267B12
Malicious:	false
Preview:	{"logTime": "0831/184200", "correlationVector":"B2B01DB6619448B7979EB11B0188EACA","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0831/184214", "correlationVector":"OnX8YxwvIje/QP8/fqf+vL","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0831/184215", "correlationVector":"E0737187036D473180D3934FFEDAB3AF","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0831/184215", "correlationVector":"+C7/aPGTCdKAMU6XLtmJHN","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\84cd0da3-091c-49cd-8f05-4fa717d4e6eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1732555133\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1966509553\7827935c-f04a-4cf0-be0b-5daacd06ca56.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1966509553\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1966509553\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1966509553\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9208_1966509553\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3OEA6NEY1Q5GVHL1C2CC.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5077313367950027
Encrypted:	false
SSDEEP:	48:0EZVbdOIPdsJOrKzBdLXuHqkDpK2AZVbdOIPdsJOrKzngdLXuHqk+21:RC3uKkD1GCnIuKkz
MD5:	058DF7E98FCF15374F6E0B6BF4378C37
SHA1:	3D9EF7A99A29235CE8DDB0CF31B9302BAD624878
SHA-256:	45DCE164855FBE5EF03D5490F333D626F320B9EFB09469615D0A15F7CD2CF6F5
SHA-512:	E1AD984DFC3039A5E7F7B7ECADAB6D5E79963E521894BD73AA6B8C2A5FD3D7C81B39A8AE4F15131B3426704337A0ACF7BE89BC00AB56039CEFA21CB6F6315B4D
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...w.Vv.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y9...PROGRA~2.........O.I.Y9.....................V......sv.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y;.............................k.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y@............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y;...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y;.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j....................C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.512065222670715
Encrypted:	false
SSDEEP:	48:0EtfudOIUdsJOrKzBdLXuHqkDpK2AZVbdOIPdsJOrKzngdLXuHqk+21:PC3uKkD1GCnIuKkz
MD5:	802A7D506FC6F0B740168C4598891F36
SHA1:	2DD177C38AF0418391CA7DBD100EE63605C9C748
SHA-256:	E5065A8604EA898529C8FE6B58D67640B7342D439CB0EEA2B18D28B404C870C1
SHA-512:	89981625CB700B28AEA1C5300E4C09D89DF399C1C0896BA9D3E11B44B4E6B866DC5E37EE28B6514F0790A8027ACAA63BBFF0195BEEBF1F4CB8C7BAB9B0799DE7
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...w.Vv.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.......-.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y;.............................k.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y;...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y;.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j....................C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EOXGAZIPATE2HR4F9WOT.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.512065222670715
Encrypted:	false
SSDEEP:	48:0EtfudOIUdsJOrKzBdLXuHqkDpK2AZVbdOIPdsJOrKzngdLXuHqk+21:PC3uKkD1GCnIuKkz
MD5:	802A7D506FC6F0B740168C4598891F36
SHA1:	2DD177C38AF0418391CA7DBD100EE63605C9C748
SHA-256:	E5065A8604EA898529C8FE6B58D67640B7342D439CB0EEA2B18D28B404C870C1
SHA-512:	89981625CB700B28AEA1C5300E4C09D89DF399C1C0896BA9D3E11B44B4E6B866DC5E37EE28B6514F0790A8027ACAA63BBFF0195BEEBF1F4CB8C7BAB9B0799DE7
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...w.Vv.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.......-.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y;.............................k.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y;...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y;.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j....................C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5077313367950027
Encrypted:	false
SSDEEP:	48:0EZVbdOIPdsJOrKzBdLXuHqkDpK2AZVbdOIPdsJOrKzngdLXuHqk+21:RC3uKkD1GCnIuKkz
MD5:	058DF7E98FCF15374F6E0B6BF4378C37
SHA1:	3D9EF7A99A29235CE8DDB0CF31B9302BAD624878
SHA-256:	45DCE164855FBE5EF03D5490F333D626F320B9EFB09469615D0A15F7CD2CF6F5
SHA-512:	E1AD984DFC3039A5E7F7B7ECADAB6D5E79963E521894BD73AA6B8C2A5FD3D7C81B39A8AE4F15131B3426704337A0ACF7BE89BC00AB56039CEFA21CB6F6315B4D
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...w.Vv.....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y9...PROGRA~2.........O.I.Y9.....................V......sv.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux..Y;.............................k.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y@............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y;...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y;.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j....................C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5797813807843655
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	8ed23a69e2084e1a94597c441658254e
SHA1:	d1870fdc6b3e94c3b4c606d314790748b84d4b5b
SHA256:	b37d3956036d1708f0338dfb76e1e65141401cb82c245da89b66b17927712393
SHA512:	2b5b8dfdd953df04777aed0805d9464eabb102291b343327b7bae4d1d992dae3f796ad000c7c10de82f0f43ce6f10bc5932c14e57d6b8365071cb8ffc818b60f
SSDEEP:	12288:MqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTk:MqDEvCTbMWu7rQYlBQcBiT6rprG8ask
TLSH:	36159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D36317 [Sat Aug 31 18:38:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FAED4822443h
jmp 00007FAED4821D4Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FAED4821F2Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FAED4821EFAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FAED4824AEDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FAED4824B38h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FAED4824B21h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	3d81b3f2a62fbd8853e6602c1aa60f39	False	0.286953125	data	5.165734491251248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 20:41:58.707627058 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 31, 2024 20:42:00.430227041 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.430244923 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.430413961 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.430615902 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.430632114 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.431735039 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.431766033 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.431909084 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.432214022 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.432219982 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.432308912 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.432326078 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.432332993 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.432375908 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.432678938 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.432702065 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.432845116 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.432857037 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.432974100 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.432985067 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.471786022 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.471796989 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.471923113 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.472688913 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.472698927 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.716538906 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:00.716574907 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:00.716669083 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:00.716856956 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:00.716871023 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:00.942107916 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.944988966 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.945157051 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.945663929 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.951158047 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.986975908 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.986993074 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.987073898 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.987092972 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.987807989 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.987818003 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.987911940 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.987962008 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.988008022 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.988056898 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.988157034 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.988163948 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.988248110 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.988256931 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.988723040 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.988773108 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.989142895 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.989147902 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.989207983 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.989209890 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.989638090 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.989696980 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.991403103 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.991461039 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.991588116 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.991596937 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.991839886 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:00.991847038 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:00.992738962 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.992796898 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.994313002 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.994390965 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.994400978 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.994410038 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.994973898 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.994981050 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.995116949 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.995170116 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:00.995239019 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:00.995246887 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.036822081 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.036822081 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:01.037564993 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.037621975 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.037621975 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:01.091420889 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:01.091465950 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:01.091525078 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:01.093538046 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.093590975 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.093638897 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.094885111 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.094940901 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.095550060 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.095592022 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.095599890 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.095639944 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.096812963 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:01.096856117 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:01.096903086 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:01.113593102 CEST	49750	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:01.113609076 CEST	443	49750	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:01.113888025 CEST	49749	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.113895893 CEST	443	49749	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.119510889 CEST	49748	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.119517088 CEST	443	49748	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.119699955 CEST	49747	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.119705915 CEST	443	49747	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.122478008 CEST	49751	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:01.122483015 CEST	443	49751	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:01.175635099 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.175652981 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.175782919 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.175806046 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.175818920 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.175873995 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.176052094 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.176065922 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.176106930 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.176131010 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.393085957 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.393311977 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.393335104 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.394200087 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.394263029 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.395324945 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.395376921 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.395605087 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.395612001 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.443075895 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.503019094 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.503046989 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.503055096 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.503098965 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.503106117 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.503118038 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.503138065 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.503145933 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.503175974 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.503199100 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.504987001 CEST	49754	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:01.504998922 CEST	443	49754	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:01.546399117 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:01.546416998 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:01.546633005 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:01.547961950 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:01.547971010 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:01.640908003 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.641112089 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.641122103 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.641433001 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.641741037 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.641796112 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.659169912 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.659358978 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.659379005 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.659665108 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.659945965 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.660008907 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.693089008 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.708689928 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.731446981 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:01.731484890 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:01.731550932 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:01.731703043 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:01.731717110 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.219261885 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.219338894 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:02.242885113 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:02.242912054 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.243199110 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.279582977 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:02.324501991 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.399142027 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.399496078 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.399507999 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.399915934 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.400167942 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.400233030 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.400294065 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.443120003 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.443130970 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.494194984 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.494247913 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.494335890 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:02.494359016 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.494371891 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:02.494371891 CEST	49760	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:02.494380951 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.494393110 CEST	443	49760	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.515726089 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.515744925 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.515750885 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.515800953 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.515805960 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.515865088 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.515877962 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.515882969 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.515922070 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.525482893 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:02.525518894 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.525616884 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:02.525883913 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:02.525897026 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:02.553972006 CEST	49763	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.554002047 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.554070950 CEST	49763	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.554322004 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.554351091 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.554409981 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.554655075 CEST	49763	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.554667950 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.554780006 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.554790974 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.602817059 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.602833033 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.602893114 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.602916002 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.602958918 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.608011007 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.608026981 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.608081102 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.608091116 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.608134985 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.686595917 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.686609983 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.686640978 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.686688900 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.686690092 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.686701059 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.686745882 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.686754942 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.686773062 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:02.686830044 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.687369108 CEST	49761	443	192.168.2.4	13.107.246.40
Aug 31, 2024 20:42:02.687381983 CEST	443	49761	13.107.246.40	192.168.2.4
Aug 31, 2024 20:42:03.037833929 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.037852049 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.037930965 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.037956953 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.037964106 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.038028002 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.038361073 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.038372040 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.038495064 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.038501978 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.069067001 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.070476055 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.070489883 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.070796013 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.071074963 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.071130991 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.098269939 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.098510981 CEST	49763	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.098532915 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.098879099 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.099322081 CEST	49763	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.099400043 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.116318941 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.149913073 CEST	49763	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.215552092 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:03.215631008 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:03.216954947 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:03.216967106 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:03.217186928 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:03.220906019 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:03.268512964 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:03.323236942 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.323283911 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.323489904 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.323757887 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.323775053 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.495709896 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:03.495773077 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:03.498522043 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:03.509959936 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.512732983 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.545916080 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.545928955 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.546360016 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.546421051 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.546947956 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.549688101 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.549809933 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.549814939 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.550196886 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.550246954 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.550793886 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.552660942 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.566632986 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.566685915 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.590353012 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.590420008 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.593339920 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.593352079 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.593694925 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.593704939 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.598110914 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:03.598129988 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:03.598217010 CEST	49762	443	192.168.2.4	184.28.90.27
Aug 31, 2024 20:42:03.598223925 CEST	443	49762	184.28.90.27	192.168.2.4
Aug 31, 2024 20:42:03.648917913 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.650361061 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.699850082 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.700398922 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.700520992 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.701239109 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.701334953 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.701541901 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.701797009 CEST	49765	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.701806068 CEST	443	49765	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.702950001 CEST	49766	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:03.702953100 CEST	443	49766	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:03.785276890 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.785747051 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.785775900 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.786634922 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.786689997 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.788079023 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.788134098 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.788527966 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.788536072 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.834060907 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.907016039 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.907046080 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.907072067 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.907098055 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.907114029 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.907160044 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.907301903 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.907430887 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:03.907610893 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.908555984 CEST	49767	443	192.168.2.4	142.250.81.228
Aug 31, 2024 20:42:03.908569098 CEST	443	49767	142.250.81.228	192.168.2.4
Aug 31, 2024 20:42:04.011153936 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.011183977 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.011249065 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.011360884 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.011383057 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.011430979 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.011715889 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.011728048 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.011826992 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.011836052 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.470510960 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.470706940 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.470721960 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.471092939 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.471149921 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.471693039 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.471741915 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.471919060 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.471968889 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.478260040 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.478442907 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.478457928 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.478775978 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.478832960 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.479465961 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.479511976 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.479654074 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.479712963 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.523551941 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.523555040 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.523560047 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.523566008 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.573220015 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.573223114 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:10.900930882 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:10.900955915 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:10.901302099 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:10.902431011 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:10.902443886 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:11.848031044 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:11.848099947 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:11.851372004 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:11.851377964 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:11.851604939 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:11.894607067 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:12.425131083 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:12.468503952 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.651355982 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.651376009 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.651382923 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.651396990 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.651437044 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.651453972 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:12.651473999 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.651489973 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:12.651515961 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:12.651792049 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.651854038 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:12.651861906 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.652204037 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:12.652255058 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:13.912502050 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:13.912533045 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:13.912542105 CEST	49770	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:13.912549019 CEST	443	49770	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:15.775657892 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:15.775686979 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:15.775744915 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:15.775872946 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:15.775886059 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:15.812478065 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:15.812491894 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:15.812545061 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:15.813041925 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:15.813051939 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.453690052 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.457329035 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.457350969 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.458328009 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.458386898 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.460974932 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.461030960 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.467328072 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.467334986 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.499331951 CEST	80	49723	41.63.96.0	192.168.2.4
Aug 31, 2024 20:42:16.499511003 CEST	49723	80	192.168.2.4	41.63.96.0
Aug 31, 2024 20:42:16.499511003 CEST	49723	80	192.168.2.4	41.63.96.0
Aug 31, 2024 20:42:16.504307032 CEST	80	49723	41.63.96.0	192.168.2.4
Aug 31, 2024 20:42:16.521157980 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.531075001 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.531362057 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.531372070 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.531733990 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.531745911 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.531793118 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.531797886 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.531838894 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.531858921 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.532447100 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.533843994 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.533902884 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.534120083 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.534126043 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.546366930 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:16.546433926 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:16.546497107 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:16.561227083 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:16.561281919 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:16.561319113 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:16.564414978 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.564436913 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.564445019 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.564471006 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.564486027 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.564491034 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.564507961 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.564517975 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.564527988 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.564538002 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.564558983 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.564793110 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.564832926 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.564874887 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.566076040 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.566086054 CEST	443	49782	13.107.246.60	192.168.2.4
Aug 31, 2024 20:42:16.566119909 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.566138029 CEST	49782	443	192.168.2.4	13.107.246.60
Aug 31, 2024 20:42:16.584749937 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.804987907 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.805087090 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.805552959 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.805565119 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.808999062 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.809163094 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.809169054 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.812686920 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.812937021 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.812942028 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.817791939 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.818284988 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.818289995 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.824253082 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.824501991 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.824506998 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.830440998 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.831005096 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.831011057 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.836796045 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.836934090 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.836939096 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.843507051 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.843837023 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.843843937 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.897108078 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.897517920 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.897665977 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.897694111 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.897803068 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.897810936 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.897906065 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.898010015 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.904252052 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.904283047 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.904450893 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.904455900 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.904627085 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.910623074 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.916901112 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.917046070 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.917128086 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.917134047 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.917212009 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.922400951 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.928668976 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.928694010 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.928791046 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.928797007 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.928905964 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.934973955 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.940972090 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.941005945 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.941092968 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.941098928 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.941212893 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.946461916 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.952404976 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.952434063 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.952775955 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.952781916 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.952924013 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.957369089 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.962910891 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.962944031 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.963074923 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.963080883 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.963362932 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.968338966 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.974258900 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.974286079 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.974390030 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.974395990 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.974473000 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.993726015 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.993798971 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.993844986 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.993849993 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.994154930 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.994188070 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.994229078 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.994257927 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.994260073 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.994270086 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.994308949 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.994314909 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.998796940 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.998831987 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.998857021 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.998862028 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:16.998963118 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:16.999145031 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.002855062 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.002887011 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.002927065 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.002935886 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.003343105 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.006315947 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.009809017 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.009839058 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.009951115 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.009958029 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.010124922 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.013191938 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.016654968 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.016690969 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.016789913 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.016794920 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.016972065 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.020405054 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.023523092 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.023554087 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.023668051 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.023679018 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.023822069 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.026881933 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.030461073 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.030489922 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.030582905 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.030587912 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.030802011 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.033827066 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.038692951 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.038754940 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.038902044 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.038907051 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.039001942 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.044713020 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.049632072 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.049671888 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.049700975 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.049700975 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.049709082 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.049812078 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.049817085 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.049998999 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.055120945 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.055318117 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.055350065 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.055443048 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.055453062 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.055567026 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.060619116 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.060699940 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.060770035 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.060775042 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.060940981 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.061290026 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.061295033 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.063514948 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:17.063651085 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.063844919 CEST	49781	443	192.168.2.4	172.217.18.1
Aug 31, 2024 20:42:17.063855886 CEST	443	49781	172.217.18.1	192.168.2.4
Aug 31, 2024 20:42:18.512780905 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:18.512793064 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:18.512845993 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:18.512866974 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:18.512893915 CEST	49763	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:18.512916088 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:18.998369932 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:18.998418093 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:18.998507977 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:18.998894930 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:18.998908043 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:18.999208927 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:18.999229908 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:18.999419928 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:18.999495029 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:18.999505997 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.042758942 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.042772055 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.042892933 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.043386936 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.043397903 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.624869108 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.625224113 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.625247002 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.625612974 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.625613928 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.626060009 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.626080990 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.626146078 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.626210928 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.626210928 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.626219988 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.627341986 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.627367020 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.627372026 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.627424002 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.627440929 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.627440929 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.628694057 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.628756046 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.628962994 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.628972054 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.629780054 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.629780054 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.629797935 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.629842997 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.630019903 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.630028963 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.677362919 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.677362919 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.757400990 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.757461071 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.757621050 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.758296013 CEST	49786	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.758308887 CEST	443	49786	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.771667957 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.771735907 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.771812916 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.771888018 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.771965981 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.771998882 CEST	49788	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.772002935 CEST	443	49788	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:19.773011923 CEST	49787	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:19.773025036 CEST	443	49787	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:31.368259907 CEST	80	49724	41.63.96.0	192.168.2.4
Aug 31, 2024 20:42:31.368351936 CEST	49724	80	192.168.2.4	41.63.96.0
Aug 31, 2024 20:42:31.368421078 CEST	49724	80	192.168.2.4	41.63.96.0
Aug 31, 2024 20:42:31.373377085 CEST	80	49724	41.63.96.0	192.168.2.4
Aug 31, 2024 20:42:34.063966036 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.064002037 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.064158916 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.064166069 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.064217091 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.064246893 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.064485073 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.064492941 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.064522028 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.064528942 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.523252010 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.523873091 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.523896933 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.524239063 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.525280952 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.525916100 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.525917053 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.525930882 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.526017904 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.526252985 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.526382923 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.526809931 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.526871920 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.527151108 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.568592072 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.568609953 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.572499037 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.649024010 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.649080992 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.649379015 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.649446011 CEST	49790	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.649458885 CEST	443	49790	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.661010027 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.661072969 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.661278963 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.661278963 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.661727905 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:34.661744118 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:34.661977053 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:34.661977053 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:34.661993980 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:34.975430965 CEST	49789	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.975461960 CEST	443	49789	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:35.219681978 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.220354080 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:35.220372915 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.221365929 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.221421957 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:35.224452019 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:35.224522114 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.227915049 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:35.227921963 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.272702932 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:35.334628105 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.335582972 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.335592031 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.335633039 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.335656881 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:35.335659027 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.335707903 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:35.336546898 CEST	49791	443	192.168.2.4	152.195.19.97
Aug 31, 2024 20:42:35.336559057 CEST	443	49791	152.195.19.97	192.168.2.4
Aug 31, 2024 20:42:35.598046064 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.598077059 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:35.598146915 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.598437071 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.598467112 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:35.598531961 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.598668098 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.598683119 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:35.598767996 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.598781109 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.056175947 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.056577921 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.056586027 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.056950092 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.057157040 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.057370901 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.057442904 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.057701111 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.057717085 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.057943106 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.058052063 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.058434963 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.058501959 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.058629036 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.104499102 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.104509115 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.177262068 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.177334070 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.177498102 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.177561045 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.177582979 CEST	49792	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.177592993 CEST	443	49792	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.177613020 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.177679062 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.177928925 CEST	49793	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.177937984 CEST	443	49793	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:49.524132967 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:49.524168968 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:49.526076078 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:49.526115894 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:51.074060917 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:51.074104071 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:51.074187040 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:51.074611902 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:51.074625015 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:51.916080952 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:51.916227102 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:51.925317049 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:51.925333977 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:51.925885916 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:51.934922934 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:51.980498075 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.200136900 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.200190067 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.200254917 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.200259924 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:52.200283051 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.200318098 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:52.200330973 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:52.201420069 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.201467037 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.201500893 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:52.201508999 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.201519012 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:52.201827049 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.201881886 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:52.204128981 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:52.204140902 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:52.204157114 CEST	49796	443	192.168.2.4	13.85.23.86
Aug 31, 2024 20:42:52.204160929 CEST	443	49796	13.85.23.86	192.168.2.4
Aug 31, 2024 20:42:55.312458038 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.312499046 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.312510014 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.312516928 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.312553883 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.312582016 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.312849045 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.312860966 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.312954903 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.312967062 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.796015024 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.796319008 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.796336889 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.797499895 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.797827005 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.798005104 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.806452990 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.806662083 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.806669950 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.806957006 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.807421923 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.807487011 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.849972963 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.850868940 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:57.648900032 CEST	49758	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:57.648902893 CEST	49759	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:57.648916960 CEST	443	49758	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:57.648920059 CEST	443	49759	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.556611061 CEST	49800	443	192.168.2.4	23.223.209.207
Aug 31, 2024 20:42:58.556657076 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:42:58.556734085 CEST	49800	443	192.168.2.4	23.223.209.207
Aug 31, 2024 20:42:58.556909084 CEST	49800	443	192.168.2.4	23.223.209.207
Aug 31, 2024 20:42:58.556921959 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:42:59.027195930 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:42:59.027650118 CEST	49800	443	192.168.2.4	23.223.209.207
Aug 31, 2024 20:42:59.027687073 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:42:59.027964115 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:42:59.031234026 CEST	49800	443	192.168.2.4	23.223.209.207
Aug 31, 2024 20:42:59.031290054 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:42:59.034610033 CEST	49800	443	192.168.2.4	23.223.209.207
Aug 31, 2024 20:42:59.080503941 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:42:59.176011086 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:42:59.176048040 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:42:59.176163912 CEST	49800	443	192.168.2.4	23.223.209.207
Aug 31, 2024 20:42:59.177620888 CEST	49800	443	192.168.2.4	23.223.209.207
Aug 31, 2024 20:42:59.177642107 CEST	443	49800	23.223.209.207	192.168.2.4
Aug 31, 2024 20:43:03.522164106 CEST	49763	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:03.522170067 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:03.522186041 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:03.522190094 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:10.702861071 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:10.702949047 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:10.703000069 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:10.712544918 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:10.712603092 CEST	443	49798	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:10.712651968 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:34.537128925 CEST	49768	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:43:34.537131071 CEST	49769	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:43:34.537153959 CEST	443	49768	142.250.65.238	192.168.2.4
Aug 31, 2024 20:43:34.537157059 CEST	443	49769	142.250.65.238	192.168.2.4
Aug 31, 2024 20:43:48.521927118 CEST	49763	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:48.521928072 CEST	49764	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:48.521955967 CEST	443	49764	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:48.521955967 CEST	443	49763	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:55.710012913 CEST	49797	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:55.710030079 CEST	443	49797	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:55.725123882 CEST	49798	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:55.725130081 CEST	443	49798	172.64.41.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 20:41:56.481247902 CEST	53	57248	1.1.1.1	192.168.2.4
Aug 31, 2024 20:41:57.636512995 CEST	59107	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:41:57.636826992 CEST	64387	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:41:59.002506018 CEST	53	49331	1.1.1.1	192.168.2.4
Aug 31, 2024 20:41:59.007636070 CEST	53	60069	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.419692993 CEST	51028	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.419795036 CEST	57950	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.420067072 CEST	49321	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.420471907 CEST	62004	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.420473099 CEST	64051	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.420737982 CEST	60553	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.421240091 CEST	56243	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.421484947 CEST	63602	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.428849936 CEST	53	51028	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.429600954 CEST	53	49321	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.429732084 CEST	53	57950	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.431421995 CEST	53	62004	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.431641102 CEST	53	63602	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.431704998 CEST	53	60553	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.431713104 CEST	53	56243	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.431716919 CEST	53	64051	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.464061022 CEST	50473	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.464061022 CEST	51752	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:00.470786095 CEST	53	50473	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:00.471153021 CEST	53	51752	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:01.175371885 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.477760077 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.621196032 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.621750116 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.621759892 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.621769905 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.621783972 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.622001886 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.623610973 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.623769045 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.624386072 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.624468088 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.722579956 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.722676039 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.722683907 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.722691059 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.722697973 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.723051071 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.723121881 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.725487947 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.728538036 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.730607986 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.730834961 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:01.824065924 CEST	443	57642	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:01.853377104 CEST	57642	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.239461899 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.553714991 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.701184034 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.701260090 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.701272964 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.701283932 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.701293945 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.701914072 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.709999084 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.710299969 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.710428953 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.710705996 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.711036921 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.809923887 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.810061932 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.810416937 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.811825991 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.811858892 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.812524080 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.813142061 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.813370943 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.816615105 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.923329115 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.923571110 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:02.950696945 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:02.985740900 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.036058903 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.036252022 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.037249088 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.037439108 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.219710112 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.220062017 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.320909023 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.321804047 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.322438002 CEST	443	53458	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:03.322568893 CEST	53458	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:03.705549002 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.010596037 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.188568115 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.188663006 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.189101934 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.194636106 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.194684982 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.194725990 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.194782019 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.195152998 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.195727110 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.196522951 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.196619987 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.196896076 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.196909904 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.209718943 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.294203043 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.294214964 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.294816017 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.298363924 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.307939053 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.308284998 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.310652018 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.311999083 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.312866926 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.321676970 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.321973085 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.322077036 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:04.353079081 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:04.419677019 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:12.024723053 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:12.024791002 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:12.123042107 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:12.159949064 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:12.159981966 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:12.160443068 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:12.193788052 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:12.386277914 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:12.386288881 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:12.386535883 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:15.767396927 CEST	64700	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:15.767613888 CEST	52774	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:15.774844885 CEST	53	64700	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:15.775023937 CEST	53	52774	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:17.232650995 CEST	138	138	192.168.2.4	192.168.2.255
Aug 31, 2024 20:42:18.638593912 CEST	53	63116	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:18.990911961 CEST	49189	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:18.990911961 CEST	63239	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:18.991632938 CEST	51401	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:18.991894960 CEST	51684	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:18.997706890 CEST	53	49189	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:18.997756004 CEST	53	63239	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:18.998348951 CEST	53	51401	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:18.998476982 CEST	53	51684	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:19.034842014 CEST	64923	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:19.035043955 CEST	49734	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:42:19.041836023 CEST	53	49734	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:19.042418957 CEST	53	64923	1.1.1.1	192.168.2.4
Aug 31, 2024 20:42:33.014740944 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:33.014818907 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:33.113003969 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.127852917 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.128056049 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:33.195560932 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:33.377634048 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.446660042 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:33.686791897 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:33.700122118 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.710452080 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.710526943 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.710738897 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:33.713335037 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.713537931 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:33.713773012 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.741156101 CEST	63997	443	192.168.2.4	142.250.65.238
Aug 31, 2024 20:42:33.785145044 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.808156967 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:33.810875893 CEST	443	63997	142.250.65.238	192.168.2.4
Aug 31, 2024 20:42:34.063709974 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.365962029 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.530204058 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.530267954 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.530827999 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.530873060 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.530884027 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.533381939 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.533381939 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.534388065 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.628006935 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.628019094 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.628026962 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.628035069 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.628266096 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.628463030 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.628463030 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:34.722820044 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:34.774130106 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.595700026 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.596400023 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.597608089 CEST	63995	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.692404032 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:35.692949057 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:35.693077087 CEST	443	57308	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:35.693538904 CEST	57308	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:35.912564039 CEST	63995	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.063350916 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.063469887 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.063982010 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.064038038 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.064048052 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.064291000 CEST	63995	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.065979004 CEST	63995	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.066127062 CEST	63995	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.166661978 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.166672945 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.166680098 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.166687965 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.166696072 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.167004108 CEST	63995	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.167061090 CEST	63995	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:36.266688108 CEST	443	63995	162.159.61.3	192.168.2.4
Aug 31, 2024 20:42:36.302704096 CEST	63995	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:42:55.312155008 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.615896940 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.766676903 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.766690969 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.766700983 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.768101931 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.768112898 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.768371105 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.769819975 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.769937038 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.770169020 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.770308971 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.864559889 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.864573002 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.864583015 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.864589930 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.864944935 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.864944935 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.868541956 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.868578911 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.868948936 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.869085073 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:55.958678961 CEST	443	58477	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:55.992613077 CEST	58477	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:57.650015116 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:57.650173903 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:57.650367022 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:57.650470972 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:58.052956104 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:58.095379114 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.095999956 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:58.130805969 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:58.148905039 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.148917913 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.148925066 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.148932934 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.149317026 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:58.149317980 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:58.189798117 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.224653959 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:58.242966890 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.243155003 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:58.485450983 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.521730900 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:42:58.552248001 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.555270910 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.555865049 CEST	443	53531	172.64.41.3	192.168.2.4
Aug 31, 2024 20:42:58.556278944 CEST	53531	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:03.745145082 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:03.745300055 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:03.745589972 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:03.745675087 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.147007942 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.190500021 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.191046953 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.224816084 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.242708921 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.242719889 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.242782116 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.242789984 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.242945910 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.243026972 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.243094921 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.286358118 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.318393946 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.526303053 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.526664019 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.549314976 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.586107016 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.623605013 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.624037981 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.624181986 CEST	443	53270	172.64.41.3	192.168.2.4
Aug 31, 2024 20:43:04.624413013 CEST	53270	443	192.168.2.4	172.64.41.3
Aug 31, 2024 20:43:04.625416994 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:04.625557899 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.072834015 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.083092928 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.083110094 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.083872080 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.083872080 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.084120035 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.084208012 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.084522963 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.084568977 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.099598885 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.167028904 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.167627096 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.178232908 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.178503036 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.178510904 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.178786039 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.179378033 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.182557106 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.192325115 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.192356110 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.192636967 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.193034887 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.193356991 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.194408894 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.226660967 CEST	54701	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:05.261478901 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.286744118 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:05.314007998 CEST	443	54701	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:34.602592945 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:34.602694035 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.061501980 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.061522961 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.062243938 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.062243938 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.062504053 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.062628031 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.062628031 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.078907013 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.157542944 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.158315897 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.158426046 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.159215927 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.159600973 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.173391104 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.173401117 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.173408985 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.174195051 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:35.176274061 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.180048943 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.218221903 CEST	65206	443	192.168.2.4	142.250.65.206
Aug 31, 2024 20:43:35.273818970 CEST	443	65206	142.250.65.206	192.168.2.4
Aug 31, 2024 20:43:54.672787905 CEST	58845	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:43:54.673099041 CEST	55595	53	192.168.2.4	1.1.1.1
Aug 31, 2024 20:43:54.679708958 CEST	53	58845	1.1.1.1	192.168.2.4
Aug 31, 2024 20:43:54.679737091 CEST	53	55595	1.1.1.1	192.168.2.4
Aug 31, 2024 20:43:54.681134939 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:54.681308985 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:54.681593895 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:54.681765079 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:55.099601984 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:55.127150059 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.127707958 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:55.162115097 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:55.196227074 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.196393967 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.196403027 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.196407080 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.196583033 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:55.196784973 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:55.196860075 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:55.224205971 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.256742001 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:55.293998003 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.294214964 CEST	53993	443	192.168.2.4	162.159.61.3
Aug 31, 2024 20:43:55.392035961 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.393285036 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.393307924 CEST	443	53993	162.159.61.3	192.168.2.4
Aug 31, 2024 20:43:55.393668890 CEST	53993	443	192.168.2.4	162.159.61.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 31, 2024 20:42:00.641279936 CEST	192.168.2.4	1.1.1.1	c28d	(Port unreachable)	Destination Unreachable
Aug 31, 2024 20:42:15.815607071 CEST	192.168.2.4	1.1.1.1	c2b9	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 20:41:57.636512995 CEST	192.168.2.4	1.1.1.1	0x34f8	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:41:57.636826992 CEST	192.168.2.4	1.1.1.1	0xb305	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 31, 2024 20:42:00.419692993 CEST	192.168.2.4	1.1.1.1	0xc760	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.419795036 CEST	192.168.2.4	1.1.1.1	0xf771	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 20:42:00.420067072 CEST	192.168.2.4	1.1.1.1	0x75e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.420471907 CEST	192.168.2.4	1.1.1.1	0xecb6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 20:42:00.420473099 CEST	192.168.2.4	1.1.1.1	0x91c7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.420737982 CEST	192.168.2.4	1.1.1.1	0xac6b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 20:42:00.421240091 CEST	192.168.2.4	1.1.1.1	0xd942	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.421484947 CEST	192.168.2.4	1.1.1.1	0x77a2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 20:42:00.464061022 CEST	192.168.2.4	1.1.1.1	0xc792	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.464061022 CEST	192.168.2.4	1.1.1.1	0x6cec	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 20:42:15.767396927 CEST	192.168.2.4	1.1.1.1	0x3301	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:15.767613888 CEST	192.168.2.4	1.1.1.1	0x3094	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Aug 31, 2024 20:42:18.990911961 CEST	192.168.2.4	1.1.1.1	0x1ebf	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:18.990911961 CEST	192.168.2.4	1.1.1.1	0xa2d1	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 20:42:18.991632938 CEST	192.168.2.4	1.1.1.1	0xe18	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:18.991894960 CEST	192.168.2.4	1.1.1.1	0xc8e4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 20:42:19.034842014 CEST	192.168.2.4	1.1.1.1	0xa3fc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:19.035043955 CEST	192.168.2.4	1.1.1.1	0x8a55	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 20:43:54.672787905 CEST	192.168.2.4	1.1.1.1	0xc42b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:43:54.673099041 CEST	192.168.2.4	1.1.1.1	0xe02a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 20:41:57.644704103 CEST	1.1.1.1	192.168.2.4	0x34f8	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:41:57.644964933 CEST	1.1.1.1	192.168.2.4	0xb305	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:00.428849936 CEST	1.1.1.1	192.168.2.4	0xc760	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.428849936 CEST	1.1.1.1	192.168.2.4	0xc760	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.429600954 CEST	1.1.1.1	192.168.2.4	0x75e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.429600954 CEST	1.1.1.1	192.168.2.4	0x75e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.429732084 CEST	1.1.1.1	192.168.2.4	0xf771	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 20:42:00.431421995 CEST	1.1.1.1	192.168.2.4	0xecb6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 20:42:00.431641102 CEST	1.1.1.1	192.168.2.4	0x77a2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 20:42:00.431704998 CEST	1.1.1.1	192.168.2.4	0xac6b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 20:42:00.431713104 CEST	1.1.1.1	192.168.2.4	0xd942	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.431713104 CEST	1.1.1.1	192.168.2.4	0xd942	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.431716919 CEST	1.1.1.1	192.168.2.4	0x91c7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.431716919 CEST	1.1.1.1	192.168.2.4	0x91c7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.470786095 CEST	1.1.1.1	192.168.2.4	0xc792	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.470786095 CEST	1.1.1.1	192.168.2.4	0xc792	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:00.471153021 CEST	1.1.1.1	192.168.2.4	0x6cec	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 20:42:00.714196920 CEST	1.1.1.1	192.168.2.4	0xda08	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:00.714196920 CEST	1.1.1.1	192.168.2.4	0xda08	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:15.774844885 CEST	1.1.1.1	192.168.2.4	0x3301	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:15.774844885 CEST	1.1.1.1	192.168.2.4	0x3301	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:15.775023937 CEST	1.1.1.1	192.168.2.4	0x3094	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:15.800072908 CEST	1.1.1.1	192.168.2.4	0x91ad	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:15.800072908 CEST	1.1.1.1	192.168.2.4	0x91ad	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:17.112641096 CEST	1.1.1.1	192.168.2.4	0xc03	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:17.112641096 CEST	1.1.1.1	192.168.2.4	0xc03	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:17.160108089 CEST	1.1.1.1	192.168.2.4	0xa379	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:18.516797066 CEST	1.1.1.1	192.168.2.4	0x549c	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:18.516797066 CEST	1.1.1.1	192.168.2.4	0x549c	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:18.869616985 CEST	1.1.1.1	192.168.2.4	0x9fcc	No error (0)	wildcard.sf.tlu.dl.delivery.mp.microsoft.com.cdn.dnsv1.com	microsoft-sf.ovslegodl.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:18.997706890 CEST	1.1.1.1	192.168.2.4	0x1ebf	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:18.997706890 CEST	1.1.1.1	192.168.2.4	0x1ebf	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:18.997756004 CEST	1.1.1.1	192.168.2.4	0xa2d1	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 20:42:18.998348951 CEST	1.1.1.1	192.168.2.4	0xe18	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:18.998348951 CEST	1.1.1.1	192.168.2.4	0xe18	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:18.998476982 CEST	1.1.1.1	192.168.2.4	0xc8e4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 20:42:19.041836023 CEST	1.1.1.1	192.168.2.4	0x8a55	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 20:42:19.042418957 CEST	1.1.1.1	192.168.2.4	0xa3fc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:19.042418957 CEST	1.1.1.1	192.168.2.4	0xa3fc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:20.156490088 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:20.156490088 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:21.171174049 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:21.171174049 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:22.184216022 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:22.184216022 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:24.788527966 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:24.788527966 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:42:28.200412989 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 20:42:28.200412989 CEST	1.1.1.1	192.168.2.4	0x1721	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:43:54.679708958 CEST	1.1.1.1	192.168.2.4	0xc42b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:43:54.679708958 CEST	1.1.1.1	192.168.2.4	0xc42b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 20:43:54.679737091 CEST	1.1.1.1	192.168.2.4	0xe02a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
2024-08-31 18:42:34 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	true
2024-08-31 18:42:34 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	true
2024-08-31 18:42:34 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	true

HTTP Request Dependency Graph

chrome.cloudflare-dns.com

edgeassetservice.azureedge.net

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49751	162.159.61.3	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 18:42:01 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:01 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf28748c624239-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:01 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ed 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49750	162.159.61.3	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 18:42:01 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:01 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf28748c114340-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:01 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b1 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49747	172.64.41.3	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 18:42:01 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:01 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf2874886842d4-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:01 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e7 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49748	172.64.41.3	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 18:42:01 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:01 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf28748bc7c407-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:01 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom%PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49749	172.64.41.3	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:00 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:00 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 18:42:01 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:01 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf28748a384258-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:01 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b1 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49754	13.107.246.60	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:01 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 18:42:01 UTC	559	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 18:42:01 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T184201Z-16579567576pg4fvvmc18u0v4g000000059g00000000fm48 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-31 18:42:01 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49760	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:02 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 18:42:02 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=252218 Date: Sat, 31 Aug 2024 18:42:02 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49761	13.107.246.40	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:02 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 18:42:02 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 18:42:02 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T184202Z-165795675767jvm9z21nmtw4wn000000053g000000006zsz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-31 18:42:02 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-31 18:42:02 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-31 18:42:02 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-31 18:42:02 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-31 18:42:02 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49762	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:03 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 18:42:03 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=252217 Date: Sat, 31 Aug 2024 18:42:03 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-31 18:42:03 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49766	142.250.65.238	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:03 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 18:42:03 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 18:42:03 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49765	142.250.65.238	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:03 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 18:42:03 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 18:42:03 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49767	142.250.81.228	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:03 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 18:42:03 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 31 Aug 2024 17:25:07 GMT Expires: Sun, 08 Sep 2024 17:25:07 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 4616 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 18:42:03 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-31 18:42:03 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-31 18:42:03 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-31 18:42:03 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-31 18:42:03 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49770	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:12 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zzBvX73tGYgumKy&MD=hZ8pXY2C HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 18:42:12 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 37967023-2b60-432c-a2df-ce1abaef0bbe MS-RequestId: e7027ca0-7749-4414-96a9-5be6ff1d048f MS-CV: +8R1zoUhyEugRH7h.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 18:42:12 GMT Connection: close Content-Length: 24490
2024-08-31 18:42:12 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-31 18:42:12 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49782	13.107.246.60	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:16 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 18:42:16 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 18:42:16 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T184216Z-16579567576rt7gkm43y59pk38000000055g0000000092tt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-31 18:42:16 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49781	172.217.18.1	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:16 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 18:42:16 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljsvkdyLQN5ME9bCDQAD9zre8w85c1BzOiR-oI3BSc8K7KfSTlxuG8dj8ALvmiOTcFyKqvH62Hs3pQ X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Fri, 30 Aug 2024 19:15:10 GMT Expires: Sat, 30 Aug 2025 19:15:10 GMT Cache-Control: public, max-age=31536000 Age: 84426 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 18:42:16 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-08-31 18:42:16 UTC	1390	IN	Data Raw: fd c7 0f 59 dd ca cf cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d Data Ascii: Y0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>
2024-08-31 18:42:16 UTC	1390	IN	Data Raw: b0 78 c3 9a 50 64 5d fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad Data Ascii: xPd]DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewW
2024-08-31 18:42:16 UTC	1390	IN	Data Raw: d9 73 4a e4 91 70 9d a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d Data Ascii: sJp:fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~
2024-08-31 18:42:16 UTC	1390	IN	Data Raw: 58 f0 77 67 86 f4 73 f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb Data Ascii: Xwgs9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:
2024-08-31 18:42:16 UTC	1390	IN	Data Raw: 4d 15 00 a4 81 86 68 ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a Data Ascii: Mh3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:
2024-08-31 18:42:16 UTC	1390	IN	Data Raw: a0 8e 2c ba 65 e8 66 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 Data Ascii: ,ef4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$
2024-08-31 18:42:16 UTC	1390	IN	Data Raw: 3f ec fa 62 d7 ae 70 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 Data Ascii: ?bpnh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u
2024-08-31 18:42:16 UTC	1390	IN	Data Raw: f9 d6 22 50 e1 7c 45 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 Data Ascii: "P\|E'3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9
2024-08-31 18:42:16 UTC	1390	IN	Data Raw: 4e 57 c1 ef e1 60 9a 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f Data Ascii: NW`^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gOD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49787	162.159.61.3	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:19 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:19 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 18:42:19 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:19 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf28e949577d08-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:19 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ff 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49788	162.159.61.3	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:19 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:19 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 18:42:19 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:19 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf28e949c28c6b-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:19 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 19 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49786	162.159.61.3	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:19 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:19 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 18:42:19 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:19 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf28e928eb6a58-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:19 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ce 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49789	162.159.61.3	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA)/+
2024-08-31 18:42:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf29465ab818b1-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 06 00 01 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d b5 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 51 25 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 00 d1 00 1c 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 09 61 7a 75 72 65 65 64 67 65 c0 b3 c0 c4 00 05 00 01 00 00 06 ad 00 15 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 02 65 63 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA4starsftludldeliverympmicrosoftcomdelivery3RQ%&cdp-f-ssl-tlu-nettrafficmanagernetwildcardtlu-sslazureedgewildcardtlu-sslec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49790	162.159.61.3	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcom)/+
2024-08-31 18:42:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf294649b342d7-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 07 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 08 5a 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 4b ca 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 00 b3 00 1c 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 09 61 7a 75 72 65 65 64 67 65 c0 b3 c0 c4 00 05 00 01 00 00 06 8f 00 15 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 02 65 63 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomZ4starsftludldeliverympmicrosoftcomdelivery3RK&cdp-f-ssl-tlu-nettrafficmanagernetwildcardtlu-sslazureedgewildcardtlu-sslec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49791	152.195.19.97	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:35 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725734536&P2=404&P3=2&P4=HZyZCpjvtvEsj9AQQUAOcfXwpT5P1CqgwuE6lAyTtmiB2PMIRmOaDySoNtOxlRwPH9qZ%2fNmInPyF8M9QeMdTKg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: +C7/aPGTCdKAMU6XLtmJHN Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 18:42:35 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5056286 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sat, 31 Aug 2024 18:42:35 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-08-31 18:42:35 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49793	162.159.61.3	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-08-31 18:42:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf294fdba843dd-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d e6 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 12 00 02 c0 43 c0 43 00 01 00 01 00 00 00 12 00 04 0d 6b 15 ef c0 43 00 01 00 01 00 00 00 12 00 04 cc 4f c5 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCkCO)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49792	162.159.61.3	443	7604	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 18:42:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2024-08-31 18:42:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 18:42:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbf294fd9371768-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 18:42:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0e 0d 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 ed 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA-edge-microsoft-comdual-a-0036a-msedgenetO#ns1Omsnhstx+"$)=9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49796	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:51 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zzBvX73tGYgumKy&MD=hZ8pXY2C HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 18:42:52 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: f20e4894-af9b-46ed-a282-1fbbf0f3ea64 MS-RequestId: 50e58d20-6237-43a9-bdd4-fa43cd1e3a23 MS-CV: gaUuiS0HS0ydoTyJ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 18:42:51 GMT Connection: close Content-Length: 30005
2024-08-31 18:42:52 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-31 18:42:52 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49800	23.223.209.207	443	7868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 18:42:59 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 18:42:59 UTC	332	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Date: Sat, 31 Aug 2024 18:42:59 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.cfbbd717.1725129779.4aee7f56 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	14:41:53
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf0000
File size:	917'504 bytes
MD5 hash:	8ED23A69E2084E1A94597C441658254E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:41:53
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:41:53
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2096,i,18383972108529384836,11793983287344144029,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:41:53
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:41:54
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:41:59
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7760 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:41:59
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3436 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:42:00
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7086d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:42:00
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7340 --field-trial-handle=2032,i,15502300999554502982,58084370835951274,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7086d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:42:12
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	14:42:12
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	14:42:13
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4080 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:42:14
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5984 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8
Imagebase:	0x7ff7086d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:42:14
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5984 --field-trial-handle=2032,i,8352793268309745401,7531272831810527599,262144 /prefetch:8
Imagebase:	0x7ff7086d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:42:20
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:42:21
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=1960,i,15799680679975826435,5556209134532581845,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:42:28
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:42:29
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2108,i,1270928443281422738,12119147721520445280,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:42:41
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:42:42
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2088,i,1395523319678171847,346153623225115163,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	1379
Total number of Limit Nodes:	48

Executed Functions

Function 0010F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0010F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0014F474
IsIconic.USER32(00000000), ref: 0014F47D
ShowWindow.USER32(00000000,00000009), ref: 0014F48A
SetForegroundWindow.USER32(00000000), ref: 0014F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0014F4AA
GetCurrentThreadId.KERNEL32 ref: 0014F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0014F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0014F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0014F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0014F4DE
SetForegroundWindow.USER32(00000000), ref: 0014F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0014F4F6
keybd_event.USER32(00000012,00000000), ref: 0014F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0014F50B
keybd_event.USER32(00000012,00000000), ref: 0014F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0014F519
keybd_event.USER32(00000012,00000000), ref: 0014F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0014F528
keybd_event.USER32(00000012,00000000), ref: 0014F52D
SetForegroundWindow.USER32(00000000), ref: 0014F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0014F557

Strings

Shell_TrayWnd, xrefs: 0014F46F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: b6aa697faf2e181c9c9145f24b2b3721d1387b9bc209c4731dae7924ff993125
Instruction ID: 75c841923de19148931a2035a65da3149670b7fd0ec54dd5aaafc8be428b2974
Opcode Fuzzy Hash: b6aa697faf2e181c9c9145f24b2b3721d1387b9bc209c4731dae7924ff993125
Instruction Fuzzy Hash: F9313071B40218BAEB206BB55C4AFBF7E6CEB44B50F110069F605EA2D1D7B15A41ABB0

Function 000F42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 000F430D

Part of subcall function 000F6B57: _wcslen.LIBCMT ref: 000F6B6A

GetCurrentProcess.KERNEL32(?,0018CB64,00000000,?,?), ref: 000F4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 000F4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 000F4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 000F4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 000F4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 000F447B
GetSystemInfo.KERNEL32(?,?,?), ref: 000F44A0

Strings

GetNativeSystemInfo, xrefs: 000F4460
|O, xrefs: 001336F8
kernel32.dll, xrefs: 000F444F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: e2a3d5ede22dd9e471b3906666ba8c494d8fe1c187d0dfc2ee38c4105ea6ed52
Instruction ID: b8d71981f07b8de52d8fff4077a4ac484d2238b26e1800086587f1475f1bc47f
Opcode Fuzzy Hash: e2a3d5ede22dd9e471b3906666ba8c494d8fe1c187d0dfc2ee38c4105ea6ed52
Instruction Fuzzy Hash: 24A1E67299A2C4EFC712C76A7C459A93FA47B63328B047598D441A3E23D330C6C8DB66

Function 000F42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,000F50AA,?,?,00000000,00000000), ref: 000F42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,000F50AA,?,?,00000000,00000000), ref: 000F42C9
LoadResource.KERNEL32(?,00000000,?,?,000F50AA,?,?,00000000,00000000,?,?,?,?,?,?,000F4F20), ref: 001335BE
SizeofResource.KERNEL32(?,00000000,?,?,000F50AA,?,?,00000000,00000000,?,?,?,?,?,?,000F4F20), ref: 001335D3
LockResource.KERNEL32(000F50AA,?,?,000F50AA,?,?,00000000,00000000,?,?,?,?,?,?,000F4F20,?), ref: 001335E6

Strings

SCRIPT, xrefs: 000F42BF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: d46400a69102547071601858238498f2a68d8e65aaa8d46cd6e9b61b3b507128
Instruction ID: ba6b71f1e4ad76b53cd68017f7203e49f948c5832abc3cabb0c7dc9b5bbe0b43
Opcode Fuzzy Hash: d46400a69102547071601858238498f2a68d8e65aaa8d46cd6e9b61b3b507128
Instruction Fuzzy Hash: 4D118E70600704BFD7218B65DC48F277BBAEBC5B51F104169F902D6AA0DB71DD409B70

Function 00132BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 000F2B6B

Part of subcall function 000F3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,001C1418,?,000F2E7F,?,?,?,00000000), ref: 000F3A78

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,001B2224), ref: 00132C10
ShellExecuteW.SHELL32(00000000,?,?,001B2224), ref: 00132C17

Strings

runas, xrefs: 00132C0B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: a95a40cbdb0774fc2908bb0e51ec1fac5518e218f171461c8e1806d85ec51baa
Instruction ID: 19be62d30494b43ccef1262e8e8dfca06a7476b646d081f1910ec1132135781e
Opcode Fuzzy Hash: a95a40cbdb0774fc2908bb0e51ec1fac5518e218f171461c8e1806d85ec51baa
Instruction Fuzzy Hash: CB11D63120834D6AC715FF60D852EFEBBA59F91750F48142DF782528A3DF31CA4AA752

Function 0015DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00135222), ref: 0015DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0015DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0015DBEE
FindClose.KERNEL32(00000000), ref: 0015DBFA

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 0e425b351dceee1ba87a3283f94e931347eb6b97f4cf0d48968c0366c85a2083
Instruction ID: 0f32282c811123c9ddfc4c4d94b55383b9deb5d89a28b767e1d30aee5048dfde
Opcode Fuzzy Hash: 0e425b351dceee1ba87a3283f94e931347eb6b97f4cf0d48968c0366c85a2083
Instruction Fuzzy Hash: E8F0A030810910D782306B78BC0D8AE37AE9F02336B10470AF836C64E0EBB05A9887E5

Function 0017AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0017B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0017B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0017B1D4
_wcslen.LIBCMT ref: 0017B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0017B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0017B236
_wcslen.LIBCMT ref: 0017B332

Part of subcall function 001605A7: GetStdHandle.KERNEL32(000000F6), ref: 001605C6

_wcslen.LIBCMT ref: 0017B34B
_wcslen.LIBCMT ref: 0017B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0017B3B6
GetLastError.KERNEL32(00000000), ref: 0017B407
CloseHandle.KERNEL32(?), ref: 0017B439
CloseHandle.KERNEL32(00000000), ref: 0017B44A
CloseHandle.KERNEL32(00000000), ref: 0017B45C
CloseHandle.KERNEL32(00000000), ref: 0017B46E
CloseHandle.KERNEL32(?), ref: 0017B4E3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 5959ccbb9d3b57723de35955e352bdcc6db98900d80368e3d43d100c0974fc35
Instruction ID: cf323d1cdf1dfc8f3eea202608b3fa3630cd3b6407b0c3d685ed03bd54e43e8b
Opcode Fuzzy Hash: 5959ccbb9d3b57723de35955e352bdcc6db98900d80368e3d43d100c0974fc35
Instruction Fuzzy Hash: 8DF189316083049FC724EF24C891B6EBBF5AF85714F14855DF99A8B2A2CB71EC45CB92

Function 000FD744 Relevance: 21.6, APIs: 14, Instructions: 616windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 000FD807
timeGetTime.WINMM ref: 000FDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000FDB28
TranslateMessage.USER32(?), ref: 000FDB7B
DispatchMessageW.USER32(?), ref: 000FDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000FDB9F
Sleep.KERNELBASE(0000000A), ref: 000FDBB1

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 007a9c96f520accb8dfe232b89ff36275bee08aa4eedf9676ce5a6adb180af18
Instruction ID: 62bd488e80015ef7ff19fd13d6bd7578a2b2d07da032314ce3d1a6ef3204f101
Opcode Fuzzy Hash: 007a9c96f520accb8dfe232b89ff36275bee08aa4eedf9676ce5a6adb180af18
Instruction Fuzzy Hash: 6532D230608346EFD738CF24C884BBAB7E2BF45304F54451AF55587AA1D7B0E984EB92

Function 000F2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 000F2D07
RegisterClassExW.USER32(00000030), ref: 000F2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000F2D42
InitCommonControlsEx.COMCTL32(?), ref: 000F2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000F2D6F
LoadIconW.USER32(000000A9), ref: 000F2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 000F2D94

Strings

AutoIt v3 GUI, xrefs: 000F2D23
+, xrefs: 000F2CF0
TaskbarCreated, xrefs: 000F2D37
0, xrefs: 000F2CE9

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 433fdc4492dfcad69742512ede2f3ae6be6358dfab16281f60e644487e24db5b
Instruction ID: 78a8dddb7e4f3b7b3555d086c819ce41bc26c8e89a938dfacb9176d5d5a4fc3d
Opcode Fuzzy Hash: 433fdc4492dfcad69742512ede2f3ae6be6358dfab16281f60e644487e24db5b
Instruction Fuzzy Hash: 0521C3B5941218AFDB00DFA4ED49BDDBFB4FB09704F10411AF511A66A1D7B18684CFA1

Function 0013065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013039A: CreateFileW.KERNELBASE(00000000,00000000,?,00130704,?,?,00000000,?,00130704,00000000,0000000C), ref: 001303B7

GetLastError.KERNEL32 ref: 0013076F
__dosmaperr.LIBCMT ref: 00130776
GetFileType.KERNELBASE(00000000), ref: 00130782
GetLastError.KERNEL32 ref: 0013078C
__dosmaperr.LIBCMT ref: 00130795
CloseHandle.KERNEL32(00000000), ref: 001307B5
CloseHandle.KERNEL32(?), ref: 001308FF
GetLastError.KERNEL32 ref: 00130931
__dosmaperr.LIBCMT ref: 00130938

Strings

H, xrefs: 001308BD

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 9ab88d7e81d60684e594e28ffc8527b2c738eeafd974912cc2f587d9071314e2
Instruction ID: eeb63590fc068da73b8d5162c3db6ff1d5e4450e619028c65fa5e6ae6f4dd993
Opcode Fuzzy Hash: 9ab88d7e81d60684e594e28ffc8527b2c738eeafd974912cc2f587d9071314e2
Instruction Fuzzy Hash: 92A10332A041088FDF1AAF68DC62BAE7BE1AB1A324F14015DF815AB291D731DD53CB91

Function 000F344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000F3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,001C1418,?,000F2E7F,?,?,?,00000000), ref: 000F3A78

Part of subcall function 000F3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 000F3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 000F356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0013318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 001331CE
RegCloseKey.ADVAPI32(?), ref: 00133210
_wcslen.LIBCMT ref: 00133277
_wcslen.LIBCMT ref: 00133286

Strings

Software\AutoIt v3\AutoIt, xrefs: 000F3560
Include, xrefs: 00133184, 001331C5
\, xrefs: 0013328C
\Include\, xrefs: 000F3527

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 259696333e507412a75d34ebdb4585886a56aa37aac1dd7fe01ec4638db3465f
Instruction ID: c8ed257fca61d1f9d142ee6f9d33c7f8a7693132a3c2cf52b86ce8f000dffb77
Opcode Fuzzy Hash: 259696333e507412a75d34ebdb4585886a56aa37aac1dd7fe01ec4638db3465f
Instruction Fuzzy Hash: 6B719A715043449FC314EF65DC82DABBBE8BF98740F40152EF545939A1EB74DA88CBA2

Function 000F2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 000F2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 000F2B9D
LoadIconW.USER32(00000063), ref: 000F2BB3
LoadIconW.USER32(000000A4), ref: 000F2BC5
LoadIconW.USER32(000000A2), ref: 000F2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 000F2BEF
RegisterClassExW.USER32(?), ref: 000F2C40

Part of subcall function 000F2CD4: GetSysColorBrush.USER32(0000000F), ref: 000F2D07
Part of subcall function 000F2CD4: RegisterClassExW.USER32(00000030), ref: 000F2D31
Part of subcall function 000F2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000F2D42
Part of subcall function 000F2CD4: InitCommonControlsEx.COMCTL32(?), ref: 000F2D5F
Part of subcall function 000F2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000F2D6F
Part of subcall function 000F2CD4: LoadIconW.USER32(000000A9), ref: 000F2D85
Part of subcall function 000F2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 000F2D94

Strings

#, xrefs: 000F2C16
AutoIt v3, xrefs: 000F2C2F
0, xrefs: 000F2C0F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 6280bc7f338c82ec51047418ab8cecb12802e42f3e106be85f10d8548099a203
Instruction ID: 3b24a8e03be7a2fd9987d7e86e7b59a32e47fbe4bb68dab71bddf7949312c4e9
Opcode Fuzzy Hash: 6280bc7f338c82ec51047418ab8cecb12802e42f3e106be85f10d8548099a203
Instruction Fuzzy Hash: AA214C70E40358BBDB109FA5EC45EA97FB4FB49B64F00101AE600A6AA1D3B58690DF90

Function 000F3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,000F316A,?,?), ref: 000F31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,000F316A,?,?), ref: 000F3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 000F3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,000F316A,?,?), ref: 000F3232
CreatePopupMenu.USER32 ref: 000F3246
PostQuitMessage.USER32(00000000), ref: 000F3267

Strings

TaskbarCreated, xrefs: 000F322D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 1a17307564c38cf13d2d154c081ee5a18ec774d92e4a5e9318115ee10cb406d2
Instruction ID: ee0e4802b0d27396e4b15855fb7886d3c0a4655397316b572a23d85b9a5c278e
Opcode Fuzzy Hash: 1a17307564c38cf13d2d154c081ee5a18ec774d92e4a5e9318115ee10cb406d2
Instruction Fuzzy Hash: 2C41FA31280248F7DB642B789D59FBD3A55F746368F040129FB0696D92CB71DB80A7A1

Function 000F2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 000F2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 000F2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,000F1CAD,?), ref: 000F2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,000F1CAD,?), ref: 000F2CCF

Strings

edit, xrefs: 000F2CAC
AutoIt v3, xrefs: 000F2C89, 000F2C8E, 000F2C8F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 7cbdbe3b9ac98c52c998fe0c6a44b3cc9072984fb98bf9d150fb15e4d734c02b
Instruction ID: 684cfa6540004d04df20d3b575df4c49be940a3380cbfc5ccae998cef8de639e
Opcode Fuzzy Hash: 7cbdbe3b9ac98c52c998fe0c6a44b3cc9072984fb98bf9d150fb15e4d734c02b
Instruction Fuzzy Hash: 25F0DA759802D07AEB311717AC08E773EBDE7C7F64B01105AFD00A29A1C6755890DEB0

Function 0015E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0015E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0015E9A5
Sleep.KERNEL32(00000000), ref: 0015E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0015E9B7
Sleep.KERNELBASE ref: 0015E9F3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e99c5a9b60b98c7938ccac7add49682d34982609eccb9cf00f900150fd8e373a
Instruction ID: 32a95150876965d3663824bfd966f9b4721c122335b646dfda83ff24608affab
Opcode Fuzzy Hash: e99c5a9b60b98c7938ccac7add49682d34982609eccb9cf00f900150fd8e373a
Instruction Fuzzy Hash: 26016D31C01529DBCF08AFE4DD996EDBBB8FF09306F010546E922B6140DB309798C7A1

Function 000F3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,000F3B0F,SwapMouseButtons,00000004,?), ref: 000F3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,000F3B0F,SwapMouseButtons,00000004,?), ref: 000F3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,000F3B0F,SwapMouseButtons,00000004,?), ref: 000F3B83

Strings

Control Panel\Mouse, xrefs: 000F3B3E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 217ba16bff2f3f53fbfd83027a2729fd3144e583c04e505a12440dd21dcfeb01
Instruction ID: 304c5088434bec7fd29d3de3f77a041b1a88ce1370689a7af037798f71cd75e9
Opcode Fuzzy Hash: 217ba16bff2f3f53fbfd83027a2729fd3144e583c04e505a12440dd21dcfeb01
Instruction Fuzzy Hash: FA112AB5511208FFDB618FA5DC54ABEB7BCEF44794B10445ABA05D7510D3319F40A7A0

Function 000F3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 001333A2

Part of subcall function 000F6B57: _wcslen.LIBCMT ref: 000F6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 000F3A04

Strings

Line: , xrefs: 001333EB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: fd32ae6afa9b3c55df72001a2a9b75ae394c3726fe80d081e32e287651926338
Instruction ID: 0fb41af60506ad50766f2256f480a69d38db975170f7979816a21f7b57fb9255
Opcode Fuzzy Hash: fd32ae6afa9b3c55df72001a2a9b75ae394c3726fe80d081e32e287651926338
Instruction Fuzzy Hash: 6F31E471448308AAD321EB10DC45FFFB7D8BB41724F00592EF69992892DB709B88D7D2

Function 0010FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00110668

Part of subcall function 001132A4: RaiseException.KERNEL32(?,?,?,0011068A,?,001C1444,?,?,?,?,?,?,0011068A,000F1129,001B8738,000F1129), ref: 00113304

__CxxThrowException@8.LIBVCRUNTIME ref: 00110685

Strings

Unknown exception, xrefs: 00110692

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: b3cc35151eca7b63c801e3c25d98e41c9a3dd701728da56de8118948de2fbd4a
Instruction ID: ed119fc3e9792c3a7f0a77b6b2fa9dccfd10bf695d6f56e18f42402db7f65288
Opcode Fuzzy Hash: b3cc35151eca7b63c801e3c25d98e41c9a3dd701728da56de8118948de2fbd4a
Instruction Fuzzy Hash: 78F0C234D0020DB7CB1DBAA4DC46CDE7B6D5E14750B604135B924969D1EFB1DAE7CA80

Function 000F10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 000F1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 000F1BF4
Part of subcall function 000F1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 000F1BFC
Part of subcall function 000F1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 000F1C07
Part of subcall function 000F1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 000F1C12
Part of subcall function 000F1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 000F1C1A
Part of subcall function 000F1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 000F1C22

Part of subcall function 000F1B4A: RegisterWindowMessageW.USER32(00000004,?,000F12C4), ref: 000F1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 000F136A
OleInitialize.OLE32 ref: 000F1388
CloseHandle.KERNEL32(00000000,00000000), ref: 001324AB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: cefde5cf2c2e0571921d0adb71ed690dd558b1038908d37e48e893b83e2b2bea
Instruction ID: 6dd7f81e9b7e59b35526cdfd75e470617dd67a605aa17e09be725733fed10614
Opcode Fuzzy Hash: cefde5cf2c2e0571921d0adb71ed690dd558b1038908d37e48e893b83e2b2bea
Instruction Fuzzy Hash: 7871CFB4985304AFC384EF79A945EA53EE1BB9B344354822ED10AD7B63EB70C491CF91

Function 0015C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 000F3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0015C259
KillTimer.USER32(?,00000001,?,?), ref: 0015C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0015C270

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 989b00e13e089b99bf4a09619a26e0e63e80db8f4adc3de84743dcff6c29619b
Instruction ID: bdcbeed08c4887542f247b2bd2f95b6a7f20f9499cded6fb46ab0365810e85f1
Opcode Fuzzy Hash: 989b00e13e089b99bf4a09619a26e0e63e80db8f4adc3de84743dcff6c29619b
Instruction Fuzzy Hash: DB31A974904744EFEB329F648855BE7BBECAF16305F00049DD5EA9B141C7745AC8CB91

Function 001286AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,001285CC,?,001B8CC8,0000000C), ref: 00128704
GetLastError.KERNEL32(?,001285CC,?,001B8CC8,0000000C), ref: 0012870E
__dosmaperr.LIBCMT ref: 00128739

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 9cbbd797d1892dac8efe58db9e45a67b69c746c08feaa43c027df4a2afe528ab
Instruction ID: 7ae023f7fc74e0acb7e363e9efa31aac88fd8f12da11368b63651a63258ac08e
Opcode Fuzzy Hash: 9cbbd797d1892dac8efe58db9e45a67b69c746c08feaa43c027df4a2afe528ab
Instruction Fuzzy Hash: AE012632A0663027D725A334B889B7E6B5A9BA2B75F39011DF8148B1D3DFB0CCD18390

Function 000FDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 000FDB7B
DispatchMessageW.USER32(?), ref: 000FDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000FDB9F
Sleep.KERNELBASE(0000000A), ref: 000FDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00141CC9

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: dbf4110d3562a0b3ccd56c6e6c7dd914e948b5a54ba07b2597215df91e14c460
Instruction ID: 66651052727176df804b10bb9bfa8d8dda58013548330efbc2050f7bb9686863
Opcode Fuzzy Hash: dbf4110d3562a0b3ccd56c6e6c7dd914e948b5a54ba07b2597215df91e14c460
Instruction Fuzzy Hash: 74F05E30644344ABEB30CBA08C89FAA73ADEB45350F504A19E64A838D0DB30D5899B65

Function 00101310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001017F6

Strings

CALL, xrefs: 001017C6

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 7ff7f0d149a460e74d6f66d1ac1c367029c6cd0bbf79af642d395e472cf65c58
Instruction ID: a91f69b7cc514b5ac42085197a8f2048e10bca48d293fc0851843a3ba7008f42
Opcode Fuzzy Hash: 7ff7f0d149a460e74d6f66d1ac1c367029c6cd0bbf79af642d395e472cf65c58
Instruction Fuzzy Hash: C4229D70608241EFC714DF14C881B6ABBF1BF9A314F15892DF49A8B3A1D7B5E941CB92

Function 000F2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00132C8C

Part of subcall function 000F3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000F3A97,?,?,000F2E7F,?,?,?,00000000), ref: 000F3AC2

Part of subcall function 000F2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000F2DC4

Strings

X, xrefs: 00132C5A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: e367a261f5fe7e786d833b04c0ad5185843ead18d7cc27c3437360169f7bb103
Instruction ID: db898956e1927e9458817616af64dae42d2e9f8d3a6e16fc06d1dad1588cc250
Opcode Fuzzy Hash: e367a261f5fe7e786d833b04c0ad5185843ead18d7cc27c3437360169f7bb103
Instruction Fuzzy Hash: 2221A571A0029C9FCF01EF94C845BEE7BFCAF59314F004059E505B7242DBB85A899FA1

Function 000F3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 000F3908

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 0a52b580d347f07dd65b03427307af42767ddbe856453695d2536d9a4aa49142
Instruction ID: 3f935ef97777fb7d984f44dbba4fb037911a2d4f4a782209a05141d48200122a
Opcode Fuzzy Hash: 0a52b580d347f07dd65b03427307af42767ddbe856453695d2536d9a4aa49142
Instruction Fuzzy Hash: 0731E370504304DFD760DF24D884BA7BBE4FB49368F00082EFA9983A41E775AA84CB52

Function 0010F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0010F661

Part of subcall function 000FD744: GetInputState.USER32 ref: 000FD807

Sleep.KERNEL32(00000000), ref: 0014F2DE

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 1e4cf098c0375f0e90eceeef8cda0e4e02d4cb824c9e091566d07bab4016f170
Instruction ID: 40623215aeb4ad02a0f71552795e3b366ff772ca4e6720723e6bdd6bbd9432c5
Opcode Fuzzy Hash: 1e4cf098c0375f0e90eceeef8cda0e4e02d4cb824c9e091566d07bab4016f170
Instruction Fuzzy Hash: 7CF08C312446099FD314EF69D459BAAB7E9EF45760F00002AE959C7BA1DBB0A840DFA0

Function 000FB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 000FBB4E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 4bc966888e4adb3954dcb1405c58d03f1f11a99a6bf48e8087dc842426ac7f22
Instruction ID: cb9bbdf2283b52158808b5c4358c298e9d7ba2d4f4a4da5acb685cea47649455
Opcode Fuzzy Hash: 4bc966888e4adb3954dcb1405c58d03f1f11a99a6bf48e8087dc842426ac7f22
Instruction Fuzzy Hash: D532BC34A042099FDB25CF55C894EBEBBB5FF48300F148059EA05AB6A1C7B4ED81DF91

Function 00182598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00182649

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 5eeb62e11be19628933ff797b6877d1156dce60b0c515e17b3b5dded644fd923
Instruction ID: 555bf77ee69b3f7fc5993bff82e258c5b47afa2b960707f7e033a1bbafe9dc43
Opcode Fuzzy Hash: 5eeb62e11be19628933ff797b6877d1156dce60b0c515e17b3b5dded644fd923
Instruction Fuzzy Hash: 64212674200619AFE715EF14C8D0D76B7AAFF44368B20806CE8568B792D771EE41CF90

Function 001813B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00181420

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 39d1f66833175f6739597b61a27680203b83248e66f9b91b043ec7b3c4b6e9d9
Instruction ID: cc039ba35e2766d177db1f86a0717175756c3f543528c4ea726cd50c82830938
Opcode Fuzzy Hash: 39d1f66833175f6739597b61a27680203b83248e66f9b91b043ec7b3c4b6e9d9
Instruction Fuzzy Hash: 3431BF31604206AFD714EF29C491B69F7A6FF45328F048168E81A4F692DB75ED46CFD0

Function 000F4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 000F4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,000F4EDD,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4E9C
Part of subcall function 000F4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 000F4EAE
Part of subcall function 000F4E90: FreeLibrary.KERNEL32(00000000,?,?,000F4EDD,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4EFD

Part of subcall function 000F4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00133CDE,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4E62
Part of subcall function 000F4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 000F4E74
Part of subcall function 000F4E59: FreeLibrary.KERNEL32(00000000,?,?,00133CDE,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4E87

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 3c88b195349ef162d7e1e7c2dd4069eda6b30a57d5591a00163e2f1f64b5cd0a
Instruction ID: 41526449809290e52aea683b746560692d11dab40bf0b14868d89f82d93b3001
Opcode Fuzzy Hash: 3c88b195349ef162d7e1e7c2dd4069eda6b30a57d5591a00163e2f1f64b5cd0a
Instruction Fuzzy Hash: DE11E731610209ABCF24FF64DC02FFE77A5AF50711F10842DFA46A65C2DF709A49A760

Function 00128402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00128440

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: de1385ac0704210f5195f776bb76c666bec8cd8bdf355ea3694096ecf9b8048c
Instruction ID: 59ce830414588bdb38d4b84987ab88dc412bda349b6b9e5ce1f14e834a7ad78a
Opcode Fuzzy Hash: de1385ac0704210f5195f776bb76c666bec8cd8bdf355ea3694096ecf9b8048c
Instruction Fuzzy Hash: 9D11187590410AEFCB05DF58E941A9A7BF5EF48314F154059F808AB312DB31DA21CBA5

Function 00125000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00124C7D: RtlAllocateHeap.NTDLL(00000008,000F1129,00000000,?,00122E29,00000001,00000364,?,?,?,0011F2DE,00123863,001C1444,?,0010FDF5,?), ref: 00124CBE

_free.LIBCMT ref: 0012506C

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 12992d6a50110d5741c2bd5c315baef3813dec4816696f832104316f5a34495e
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: C70126722047146BE3258F69AC81A5AFBEDFB89370F65051DF194832C0EB30A805C7B8

Function 001829BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,001814B5,?), ref: 00182A01

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8c1380301706bf9be6aac0b2657e2d81a3d1366dee0da1c47d77a011517fef3f
Instruction ID: c9a89a0f2117383ca5f79c8006284a27a3da906af9225c2aa94eb92b40cd76ab
Opcode Fuzzy Hash: 8c1380301706bf9be6aac0b2657e2d81a3d1366dee0da1c47d77a011517fef3f
Instruction Fuzzy Hash: 3501B136700A519FD32AEA2CC494F227792EF85318F298468C0478B651DB32FE42CBA0

Function 0011E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 019dc61ef629dd27253e1f8a15fe20252654a72a870065e088d04025efe26b07
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: CBF02D32511A24A7C7393AA5AC05BDA33D89F72334F500735FC21931D1DB70D481CAA5

Function 0018149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 001814EB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 9d1ff2320fcd243eeb62d288563ac2b9623d8dc52e37577013736198114c48d0
Instruction ID: 84e42a5de5c27668a963b8fb6294adc02499e8fa05921681cf6fd450c405099d
Opcode Fuzzy Hash: 9d1ff2320fcd243eeb62d288563ac2b9623d8dc52e37577013736198114c48d0
Instruction Fuzzy Hash: BD01F736308755AFD321EF69D440826BB99FF94324754806DE84A8B742D732DE82CFC0

Function 00124C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,000F1129,00000000,?,00122E29,00000001,00000364,?,?,?,0011F2DE,00123863,001C1444,?,0010FDF5,?), ref: 00124CBE

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cdbf30206e36b6942e69045bd20f91f06c7e445ce51ee239d2c793a9e2ad02b9
Instruction ID: 2c1c716f4b0b4fdc239c0adc45fb3b4f1e270bbe2e13af6143281a1f58ea8aa5
Opcode Fuzzy Hash: cdbf30206e36b6942e69045bd20f91f06c7e445ce51ee239d2c793a9e2ad02b9
Instruction Fuzzy Hash: 60F0E931603234A7DB255F6AFC09F9A3788BF51BB0B154125B815A6281CB70D87197E0

Function 00123820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,001C1444,?,0010FDF5,?,?,000FA976,00000010,001C1440,000F13FC,?,000F13C6,?,000F1129), ref: 00123852

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 830fc89be1bc51257876293b369b97735b776bb98235a4aab9cba9d981a79bf3
Instruction ID: 0219a8adc178c2bc252ed0dc00361536ad5bb38b5c8a391f64fe3375a3497193
Opcode Fuzzy Hash: 830fc89be1bc51257876293b369b97735b776bb98235a4aab9cba9d981a79bf3
Instruction Fuzzy Hash: 6DE0E532101234A7D6252666BC04BDA3659EB42FB0F160234BD259A9D1CB29DE5282E0

Function 000F4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4F6D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: bf204a4fd4444605556ec1038eb3708e410f36f31cfe8c7a94908a81c3a5f8e1
Instruction ID: d5bdc64a5a5793ef060152070b6a6dde4c74c5bc8e257fcff7f273dbfe6a799f
Opcode Fuzzy Hash: bf204a4fd4444605556ec1038eb3708e410f36f31cfe8c7a94908a81c3a5f8e1
Instruction Fuzzy Hash: F4F0A070005705CFCB348F60D490827B7E0AF10329314897EEADE82920C7319888EF10

Function 00182A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00182A66

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: bc61f108300d3d013b228b01ad10be619c226ac7061c82ad88beaca3caa672e3
Instruction ID: f753d6dd8c75883ce1e3b9bce3e782657d9d1b59ee878423a111b1f8ba83b87c
Opcode Fuzzy Hash: bc61f108300d3d013b228b01ad10be619c226ac7061c82ad88beaca3caa672e3
Instruction Fuzzy Hash: 6BE04F76350116ABC719FA30DC808FA735CEF603957104536FC26C7600EB309A958BF0

Function 000F2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000F2DC4

Part of subcall function 000F6B57: _wcslen.LIBCMT ref: 000F6B6A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: a36899dfff92f943a23dc3ab134880a32adcb58b901847dab7e0673b7dc93d54
Instruction ID: 2df78d64e3e7d975060e66142ae0d1a01f5cb81c6767bb1f70a72e16ac6aafcf
Opcode Fuzzy Hash: a36899dfff92f943a23dc3ab134880a32adcb58b901847dab7e0673b7dc93d54
Instruction Fuzzy Hash: 70E0CD726001245BC71092589C05FEA77DDDFC8790F040071FD09D7248DA70ADC48690

Function 000F2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000F3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 000F3908

Part of subcall function 000FD744: GetInputState.USER32 ref: 000FD807

SetCurrentDirectoryW.KERNEL32(?), ref: 000F2B6B

Part of subcall function 000F30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 000F314E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 470598761baabe99aabf344ea28349fe31c3f10550419c26ab6c6d845f6fe719
Instruction ID: c99455985bf3a0ac92d1412cfe48cd27729a4e7d7432662d8a0f0316350be9df
Opcode Fuzzy Hash: 470598761baabe99aabf344ea28349fe31c3f10550419c26ab6c6d845f6fe719
Instruction Fuzzy Hash: 7FE0863130434D16C608BB75A8529FDA759DBD2762F40153EF74247963DF24C6866351

Function 00153D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00153D18

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 9eef399f414a5fcce120c2d21ff8d6c42e8404f3d166ff16f65d39b8d8787977
Instruction ID: 375aa1f2a6e39f3c2a8e83e51b0be97e068587c2c8ef255fc69854be1b8f8492
Opcode Fuzzy Hash: 9eef399f414a5fcce120c2d21ff8d6c42e8404f3d166ff16f65d39b8d8787977
Instruction Fuzzy Hash: 78D08CF06A03087EFB0083718C0BEBB339CC316E81F104BA47E02D69C1E9A0DE080270

Function 0013039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00130704,?,?,00000000,?,00130704,00000000,0000000C), ref: 001303B7

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 208093f287da824051503547035163e7cbd4f5981471586f57e7a2b8a4fb7678
Instruction ID: 4664ddaafb7ca20da294341441ec9742fddd486aa4537de034d0191fabeb14db
Opcode Fuzzy Hash: 208093f287da824051503547035163e7cbd4f5981471586f57e7a2b8a4fb7678
Instruction Fuzzy Hash: 4FD06C3204010DFBDF029F84DD46EDA3BAAFB48714F014000BE1856020C732E961AB90

Function 000F1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 000F1CBC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 3653897ba7dd33e2882afcdeb0e6fd5f98fd3db375560c6792ccc21ce4657ecf
Instruction ID: 13d30d2439446a5cb4b20aed3c613592869ea11d134bf6cf2135c726884e9a74
Opcode Fuzzy Hash: 3653897ba7dd33e2882afcdeb0e6fd5f98fd3db375560c6792ccc21ce4657ecf
Instruction Fuzzy Hash: 2DC09B353C0345AFF6145780BC4AF517B54B349B14F044001F60955DE3C3F15490D750

Non-executed Functions

Function 00189576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00109BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00109BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0018961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0018965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0018969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001896C9
SendMessageW.USER32 ref: 001896F2
GetKeyState.USER32(00000011), ref: 0018978B
GetKeyState.USER32(00000009), ref: 00189798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 001897AE
GetKeyState.USER32(00000010), ref: 001897B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001897E9
SendMessageW.USER32 ref: 00189810
SendMessageW.USER32(?,00001030,?,00187E95), ref: 00189918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0018992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00189941
SetCapture.USER32(?), ref: 0018994A
ClientToScreen.USER32(?,?), ref: 001899AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 001899BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001899D6
ReleaseCapture.USER32 ref: 001899E1
GetCursorPos.USER32(?), ref: 00189A19
ScreenToClient.USER32(?,?), ref: 00189A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00189A80
SendMessageW.USER32 ref: 00189AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00189AEB
SendMessageW.USER32 ref: 00189B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00189B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00189B4A
GetCursorPos.USER32(?), ref: 00189B68
ScreenToClient.USER32(?,?), ref: 00189B75
GetParent.USER32(?), ref: 00189B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00189BFA
SendMessageW.USER32 ref: 00189C2B
ClientToScreen.USER32(?,?), ref: 00189C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00189CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00189CDE
SendMessageW.USER32 ref: 00189D01
ClientToScreen.USER32(?,?), ref: 00189D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00189D82

Part of subcall function 00109944: GetWindowLongW.USER32(?,000000EB), ref: 00109952

GetWindowLongW.USER32(?,000000F0), ref: 00189E05

Strings

@GUI_DRAGID, xrefs: 0018997D
F, xrefs: 00189D07

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 6f28759d8d282201f598a804376028bdce43cb463a2141dfe6e548910c3ef960
Instruction ID: 1c1f565a09072ef4ef0c57c5647fc5c4f16a66bed47999869fd8b52912628e0a
Opcode Fuzzy Hash: 6f28759d8d282201f598a804376028bdce43cb463a2141dfe6e548910c3ef960
Instruction Fuzzy Hash: 6C429E74204201AFDB25EF24CC44EBABBE5FF49314F280619F699876A1E731DA54CF91

Function 00184873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 001848F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00184908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00184927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0018494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0018495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0018497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 001849AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 001849D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00184A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00184A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00184A7E
IsMenu.USER32(?), ref: 00184A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00184AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00184B20
GetWindowLongW.USER32(?,000000F0), ref: 00184B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00184BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00184C82
wsprintfW.USER32 ref: 00184CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00184CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00184CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00184D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00184D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00184D5A

Strings

%d/%02d/%02d, xrefs: 00184CA8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 5e5e4d7e17da12d0601e26bacf2000ab84be114e535762190d3730b51054dcd6
Instruction ID: 97203aab24cb09c642455efa8b758be6d5c6be6982565adeff562ccb0444036b
Opcode Fuzzy Hash: 5e5e4d7e17da12d0601e26bacf2000ab84be114e535762190d3730b51054dcd6
Instruction Fuzzy Hash: 1912DF71600256ABEB24AF68CC49FEE7BB8AF85710F104129F516DB2E1DB749A81CF50

Function 00151201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 001516C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0015170D
Part of subcall function 001516C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0015173A
Part of subcall function 001516C3: GetLastError.KERNEL32 ref: 0015174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00151286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 001512A8
CloseHandle.KERNEL32(?), ref: 001512B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 001512D1
GetProcessWindowStation.USER32 ref: 001512EA
SetProcessWindowStation.USER32(00000000), ref: 001512F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00151310

Part of subcall function 001510BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,001511FC), ref: 001510D4
Part of subcall function 001510BF: CloseHandle.KERNEL32(?,?,001511FC), ref: 001510E9

Strings

winsta0, xrefs: 001512CC
default, xrefs: 0015130B
, xrefs: 0015125A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: f059c10f979bceb9ed736dd4b95d46d08f7038ac622723a0e5cf7fa20d2a85cf
Instruction ID: 8b4c304bf12841cbd83ebe34a085fac8f2265afc6a4a340996b8a73aea229144
Opcode Fuzzy Hash: f059c10f979bceb9ed736dd4b95d46d08f7038ac622723a0e5cf7fa20d2a85cf
Instruction Fuzzy Hash: E0816D71900209FBDF229FA4DC49FEE7BB9EF04705F145129FD21AA1A0D7758A89CB60

Function 00150B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001510F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00151114
Part of subcall function 001510F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00150B9B,?,?,?), ref: 00151120
Part of subcall function 001510F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00150B9B,?,?,?), ref: 0015112F
Part of subcall function 001510F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00150B9B,?,?,?), ref: 00151136
Part of subcall function 001510F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0015114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00150BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00150C00
GetLengthSid.ADVAPI32(?), ref: 00150C17
GetAce.ADVAPI32(?,00000000,?), ref: 00150C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00150C6D
GetLengthSid.ADVAPI32(?), ref: 00150C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00150C8C
HeapAlloc.KERNEL32(00000000), ref: 00150C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00150CB4
CopySid.ADVAPI32(00000000), ref: 00150CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00150CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00150D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00150D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00150D45
HeapFree.KERNEL32(00000000), ref: 00150D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00150D55
HeapFree.KERNEL32(00000000), ref: 00150D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00150D65
HeapFree.KERNEL32(00000000), ref: 00150D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00150D78
HeapFree.KERNEL32(00000000), ref: 00150D7F

Part of subcall function 00151193: GetProcessHeap.KERNEL32(00000008,00150BB1,?,00000000,?,00150BB1,?), ref: 001511A1
Part of subcall function 00151193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00150BB1,?), ref: 001511A8
Part of subcall function 00151193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00150BB1,?), ref: 001511B7

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: a7d6551dc293e50387a3f1ea244df2650592d0e72fb77e732cb95f4dd4231485
Instruction ID: fb45b122926a7f202e4cdaf57fb4819278c378c17e8bc2bff70706c11d6035d3
Opcode Fuzzy Hash: a7d6551dc293e50387a3f1ea244df2650592d0e72fb77e732cb95f4dd4231485
Instruction Fuzzy Hash: 2C717B7590020AEBDF119FE4DC88BEEBBB8BF08311F144115FD24AA191D771AA49CBB0

Function 0016EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0018CC08), ref: 0016EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0016EB37
GetClipboardData.USER32(0000000D), ref: 0016EB43
CloseClipboard.USER32 ref: 0016EB4F
GlobalLock.KERNEL32(00000000), ref: 0016EB87
CloseClipboard.USER32 ref: 0016EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0016EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0016EBC9
GetClipboardData.USER32(00000001), ref: 0016EBD1
GlobalLock.KERNEL32(00000000), ref: 0016EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0016EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0016EC38
GetClipboardData.USER32(0000000F), ref: 0016EC44
GlobalLock.KERNEL32(00000000), ref: 0016EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0016EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0016EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0016ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0016ECF3
CountClipboardFormats.USER32 ref: 0016ED14
CloseClipboard.USER32 ref: 0016ED59

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 4f1a45e5a8036712a4dcbf023daabb99ea5cf7ccb955a85a49cfbd968410a62f
Instruction ID: 88e3f089cce6116bf0ebdc4823a0911ab72c1af6279ffe1c326a9cce92d16c65
Opcode Fuzzy Hash: 4f1a45e5a8036712a4dcbf023daabb99ea5cf7ccb955a85a49cfbd968410a62f
Instruction Fuzzy Hash: 4961F038204205AFD300EF64DC88F7A77E4AF84754F14461DF556976A2DB31DE85CBA2

Function 0016698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 001669BE
FindClose.KERNEL32(00000000), ref: 00166A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00166A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00166A75

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00166AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00166ADF

Strings

%4d, xrefs: 00166BB1
%4d%02d%02d%02d%02d%02d, xrefs: 00166B6A
%03d, xrefs: 00166DA2
%02d, xrefs: 00166C00, 00166C0A, 00166C5A, 00166CAA, 00166CFA, 00166D4A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00166B32

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: a388303ab2970720525d53406a9ae1d90e5ea9cd6440fac25924ab5168080b82
Instruction ID: 7ad89fdbe42870caff8467d3288f1a44d499ad10d3bc237d4f392586906b8985
Opcode Fuzzy Hash: a388303ab2970720525d53406a9ae1d90e5ea9cd6440fac25924ab5168080b82
Instruction Fuzzy Hash: 00D15271508304AEC314DBA4CD82EBBB7ECAF98704F44491DF689C7192EB75DA48DB62

Function 00169642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00169663
GetFileAttributesW.KERNEL32(?), ref: 001696A1
SetFileAttributesW.KERNEL32(?,?), ref: 001696BB
FindNextFileW.KERNEL32(00000000,?), ref: 001696D3
FindClose.KERNEL32(00000000), ref: 001696DE
FindFirstFileW.KERNEL32(*.*,?), ref: 001696FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0016974A
SetCurrentDirectoryW.KERNEL32(001B6B7C), ref: 00169768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00169772
FindClose.KERNEL32(00000000), ref: 0016977F
FindClose.KERNEL32(00000000), ref: 0016978F

Strings

*.*, xrefs: 001696F5

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 7d0ecaeb6fb3cc88e40bdb77df6933bccab217cb109b35725ea344e6aa0c3445
Instruction ID: 56fa9b0b9a5de319b8fd8101c216488fe05a46e8553f97bb237bf269282c29ff
Opcode Fuzzy Hash: 7d0ecaeb6fb3cc88e40bdb77df6933bccab217cb109b35725ea344e6aa0c3445
Instruction Fuzzy Hash: 1231B332641219AFDF14AFB4EC49AEE77ADAF49320F144165F815E2090DB34DE94CFA4

Function 0016979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 001697BE
FindNextFileW.KERNEL32(00000000,?), ref: 00169819
FindClose.KERNEL32(00000000), ref: 00169824
FindFirstFileW.KERNEL32(*.*,?), ref: 00169840
SetCurrentDirectoryW.KERNEL32(?), ref: 00169890
SetCurrentDirectoryW.KERNEL32(001B6B7C), ref: 001698AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 001698B8
FindClose.KERNEL32(00000000), ref: 001698C5
FindClose.KERNEL32(00000000), ref: 001698D5

Part of subcall function 0015DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0015DB00

Strings

*.*, xrefs: 0016983B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 986bde61d0281601dc0efeb87c269f891a64674a2fe9a60af2c7d45ef85dcf8b
Instruction ID: 2ae5c7594fb98b9e80c9a2a14f6ede0a773ad7519e01e953d8896ac42e8ad4b2
Opcode Fuzzy Hash: 986bde61d0281601dc0efeb87c269f891a64674a2fe9a60af2c7d45ef85dcf8b
Instruction Fuzzy Hash: C631D23250021EAFDB14EFB4EC48ADE77ADAF5A320F144165E850A30D1DB34DE95CB60

Function 0017BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0017B6AE,?,?), ref: 0017C9B5
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017C9F1
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017CA68
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0017BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0017BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0017BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0017C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0017C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0017C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0017C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0017C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0017C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0017C382
RegCloseKey.ADVAPI32(00000000), ref: 0017C38F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 89223cb869c1b502bdb9493bd1eb40e73f5537484a2fd85ae65bce96d73566d4
Instruction ID: 37e8bb4b2d9b462e773beed625d35f76db611e36c3ad8610acbc1ec9b1eccbb9
Opcode Fuzzy Hash: 89223cb869c1b502bdb9493bd1eb40e73f5537484a2fd85ae65bce96d73566d4
Instruction Fuzzy Hash: F6024B71604200AFD714CF28C895E2ABBF5AF89318F59C49DF84ADB2A2D731ED45CB91

Function 00168195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00168257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00168267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00168273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00168310
SetCurrentDirectoryW.KERNEL32(?), ref: 00168324
SetCurrentDirectoryW.KERNEL32(?), ref: 00168356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0016838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00168395

Strings

*.*, xrefs: 0016839B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 3f606939e53c9ef66c2e6c770252d60ed5051f137d126b13697d0cf04fac8311
Instruction ID: 99273a7bc1ef3a954feae757418c62ea44cab566a6fbc762dd32e716c4acc715
Opcode Fuzzy Hash: 3f606939e53c9ef66c2e6c770252d60ed5051f137d126b13697d0cf04fac8311
Instruction Fuzzy Hash: F6618BB25043059FCB10EF64C8409AEB3E9FF89310F04492EF99987251DB35EA49CB92

Function 0015D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000F3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000F3A97,?,?,000F2E7F,?,?,?,00000000), ref: 000F3AC2

Part of subcall function 0015E199: GetFileAttributesW.KERNEL32(?,0015CF95), ref: 0015E19A

FindFirstFileW.KERNEL32(?,?), ref: 0015D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0015D1DD
MoveFileW.KERNEL32(?,?), ref: 0015D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0015D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0015D237

Part of subcall function 0015D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0015D21C,?,?), ref: 0015D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0015D253
FindClose.KERNEL32(00000000), ref: 0015D264

Strings

\*.*, xrefs: 0015D0CD, 0015D0D6, 0015D0EB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 3f282d5eda3738dec085de131fe4b4358d517624c36ca25bb0857e46e12b60cc
Instruction ID: 53979a84038bd873dcfcfd3b62b34522b657e6fb8ee05e81970f867c34dc7dc1
Opcode Fuzzy Hash: 3f282d5eda3738dec085de131fe4b4358d517624c36ca25bb0857e46e12b60cc
Instruction Fuzzy Hash: F4617A3180510DEACF15EBE0EA929FDB7B5AF15341F604165E912BB192EF30AF09DB60

Function 0016ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0016ED91
EmptyClipboard.USER32 ref: 0016ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0016EDAC
CloseClipboard.USER32 ref: 0016EEA3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: fc1a9591e85156f938f29eb645da854e1049f64e57cc69e36f47980628506928
Instruction ID: 7ad0969ac40c06779d62dd413d0c6e8038703eb353e0f73d71bd2bfebecb3d3e
Opcode Fuzzy Hash: fc1a9591e85156f938f29eb645da854e1049f64e57cc69e36f47980628506928
Instruction Fuzzy Hash: 22419F35204611AFE310CF15D848F59BBE1EF44328F14C1A9E8198BB62C736ED81CBD0

Function 0015E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 001516C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0015170D
Part of subcall function 001516C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0015173A
Part of subcall function 001516C3: GetLastError.KERNEL32 ref: 0015174A

ExitWindowsEx.USER32(?,00000000), ref: 0015E932

Strings

, xrefs: 0015E920
SeShutdownPrivilege, xrefs: 0015E902
@, xrefs: 0015E925
, xrefs: 0015E95C

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 9fce3552cf77fd492dee795d0cdc08f075b69defed315edf927678182f9777ae
Instruction ID: ef9b220157a5a235266cdbcf3ed9e7f30b0e3e49a0f2f34289bb58fab7b73861
Opcode Fuzzy Hash: 9fce3552cf77fd492dee795d0cdc08f075b69defed315edf927678182f9777ae
Instruction Fuzzy Hash: 4501DB72E10211EFEB5C2674AC86FBF72DC9B1475AF150422FC23EA1D1D7A45E8886E0

Function 00171204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00171276
WSAGetLastError.WSOCK32 ref: 00171283
bind.WSOCK32(00000000,?,00000010), ref: 001712BA
WSAGetLastError.WSOCK32 ref: 001712C5
closesocket.WSOCK32(00000000), ref: 001712F4
listen.WSOCK32(00000000,00000005), ref: 00171303
WSAGetLastError.WSOCK32 ref: 0017130D
closesocket.WSOCK32(00000000), ref: 0017133C

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: fa19910912a1505b67628174648725fba2a16bc879f0680b7e1a51d02438b11a
Instruction ID: 8008baf25681d8a2db8a49f13b0d457067b5c871038d1412d5dfe7812bb29cd4
Opcode Fuzzy Hash: fa19910912a1505b67628174648725fba2a16bc879f0680b7e1a51d02438b11a
Instruction Fuzzy Hash: 4F414D31600100AFD714DF68C489B69BBF6AF46318F28C198E95A9B693C771ED85CBE1

Function 0015D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000F3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000F3A97,?,?,000F2E7F,?,?,?,00000000), ref: 000F3AC2

Part of subcall function 0015E199: GetFileAttributesW.KERNEL32(?,0015CF95), ref: 0015E19A

FindFirstFileW.KERNEL32(?,?), ref: 0015D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0015D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0015D481
FindClose.KERNEL32(00000000), ref: 0015D498
FindClose.KERNEL32(00000000), ref: 0015D4A1

Strings

\*.*, xrefs: 0015D3F2

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 5acb9a6751dcec29894c62887b0e00d36bccde4606ce356a0af6d40d9e7906f9
Instruction ID: 527eb64e6cfca9aeda0f6fd3857af87c8370612ae43201fe3f76687620264a67
Opcode Fuzzy Hash: 5acb9a6751dcec29894c62887b0e00d36bccde4606ce356a0af6d40d9e7906f9
Instruction Fuzzy Hash: 52319E710083499BC314EF64D8918FFB7E8AF92311F444A1DF9E592592EB30AA0DD7A3

Function 0012E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0012E645

Strings

1#SNAN, xrefs: 0012F844
1#IND, xrefs: 0012F83D
1#INF, xrefs: 0012F852
1#QNAN, xrefs: 0012F84B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ef0b4dd69da453bca42f2720b4445f1b597c8962d578add5db10fc44098347e5
Instruction ID: fbdfd75d6cfc08b4760d6369f4a111a5613eb1d2820f732eb38edc3a3f10af4a
Opcode Fuzzy Hash: ef0b4dd69da453bca42f2720b4445f1b597c8962d578add5db10fc44098347e5
Instruction Fuzzy Hash: 48C22A71E046298FDB29CE28ED407EAB7F5EB49305F1541EAD84DE7240E774AE928F40

Function 0016648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001664DC
CoInitialize.OLE32(00000000), ref: 00166639
CoCreateInstance.OLE32(0018FCF8,00000000,00000001,0018FB68,?), ref: 00166650
CoUninitialize.OLE32 ref: 001668D4

Strings

.lnk, xrefs: 001664BA, 00166524, 001665E0

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 1945808a6ed5b8a0363075a6f84c434bbb62bc73a80e8568db7660ab4549ddef
Instruction ID: 1efad32fc1ac5ccecfd483485ddac955d3ce23e561aef51ce9eed722570d8ab3
Opcode Fuzzy Hash: 1945808a6ed5b8a0363075a6f84c434bbb62bc73a80e8568db7660ab4549ddef
Instruction Fuzzy Hash: CBD149715083059FD314EF24C881EABB7E8FF94744F10496DF5968B292EB71E909CB92

Function 001722DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 001722E8

Part of subcall function 0016E4EC: GetWindowRect.USER32(?,?), ref: 0016E504

GetDesktopWindow.USER32 ref: 00172312
GetWindowRect.USER32(00000000), ref: 00172319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00172355
GetCursorPos.USER32(?), ref: 00172381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 001723DF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: a29e6f9da7a8cb636962f5c16d19b9dc6e6a0f471cce6695559cc6f6773d1a2a
Instruction ID: 97142a6151f9969fa3c5e4bb2c97a0ef13e664aba98f7236d3a64766d3fbcd88
Opcode Fuzzy Hash: a29e6f9da7a8cb636962f5c16d19b9dc6e6a0f471cce6695559cc6f6773d1a2a
Instruction Fuzzy Hash: 1B31F2725043059FC720DF14D844B5BB7E9FF88314F004919F88897181DB34EA49CBD1

Function 00169B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00169B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00169C8B

Part of subcall function 00163874: GetInputState.USER32 ref: 001638CB
Part of subcall function 00163874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00163966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00169BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00169C75

Strings

*.*, xrefs: 00169B5D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 20394a2e8859963110c20cee75d94f5769b6b4ce1f88f008a5b6cb5e0bd25b40
Instruction ID: 1133dfc4b45edcb6afb644fa6bb1e79dce557388fdaa6a95bfddf337ccc0a7e2
Opcode Fuzzy Hash: 20394a2e8859963110c20cee75d94f5769b6b4ce1f88f008a5b6cb5e0bd25b40
Instruction Fuzzy Hash: 99416D7190421AAFCF15DFA4CD89AEEBBB8EF05350F244156F805A2191EB309F94DFA0

Function 0010997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00109BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00109BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00109A4E
GetSysColor.USER32(0000000F), ref: 00109B23
SetBkColor.GDI32(?,00000000), ref: 00109B36

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: c765004b012f5800b34a242797ddbaf607073218d97910ef7e61dac4cba5aa53
Instruction ID: 344ed3687d6c84a5ae463b9cc954432876e8eae409605474c6b3e46a3dd96265
Opcode Fuzzy Hash: c765004b012f5800b34a242797ddbaf607073218d97910ef7e61dac4cba5aa53
Instruction Fuzzy Hash: 25A10770209444FFE728AA2C8CA8E7B3A5DDB86354F160209F582D79E3CBA5DE41C775

Function 00171806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0017304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0017307A
Part of subcall function 0017304E: _wcslen.LIBCMT ref: 0017309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0017185D
WSAGetLastError.WSOCK32 ref: 00171884
bind.WSOCK32(00000000,?,00000010), ref: 001718DB
WSAGetLastError.WSOCK32 ref: 001718E6
closesocket.WSOCK32(00000000), ref: 00171915

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 9b903674b67f778af1c97b8317633cfd02b5a34283cb885a5f8df1fd948ebde2
Instruction ID: bb90b44838df93cc8c7a0d616213ce80fdb14e96a95d8543d775cef921c843f6
Opcode Fuzzy Hash: 9b903674b67f778af1c97b8317633cfd02b5a34283cb885a5f8df1fd948ebde2
Instruction Fuzzy Hash: 0551A371A00204AFEB10AF24C886F7A77E5AB49718F58C05CFA499F7D3C775AD418BA1

Function 00181C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00181CC0
IsWindowEnabled.USER32 ref: 00181CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00181CDB
IsIconic.USER32 ref: 00181CE9
IsZoomed.USER32 ref: 00181CF7

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c9941e79b49f8a5baf9d1d8cc828829d9e972ab67120f900307ac85e7a2bdc15
Instruction ID: f0ece9a7abc267f0b2ea7e0542f876f92ed59981ec835d7f933e4ff42314e0da
Opcode Fuzzy Hash: c9941e79b49f8a5baf9d1d8cc828829d9e972ab67120f900307ac85e7a2bdc15
Instruction Fuzzy Hash: 2E21A6327402116FD724AF1AD844B667BA9EF95314B198068E845CB752D771DE43CF90

Function 000F8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 000F843C
VUUU, xrefs: 000F83FA
ERCP, xrefs: 000F813C
VUUU, xrefs: 000F83E8
VUUU, xrefs: 00135DF0

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: e3853e75bebdb4f51bb5f83fbd30bac5399cfb17638dd157c26146dab55c282c
Instruction ID: ef79e9a04ce13adcb4c78dbad286d67d924413ad038752b121cc8a28c1f097e0
Opcode Fuzzy Hash: e3853e75bebdb4f51bb5f83fbd30bac5399cfb17638dd157c26146dab55c282c
Instruction Fuzzy Hash: 99A26C71E0061ACBDF24CF58C8407FEB7B2BB54714F24C1AAE915AB685EB709D81DB90

Function 0017A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0017A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0017A6BA

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0017A79C
CloseHandle.KERNEL32(00000000), ref: 0017A7AB

Part of subcall function 0010CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00133303,?), ref: 0010CE8A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 74c807550f83aa1bc3245e466b52c89d7cdc9459ce7b25015110fd4c067ad5ab
Instruction ID: f36359272618c7627675d47fd8d734dd736af02afedc35888db033089dac0722
Opcode Fuzzy Hash: 74c807550f83aa1bc3245e466b52c89d7cdc9459ce7b25015110fd4c067ad5ab
Instruction Fuzzy Hash: 47516C71508304AFD710EF24C886A6BBBF8FF99754F40892DF58997292EB71D904CB92

Function 0015AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0015AAAC
SetKeyboardState.USER32(00000080), ref: 0015AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0015AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0015AB88

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 8b74fdb44a13fdcea4a585aa1c27b8626e4b9b42daf780623077034c8ef030e7
Instruction ID: 7df7abff5ddab30786bc0fe1287b52225a975897413bee69d569c51ed6f31db1
Opcode Fuzzy Hash: 8b74fdb44a13fdcea4a585aa1c27b8626e4b9b42daf780623077034c8ef030e7
Instruction Fuzzy Hash: 44310930AC0208EEEB358A64CC05BFA77A6AF44312F54431AFDA15A1D1D3759989C7E2

Function 0012BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0012BB7F

Part of subcall function 001229C8: HeapFree.KERNEL32(00000000,00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000), ref: 001229DE
Part of subcall function 001229C8: GetLastError.KERNEL32(00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000,00000000), ref: 001229F0

GetTimeZoneInformation.KERNEL32 ref: 0012BB91
WideCharToMultiByte.KERNEL32(00000000,?,001C121C,000000FF,?,0000003F,?,?), ref: 0012BC09
WideCharToMultiByte.KERNEL32(00000000,?,001C1270,000000FF,?,0000003F,?,?,?,001C121C,000000FF,?,0000003F,?,?), ref: 0012BC36

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 3fce2b25d8fc855deb8c5ddeb1b78f3a89ebdd171a68123112685ecfdaa4648a
Instruction ID: 5bb3be3706d10d700da6a020278a273a4f42bf826d28d18e6412de9b333a9bf3
Opcode Fuzzy Hash: 3fce2b25d8fc855deb8c5ddeb1b78f3a89ebdd171a68123112685ecfdaa4648a
Instruction Fuzzy Hash: FB31B275948225EFCB15DF69ECC096DBBB8FF56310724426AE061E72A2D730DEA0CB50

Function 0016CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0016CE89
GetLastError.KERNEL32(?,00000000), ref: 0016CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0016CEFE

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 393ecbe55af5912f5e8e35654a31f1f5d1669a3bf655c55c65ef0283f532ddd8
Instruction ID: be964d5af07c6488b9d8b40b4e37bf25ba9008b383d70dbc2dbb2d121d4b3a38
Opcode Fuzzy Hash: 393ecbe55af5912f5e8e35654a31f1f5d1669a3bf655c55c65ef0283f532ddd8
Instruction Fuzzy Hash: F721BD716003059BDB20DFA5CD48BB6BBFCEB50314F10442EE686D2151E771EE54CBA0

Function 00158298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 001582AA

Strings

(, xrefs: 001582F0
|, xrefs: 001582DA

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: ee02ded4cb4d5f1250c759c5e744424b6f413cdcbdde96d20ea77a4783136f2c
Instruction ID: 99b3a94254d43ae631b64efabed7dba244f6e3b986cb7895a93c1590b96dbf19
Opcode Fuzzy Hash: ee02ded4cb4d5f1250c759c5e744424b6f413cdcbdde96d20ea77a4783136f2c
Instruction Fuzzy Hash: 9F322875A00605DFCB28CF59C48196AB7F0FF48710B15C56EE9AAEB7A1EB70E941CB40

Function 00165C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00165CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00165D17
FindClose.KERNEL32(?), ref: 00165D5F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 977b36f9bcd50abad8b596d212b7365f69890baf93bad9834e115e96659a5fcf
Instruction ID: 901838cacb829c0a045d2853894f2ebfd8d4ff9157f0409f4b48995769fecacd
Opcode Fuzzy Hash: 977b36f9bcd50abad8b596d212b7365f69890baf93bad9834e115e96659a5fcf
Instruction Fuzzy Hash: B151BB34604A019FC718CF68C894EAAB7E5FF49314F14855DE99A8B3A2CB30ED54CFA1

Function 00122622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0012271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00122724
UnhandledExceptionFilter.KERNEL32(?), ref: 00122731

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: dc1a415514ce37fbadf3e7bc3f99b5faf99ec8f8cfaa08477f62f509970be591
Instruction ID: d2a4e39750ebd46c5607103b0ca8bc55693f4bd26569382db1d19212cfb5c9c2
Opcode Fuzzy Hash: dc1a415514ce37fbadf3e7bc3f99b5faf99ec8f8cfaa08477f62f509970be591
Instruction Fuzzy Hash: 5531C374911228ABCB21DF64D8887DDB7B8BF18310F5041EAE81CA7260E7709FC18F44

Function 001651CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001651DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00165238
SetErrorMode.KERNEL32(00000000), ref: 001652A1

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: c1301da056a55ad89f359b8baceb5e225b4b3505b5b42ee82e04569eca213c6b
Instruction ID: c7bca4c990d5bbd8a1fc512489c3304be4de1e2e587bdecc4b250d1457d1e517
Opcode Fuzzy Hash: c1301da056a55ad89f359b8baceb5e225b4b3505b5b42ee82e04569eca213c6b
Instruction Fuzzy Hash: 6F314C75A00518DFDB00DF54D8D4EADBBB5FF48314F048099E909AB3A2DB31E95ACBA0

Function 001516C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0010FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00110668
Part of subcall function 0010FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00110685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0015170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0015173A
GetLastError.KERNEL32 ref: 0015174A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 3fc96771e45aaff59d8c549325a09a6d4afef5bb896c5768baf5ac3fd5dbcc97
Instruction ID: 13cd8a5023928b069b0341046dfcc98b1565d0d0e934660b48321915c616a003
Opcode Fuzzy Hash: 3fc96771e45aaff59d8c549325a09a6d4afef5bb896c5768baf5ac3fd5dbcc97
Instruction Fuzzy Hash: 301104B1400304FFD718AF64DC86E6BB7B9EB44711B20802EF46657681EB70BC418B60

Function 0015D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0015D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0015D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0015D650

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 9656f2bf2cd8d16120ef9baed8156e08afb3bd1ec83ed7df39695872d02f88de
Instruction ID: 7b4222eadbb3b650fd70da610145f6d1fd3ed8a5bca03ce1c0aa1ac0a1fc0dec
Opcode Fuzzy Hash: 9656f2bf2cd8d16120ef9baed8156e08afb3bd1ec83ed7df39695872d02f88de
Instruction Fuzzy Hash: 96113C75E05228BBDB208F95AC85FAFBBBCEB45B50F108115F914E7290D6704A058BA1

Function 00151663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0015168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 001516A1
FreeSid.ADVAPI32(?), ref: 001516B1

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 14c4d8e134fba69cb8ad63d028edea5cfc467b8591c52b26274b075e6b9a820e
Instruction ID: b9121857b67a82467dbb9eddb502c24c350d211e8ca590e972c0abe752d2d461
Opcode Fuzzy Hash: 14c4d8e134fba69cb8ad63d028edea5cfc467b8591c52b26274b075e6b9a820e
Instruction Fuzzy Hash: C7F0F475950309FBDB00DFE49C89EAEBBBCFB08645F504565F901E2181E774AA449BA0

Function 00114CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(001228E9,?,00114CBE,001228E9,001B88B8,0000000C,00114E15,001228E9,00000002,00000000,?,001228E9), ref: 00114D09
TerminateProcess.KERNEL32(00000000,?,00114CBE,001228E9,001B88B8,0000000C,00114E15,001228E9,00000002,00000000,?,001228E9), ref: 00114D10
ExitProcess.KERNEL32 ref: 00114D22

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e5aaedd49fa951119184ded5a12e1729c447b69a69c9c1ad8c5c42ca81ee90b5
Instruction ID: 0f72c47d5c50d07c620147cda493b831ed984c18ea43bce38c1f9719f0bb9703
Opcode Fuzzy Hash: e5aaedd49fa951119184ded5a12e1729c447b69a69c9c1ad8c5c42ca81ee90b5
Instruction Fuzzy Hash: 56E0B631000148ABCF15AF94ED09A983B69FB61B81B104024FC198A522CB35DED2DB90

Function 0014D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0014D28C

Strings

X64, xrefs: 0014D2A8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 8cc656ca4348b3f232d08f0351516d7718e04353c9901b80c2a11af9191d67c9
Instruction ID: e13ad645845049e8f5f96214d6551d8741755e9405cc143b9f1bfbdedd353e10
Opcode Fuzzy Hash: 8cc656ca4348b3f232d08f0351516d7718e04353c9901b80c2a11af9191d67c9
Instruction Fuzzy Hash: D3D0C9B480111DEBCF94CB90EC88DDAB37CBB04345F104151F106A2140DB7096488F20

Function 0011CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: cff268a32f6f95ac12453b3213f1213aec6c086279fae56469ef609a607ef6de
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 20021B71E412199BDF18CFA9D8806EDBBF1EF98314F25816AD819E7380D731AE418BD4

Function 001668EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00166918
FindClose.KERNEL32(00000000), ref: 00166961

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 27b01e34ed4d21098dda6451ead6e7f4ca39ac49b47599b096c4f25d10072450
Instruction ID: 15798519b8fcabc5f89136619ad6052bfba638fb7c82d5151b92c6716178dc84
Opcode Fuzzy Hash: 27b01e34ed4d21098dda6451ead6e7f4ca39ac49b47599b096c4f25d10072450
Instruction Fuzzy Hash: 5211D0316042059FD710CF29C885A26BBE5FF84328F04C6A9E8698F6A2C730EC45CBD1

Function 001637B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00174891,?,?,00000035,?), ref: 001637E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00174891,?,?,00000035,?), ref: 001637F4

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 0674cbbc500d8142c48511b10c9c24fb0dc61a6ee2c7ab24d65195b06de2e055
Instruction ID: 30d491bbb2a7877b38faaf39933a63389c6efa024bb72221689ba5b5c62c9917
Opcode Fuzzy Hash: 0674cbbc500d8142c48511b10c9c24fb0dc61a6ee2c7ab24d65195b06de2e055
Instruction Fuzzy Hash: 3EF0E5B06042286AE72017769C4DFEB3AAEEFC4761F000165F509D2681DA709A44C7F0

Function 001510BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,001511FC), ref: 001510D4
CloseHandle.KERNEL32(?,?,001511FC), ref: 001510E9

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 58378f48eacb8c85b7267fa1a76c16f0e5de82fee6564c1d3691f10f88dd0a36
Instruction ID: b3283483035e3bbc6ea676ee642e69bf11ba80f8e1fecd2a760baa0db21357c2
Opcode Fuzzy Hash: 58378f48eacb8c85b7267fa1a76c16f0e5de82fee6564c1d3691f10f88dd0a36
Instruction Fuzzy Hash: 9AE0BF72014611EEE7252B61FC06F7777A9FB04311B24892DF9A5848F1DBB2ACD1DB60

Function 000FCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00140C40

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 53ad76ee8c1be351f3eb1f24f7e4e50d033f1792757dd2641c6618954d3a6a50
Instruction ID: e31d9e091b49b75850783224e4710918dc451d3c669d8ead4f0b384e1fdc5336
Opcode Fuzzy Hash: 53ad76ee8c1be351f3eb1f24f7e4e50d033f1792757dd2641c6618954d3a6a50
Instruction Fuzzy Hash: 9632AF7090021CDBEF14DF94CA82EFDB7B5BF09304F144069EA06AB692D775AD49EB60

Function 0012676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00126766,?,?,00000008,?,?,0012FEFE,00000000), ref: 00126998

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5416d39ca7196d35b28308cc7a51c4c45b1ce6e72e2658bfe8e6bcd8141b5ce1
Instruction ID: c432c107359964f1cfd4e4f4650ae7f64e5adbed013d1d36aa96ae500caa7a0a
Opcode Fuzzy Hash: 5416d39ca7196d35b28308cc7a51c4c45b1ce6e72e2658bfe8e6bcd8141b5ce1
Instruction Fuzzy Hash: FCB14C31610618DFDB19CF28D48AB657BE0FF45368F258658E899CF2E2C735E9A1CB40

Function 0010B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0014851F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 020064df49e44a6e0dc28d39086058a102c25b4f52f83359ebc1017f538c44cc
Instruction ID: 985dfc4eb2fc800f81da7a8c1d88fef136bd402ca4496447e357388a8a77f11a
Opcode Fuzzy Hash: 020064df49e44a6e0dc28d39086058a102c25b4f52f83359ebc1017f538c44cc
Instruction Fuzzy Hash: 30125F71D042299BDB14CF58C880AEEB7F5FF48710F1581AAE849EB295DB749E81CF90

Function 0016EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0016EABD

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 7540fb0ecc77201c08f516ace4083fb1b80e5527c854e942d19f829c58bf1025
Instruction ID: a9804263f7d0b37c9b813abb0a7fe67ec7b404dc7d5802719e62045d3a678d60
Opcode Fuzzy Hash: 7540fb0ecc77201c08f516ace4083fb1b80e5527c854e942d19f829c58bf1025
Instruction Fuzzy Hash: 94E04F352002089FD710EF99D845E9AF7E9AF98760F108426FD49C7751DB74E8408FA0

Function 001109D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,001103EE), ref: 001109DA

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 00b05267bfbd38908d706e96cfa715b0d818f12e0d1ad43731671b3ac1331e53
Instruction ID: e7db67ec53eec33443b3cdf5c343cb6e0ab642d17025926bef225a4fe084e5c8
Opcode Fuzzy Hash: 00b05267bfbd38908d706e96cfa715b0d818f12e0d1ad43731671b3ac1331e53
Instruction Fuzzy Hash:

Function 0011781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0011798B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 70a9c9ce1778ffab131a52a9db2a5c891feb6fae77b665b029675b02c114ba27
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 6051687160CB095BDB3C8568885E7FE63B99B12354F18053AE882D73C2CB15DECAD352

Function 00126DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99fb8a01565536f5cacd3bcee58abaf881e2d0fc4c6e86033639ba120f795b0
Instruction ID: bd19d3cd4cd1c241467da346f89c84eb1d046ccb4403fd0f47e2492a6ecf182e
Opcode Fuzzy Hash: e99fb8a01565536f5cacd3bcee58abaf881e2d0fc4c6e86033639ba120f795b0
Instruction Fuzzy Hash: 3F322222D29F514DD7239634E862336A289AFB73C5F15D737E81AB5DA9EB29C4C34100

Function 0010CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07fc912e20c7abe5a8106cf0aa0ea6905053801b4b839b550ad41d928c007cd
Instruction ID: 64743b3afcd9ad8e73b08b4ef881682e2ab3dd69c02c090fbe4ca73a311fef3e
Opcode Fuzzy Hash: c07fc912e20c7abe5a8106cf0aa0ea6905053801b4b839b550ad41d928c007cd
Instruction Fuzzy Hash: 0F323431A011198BDF68CF29C5D46BD7BA1EB45314F29862AD49A9B2F2E370DD81DFC0

Function 000F7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce17b4a4a4f7f08faa46066a4d01484d4b5e9e23794fe41ac060a552f3e6a738
Instruction ID: 8b583db5eedbf6ea49d311a3dc56b5514345fb807f010557c5c3ebe26d69347a
Opcode Fuzzy Hash: ce17b4a4a4f7f08faa46066a4d01484d4b5e9e23794fe41ac060a552f3e6a738
Instruction Fuzzy Hash: 1722CFB0A04609DFDF14CFA4C881AFEB7F6FF44700F204229E816A7691EB36A951DB51

Function 000F91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f777de0e58e131a31becd81851ca4fe42b6d572c45f551c6f291a8eb8eb9025a
Instruction ID: 7c60ed96fddb942d01696fed8610688fa247045c170e982add620faafd5ace44
Opcode Fuzzy Hash: f777de0e58e131a31becd81851ca4fe42b6d572c45f551c6f291a8eb8eb9025a
Instruction Fuzzy Hash: 5702E4B0E00209EBCB14DF64D881AAEB7F1FF54300F118169F9569B6D1EB31AE61DB91

Function 00129EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794730ce3800e452196b9d05ca20275560956051be27a74cb702bf5d8603fd16
Instruction ID: 3361bd182163982177e1b54fff025be4da7dd1f19bc557df9b0d0fe83472e676
Opcode Fuzzy Hash: 794730ce3800e452196b9d05ca20275560956051be27a74cb702bf5d8603fd16
Instruction Fuzzy Hash: 6DB1EF20E6AF505DD22396399831336B65CBFBB6D5F91D71BFC2674D22EB2286C34140

Function 00111C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: b49d2c6eb192ae3fddf93361b420980f0694857a30b2dd473c4ac4b1345ba518
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 5B9178732090A359DF2E467995740BEFFE15A523A131A07BDD5F2CA1C1FF208594D620

Function 00111F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: c2d8fcf1581e5070e75aeae103fdb1bd3c8a855b3d5b9917b0419be869a7c6e7
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 749158732090E35ADB6D863984744BDFFE15A923A131A07BDE5F2CB1C5EF3485A8D620

Function 001119B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 2272fcc897ffee35877be10a852db6b2f5f5a07a9df90c56caa6b51b78b64506
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 2B91307220D0E35ADB2D427A95740BDFEF15A923A131A07BDD5F2CB1C1FF2495A4D620

Function 00117A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52670ac999afc3c67983f94529281c057cfe4364f383efea5ce911e32d78b1b6
Instruction ID: b2dd8b2fff6f21c9df7c01373f05033d61f7b5ad75ce5400be290c4e451f3f01
Opcode Fuzzy Hash: 52670ac999afc3c67983f94529281c057cfe4364f383efea5ce911e32d78b1b6
Instruction Fuzzy Hash: BB61497160C70996DA3CA928AC95BFE63B5DF51704F284939F842DB3C1DB119EC2C359

Function 00117CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e77d45c242438a98970d4122b7f15839275231dc9158f343888a3b5ef4832df
Instruction ID: fc509a350137894368c7f0d574805e8f9347013ee778b86e6888dc2e2ed0b705
Opcode Fuzzy Hash: 7e77d45c242438a98970d4122b7f15839275231dc9158f343888a3b5ef4832df
Instruction Fuzzy Hash: FA61677120C70D67DE3D5AA8A891BFE23F4AF52744F104979E843CB3C1DB12ADC28256

Function 00111706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: e8c9c2653932587e54db6790a7dbbac7250ea5780d63d750259effb4d638dec1
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: C58183336090A31ADB6D423E85340BEFFE15A923A531A47BED5F2CB1C1EF24C594E620

Function 00162046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a31b3de60d338abf809d0f61384b73677cf3dc2ff29b6c71a9a0570fd57c99
Instruction ID: 5b93c9065f9314c1fd11d96ba7fc54c079f74583ffd6a00f5191201c5f394f08
Opcode Fuzzy Hash: e1a31b3de60d338abf809d0f61384b73677cf3dc2ff29b6c71a9a0570fd57c99
Instruction Fuzzy Hash: 7721A5326206158BD728CF79C822A7E77E5A764310F15862EE4A7C37D0DE39E944CB90

Function 00172ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00172B30
DeleteObject.GDI32(00000000), ref: 00172B43
DestroyWindow.USER32 ref: 00172B52
GetDesktopWindow.USER32 ref: 00172B6D
GetWindowRect.USER32(00000000), ref: 00172B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00172CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00172CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172CF8
GetClientRect.USER32(00000000,?), ref: 00172D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00172D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172DA8
GlobalFree.KERNEL32(00000000), ref: 00172DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0018FC38,00000000), ref: 00172DDB
GlobalFree.KERNEL32(00000000), ref: 00172DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00172E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00172E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00172E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0017303F

Strings

DISPLAY, xrefs: 00172EA2
, xrefs: 00172FC5
static, xrefs: 00172D3A, 00172E91
AutoIt v3, xrefs: 00172CF2

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 0b89175ac33d4f419b38e71eb4e845ba9946b9af1c68b1af31219b03e5c9e450
Instruction ID: 0031481f5304c8762afb3117773ac261381758253831f9aacaf1671474a0ebbf
Opcode Fuzzy Hash: 0b89175ac33d4f419b38e71eb4e845ba9946b9af1c68b1af31219b03e5c9e450
Instruction Fuzzy Hash: 59026B71900209AFDB14DF64CC89EAE7BB9FB49710F108118F919AB6A1D774EE41CFA0

Function 001870D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0018712F
GetSysColorBrush.USER32(0000000F), ref: 00187160
GetSysColor.USER32(0000000F), ref: 0018716C
SetBkColor.GDI32(?,000000FF), ref: 00187186
SelectObject.GDI32(?,?), ref: 00187195
InflateRect.USER32(?,000000FF,000000FF), ref: 001871C0
GetSysColor.USER32(00000010), ref: 001871C8
CreateSolidBrush.GDI32(00000000), ref: 001871CF
FrameRect.USER32(?,?,00000000), ref: 001871DE
DeleteObject.GDI32(00000000), ref: 001871E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00187230
FillRect.USER32(?,?,?), ref: 00187262
GetWindowLongW.USER32(?,000000F0), ref: 00187284

Part of subcall function 001873E8: GetSysColor.USER32(00000012), ref: 00187421
Part of subcall function 001873E8: SetTextColor.GDI32(?,?), ref: 00187425
Part of subcall function 001873E8: GetSysColorBrush.USER32(0000000F), ref: 0018743B
Part of subcall function 001873E8: GetSysColor.USER32(0000000F), ref: 00187446
Part of subcall function 001873E8: GetSysColor.USER32(00000011), ref: 00187463
Part of subcall function 001873E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00187471
Part of subcall function 001873E8: SelectObject.GDI32(?,00000000), ref: 00187482
Part of subcall function 001873E8: SetBkColor.GDI32(?,00000000), ref: 0018748B
Part of subcall function 001873E8: SelectObject.GDI32(?,?), ref: 00187498
Part of subcall function 001873E8: InflateRect.USER32(?,000000FF,000000FF), ref: 001874B7
Part of subcall function 001873E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001874CE
Part of subcall function 001873E8: GetWindowLongW.USER32(00000000,000000F0), ref: 001874DB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 677a217c259e9ecdf70e0bf3bd9c5c71a7f68a85e6b2141c3450dad407237854
Instruction ID: e0858b9848f1d224d0a6c7bdfc91a7f5b7c7967c40d7736ed903c3cd8caff437
Opcode Fuzzy Hash: 677a217c259e9ecdf70e0bf3bd9c5c71a7f68a85e6b2141c3450dad407237854
Instruction Fuzzy Hash: 5AA18671108301EFDB119F64DC48E5B77A6FF49320F200A19F962965E1D775DA44CFA1

Function 00108D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00108E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00146AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00146AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00146F43

Part of subcall function 00108F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00108BE8,?,00000000,?,?,?,?,00108BBA,00000000,?), ref: 00108FC5

SendMessageW.USER32(?,00001053), ref: 00146F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00146F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00146FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00146FB7

Strings

0, xrefs: 00146DCF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: a854a5b2cd4c22a1e1015bf61329f441a9f6ab0a5fd96e2dbf31076c80beee30
Instruction ID: 4c4ba8a8d30ca722ddfda54ab230cc259582a2a63d2420869416f5324efbf4e1
Opcode Fuzzy Hash: a854a5b2cd4c22a1e1015bf61329f441a9f6ab0a5fd96e2dbf31076c80beee30
Instruction Fuzzy Hash: 2C12BF30604201EFDB25CF24D894BA6BBE1FB46308F144469F5C59B6A2CB71EC92DF92

Function 00172711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0017273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0017286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 001728A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 001728B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00172900
GetClientRect.USER32(00000000,?), ref: 0017290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00172955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00172964
GetStockObject.GDI32(00000011), ref: 00172974
SelectObject.GDI32(00000000,00000000), ref: 00172978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00172988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00172991
DeleteDC.GDI32(00000000), ref: 0017299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 001729C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 001729DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00172A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00172A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00172A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00172A77
GetStockObject.GDI32(00000011), ref: 00172A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00172A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00172A97

Strings

msctls_progress32, xrefs: 00172A13
DISPLAY, xrefs: 0017295A
static, xrefs: 0017294F, 00172A71
AutoIt v3, xrefs: 001728F8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 33b8e8eb95cb1a07b688706d3121fa467a455621cf70ba287ff72d84d6205d7f
Instruction ID: af00e47cfdb739bd4090e7bdafc72893a982ac1de7fe7eccc692dff4de714010
Opcode Fuzzy Hash: 33b8e8eb95cb1a07b688706d3121fa467a455621cf70ba287ff72d84d6205d7f
Instruction Fuzzy Hash: C0B15971A40209AFEB14DFA8CD89FAA7BB9FB08714F008114FA15E7691D774ED40CBA0

Function 00164ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00164AED
GetDriveTypeW.KERNEL32(?,0018CB68,?,\\.\,0018CC08), ref: 00164BCA
SetErrorMode.KERNEL32(00000000,0018CB68,?,\\.\,0018CC08), ref: 00164D36

Strings

SSA, xrefs: 00164CA6
MMC, xrefs: 00164CDE
Unknown, xrefs: 00164BED, 00164C83
Virtual, xrefs: 00164CE5
1394, xrefs: 00164C9F
Fibre, xrefs: 00164CAD
Fixed, xrefs: 00164C09
SCSI, xrefs: 00164C8A
RAMDisk, xrefs: 00164BF4
RAID, xrefs: 00164CBB
\\.\, xrefs: 00164B3F
Removable, xrefs: 00164C10, 00164C15
SAS, xrefs: 00164CC9
USB, xrefs: 00164CB4
Network, xrefs: 00164C02
FileBackedVirtual, xrefs: 00164CEC
PhysicalDrive, xrefs: 00164B76
SSD, xrefs: 00164C4A
ATAPI, xrefs: 00164C91
SATA, xrefs: 00164CD0
CDROM, xrefs: 00164BFB
ATA, xrefs: 00164C98
iSCSI, xrefs: 00164CC2

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: cd1b9657964a31126c5e03784a8810b448ff1993046261cf1008836382f938fb
Instruction ID: eb970d4aed95079b7855e682ef90043059ec72285f7499413aecb1c0df563308
Opcode Fuzzy Hash: cd1b9657964a31126c5e03784a8810b448ff1993046261cf1008836382f938fb
Instruction Fuzzy Hash: 7961D370705109DBCB08DF6CCE819FD7BA0AF14340B248415F806AB792DB3AED61EB41

Function 001873E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00187421
SetTextColor.GDI32(?,?), ref: 00187425
GetSysColorBrush.USER32(0000000F), ref: 0018743B
GetSysColor.USER32(0000000F), ref: 00187446
CreateSolidBrush.GDI32(?), ref: 0018744B
GetSysColor.USER32(00000011), ref: 00187463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00187471
SelectObject.GDI32(?,00000000), ref: 00187482
SetBkColor.GDI32(?,00000000), ref: 0018748B
SelectObject.GDI32(?,?), ref: 00187498
InflateRect.USER32(?,000000FF,000000FF), ref: 001874B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001874CE
GetWindowLongW.USER32(00000000,000000F0), ref: 001874DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0018752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00187554
InflateRect.USER32(?,000000FD,000000FD), ref: 00187572
DrawFocusRect.USER32(?,?), ref: 0018757D
GetSysColor.USER32(00000011), ref: 0018758E
SetTextColor.GDI32(?,00000000), ref: 00187596
DrawTextW.USER32(?,001870F5,000000FF,?,00000000), ref: 001875A8
SelectObject.GDI32(?,?), ref: 001875BF
DeleteObject.GDI32(?), ref: 001875CA
SelectObject.GDI32(?,?), ref: 001875D0
DeleteObject.GDI32(?), ref: 001875D5
SetTextColor.GDI32(?,?), ref: 001875DB
SetBkColor.GDI32(?,?), ref: 001875E5

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: b7f2c9b1d86b40df53c9276e6b077adbd271677b5e56384a287e2a73f13180c9
Instruction ID: d6395d9c1559ce8c47d4dfcf7dc5bca2914bc616e70bd5fde6014ec56e5a4a75
Opcode Fuzzy Hash: b7f2c9b1d86b40df53c9276e6b077adbd271677b5e56384a287e2a73f13180c9
Instruction Fuzzy Hash: 84614C72900218EFDF119FA4DC49AEE7FB9EB08320F214115F915AB6E1D7749A80DFA0

Function 00180FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00181128
GetDesktopWindow.USER32 ref: 0018113D
GetWindowRect.USER32(00000000), ref: 00181144
GetWindowLongW.USER32(?,000000F0), ref: 00181199
DestroyWindow.USER32(?), ref: 001811B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 001811ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0018120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0018121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00181232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00181245
IsWindowVisible.USER32(00000000), ref: 001812A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 001812BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 001812D0
GetWindowRect.USER32(00000000,?), ref: 001812E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0018130E
GetMonitorInfoW.USER32(00000000,?), ref: 00181328
CopyRect.USER32(?,?), ref: 0018133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 001813AA

Strings

(, xrefs: 0018131B
tooltips_class32, xrefs: 001811E6
0, xrefs: 001810D3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 05e3ac054fa87384d17babf6090c9762cb512666b42622e0d0673474012da8c6
Instruction ID: 71e245fe98b4cf6d98bfb6c51b655bd1ba2f022137f4bfa03ff6a79fdbb39719
Opcode Fuzzy Hash: 05e3ac054fa87384d17babf6090c9762cb512666b42622e0d0673474012da8c6
Instruction Fuzzy Hash: 98B19F72604341AFD704EF64C884BAABBE9FF84750F00891CF9999B262D771E945CFA1

Function 00108891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00108968
GetSystemMetrics.USER32(00000007), ref: 00108970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0010899B
GetSystemMetrics.USER32(00000008), ref: 001089A3
GetSystemMetrics.USER32(00000004), ref: 001089C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 001089E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 001089F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00108A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00108A3C
GetClientRect.USER32(00000000,000000FF), ref: 00108A5A
GetStockObject.GDI32(00000011), ref: 00108A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00108A81

Part of subcall function 0010912D: GetCursorPos.USER32(?), ref: 00109141
Part of subcall function 0010912D: ScreenToClient.USER32(00000000,?), ref: 0010915E
Part of subcall function 0010912D: GetAsyncKeyState.USER32(00000001), ref: 00109183
Part of subcall function 0010912D: GetAsyncKeyState.USER32(00000002), ref: 0010919D

SetTimer.USER32(00000000,00000000,00000028,001090FC), ref: 00108AA8

Strings

AutoIt v3 GUI, xrefs: 00108A20

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 8b074363a8b9699108276ced273521951e18fc20253e369005968a8c1e2ccb7c
Instruction ID: 175723c29f415145d7aeaa7f53e186f2bd1330971990b1acb7763dacf3ff41f4
Opcode Fuzzy Hash: 8b074363a8b9699108276ced273521951e18fc20253e369005968a8c1e2ccb7c
Instruction Fuzzy Hash: BBB18C71A0020AAFDF14DFA8CC95BAE7BB5FB49318F114129FA45A72E0DB70E940CB51

Function 00150D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001510F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00151114
Part of subcall function 001510F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00150B9B,?,?,?), ref: 00151120
Part of subcall function 001510F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00150B9B,?,?,?), ref: 0015112F
Part of subcall function 001510F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00150B9B,?,?,?), ref: 00151136
Part of subcall function 001510F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0015114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00150DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00150E29
GetLengthSid.ADVAPI32(?), ref: 00150E40
GetAce.ADVAPI32(?,00000000,?), ref: 00150E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00150E96
GetLengthSid.ADVAPI32(?), ref: 00150EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00150EB5
HeapAlloc.KERNEL32(00000000), ref: 00150EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00150EDD
CopySid.ADVAPI32(00000000), ref: 00150EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00150F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00150F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00150F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00150F6E
HeapFree.KERNEL32(00000000), ref: 00150F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00150F7E
HeapFree.KERNEL32(00000000), ref: 00150F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00150F8E
HeapFree.KERNEL32(00000000), ref: 00150F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00150FA1
HeapFree.KERNEL32(00000000), ref: 00150FA8

Part of subcall function 00151193: GetProcessHeap.KERNEL32(00000008,00150BB1,?,00000000,?,00150BB1,?), ref: 001511A1
Part of subcall function 00151193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00150BB1,?), ref: 001511A8
Part of subcall function 00151193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00150BB1,?), ref: 001511B7

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: f754c7c8278ae14b29960fe9cabad16bdde8aafa25c2176daeae6586273f5655
Instruction ID: c5eabfab44fcc9e4e46193cd9314c9b8b030feeff697de4ef0be7b2062a11868
Opcode Fuzzy Hash: f754c7c8278ae14b29960fe9cabad16bdde8aafa25c2176daeae6586273f5655
Instruction Fuzzy Hash: 37715D7190020AEBDF219FE4DC49FAEBBB8FF08341F144115F929AA191D7719A49CBB0

Function 0017C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0017C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0018CC08,00000000,?,00000000,?,?), ref: 0017C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0017C5A4
_wcslen.LIBCMT ref: 0017C5F4
_wcslen.LIBCMT ref: 0017C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0017C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0017C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0017C84D
RegCloseKey.ADVAPI32(?), ref: 0017C881
RegCloseKey.ADVAPI32(00000000), ref: 0017C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0017C960

Strings

REG_MULTI_SZ, xrefs: 0017C6F5
REG_QWORD, xrefs: 0017C8C3
REG_BINARY, xrefs: 0017C913
REG_DWORD, xrefs: 0017C804
REG_EXPAND_SZ, xrefs: 0017C5CD
REG_SZ, xrefs: 0017C644

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 3a055e3e4c995e3de3ac8b7226dcbf9a3e94ce70caec040772c738c1b9c048a1
Instruction ID: 67efe0a8542a1ca87f789407cca0e1c98b8e4dc7e522f965f9135a1a78f47e83
Opcode Fuzzy Hash: 3a055e3e4c995e3de3ac8b7226dcbf9a3e94ce70caec040772c738c1b9c048a1
Instruction Fuzzy Hash: 681265352046019FDB14DF24C881B6AB7F5EF88714F05889CF98A9B7A2DB71ED45CB82

Function 0018091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001809C6
_wcslen.LIBCMT ref: 00180A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00180A54
_wcslen.LIBCMT ref: 00180A8A
_wcslen.LIBCMT ref: 00180B06
_wcslen.LIBCMT ref: 00180B81

Part of subcall function 0010F9F2: _wcslen.LIBCMT ref: 0010F9FD

Part of subcall function 00152BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00152BFA

Strings

EXPAND, xrefs: 00180BF8
GETTEXT, xrefs: 00180C97
EXISTS, xrefs: 00180B7C, 00180B97
SELECT, xrefs: 00180D11
UNCHECK, xrefs: 00180D3E
COLLAPSE, xrefs: 00180B01, 00180B1C
CHECK, xrefs: 00180A85, 00180AA0
GETTOTALCOUNT, xrefs: 001809F2, 00180A17
ISCHECKED, xrefs: 00180CE1
GETITEMCOUNT, xrefs: 00180C1E
GETSELECTED, xrefs: 00180C4E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: b2d2a3330f317cd50b2f4b19b9863ed505b377a2ea4ae863cd2875492d489fbc
Instruction ID: a73d5e6f2e0757a79a90d1e7962f1e07d789f21eb38c1bd48db9470316be0ddf
Opcode Fuzzy Hash: b2d2a3330f317cd50b2f4b19b9863ed505b377a2ea4ae863cd2875492d489fbc
Instruction Fuzzy Hash: 3EE1EF352087098FC759EF24C45096AB7E1BF98308F11895CF89A9B7A2D731EE49CF81

Function 0017C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0017B6AE,?,?), ref: 0017C9B5
_wcslen.LIBCMT ref: 0017C9F1
_wcslen.LIBCMT ref: 0017CA68
_wcslen.LIBCMT ref: 0017CA9E
_wcslen.LIBCMT ref: 0017CAF9
_wcslen.LIBCMT ref: 0017CB2F
_wcslen.LIBCMT ref: 0017CB7F

Strings

HKCR, xrefs: 0017CB29, 0017CB2E
HKEY_USERS, xrefs: 0017CBDF
HKEY_LOCAL_MACHINE, xrefs: 0017CA62, 0017CA67
HKU, xrefs: 0017CBF0
HKCC, xrefs: 0017CBAC
HKEY_CURRENT_CONFIG, xrefs: 0017CB79, 0017CB7E
HKEY_CURRENT_USER, xrefs: 0017CBBD
HKLM, xrefs: 0017CA98, 0017CA9D
HKEY_CLASSES_ROOT, xrefs: 0017CAF3, 0017CAF8
HKCU, xrefs: 0017CBCE

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 80e5e333b759de47e517a0784e3cb95d72bcbd8a75ff9de3cf77990ae95d4c78
Instruction ID: f97670340b8b5cb00f1c60b6c7d1f457e2b6efd71790dc2d315b68fba26e8037
Opcode Fuzzy Hash: 80e5e333b759de47e517a0784e3cb95d72bcbd8a75ff9de3cf77990ae95d4c78
Instruction Fuzzy Hash: 2E71B67260416A8BCB20DE7CC9515FE33B1ABA5794B25852CF85DA7285FB31CD85C3E0

Function 0018833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0018835A
_wcslen.LIBCMT ref: 0018836E
_wcslen.LIBCMT ref: 00188391
_wcslen.LIBCMT ref: 001883B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 001883F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0018361A,?), ref: 0018844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00188487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 001884CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00188501
FreeLibrary.KERNEL32(?), ref: 0018850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0018851D
DestroyIcon.USER32(?), ref: 0018852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00188549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00188555

Strings

.exe, xrefs: 00188388
.icl, xrefs: 00188368
.dll, xrefs: 001883AB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 3b5a31dd9fbf461a39551fef83c460ac0f544e47c5cabac68f1949c133f16974
Instruction ID: 0af7b549d82a9e3a66ac2679df629a8c32dbb2d041515ea5fe6493e068f1fbff
Opcode Fuzzy Hash: 3b5a31dd9fbf461a39551fef83c460ac0f544e47c5cabac68f1949c133f16974
Instruction Fuzzy Hash: 1D61E172500219BFEB14EF64DC81BFE77A8BF08B11F504619F915E60D1DB74AA80CBA0

Function 000F7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

", xrefs: 00135153
#requireadmin, xrefs: 000F77FF
#OnAutoItStartRegister, xrefs: 000F7817
Unterminated group of comments, xrefs: 0013528C
#include, xrefs: 000F7847
#pragma compile, xrefs: 000F77D3
#comments-end, xrefs: 000F78D9
#ce, xrefs: 000F78ED
Bad directive syntax error, xrefs: 0013519A
#notrayicon, xrefs: 000F77E7
#include-once, xrefs: 000F782F
#comments-start, xrefs: 000F785F, 000F78B1
#cs, xrefs: 000F7873, 000F78C5
Cannot parse #include, xrefs: 00135279
', xrefs: 00135169

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: f96ffdc5bf3df1dccba8a146ed216e1ae3eb94ef288cb085f29d6b8fe32296df
Instruction ID: ffd9fbe457a0e9889a929cc61d490b1ec1ab47b08133043f122fae653be86f36
Opcode Fuzzy Hash: f96ffdc5bf3df1dccba8a146ed216e1ae3eb94ef288cb085f29d6b8fe32296df
Instruction Fuzzy Hash: D381F971648209BBDB24BF60CC42FFE37A5AF15740F044034FA08AB592EB74DA52D792

Function 00163E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00163EF8
_wcslen.LIBCMT ref: 00163F03
_wcslen.LIBCMT ref: 00163F5A
_wcslen.LIBCMT ref: 00163F98
GetDriveTypeW.KERNEL32(?), ref: 00163FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0016401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00164059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00164087

Strings

open, xrefs: 00163F54, 00163F59
close cd wait, xrefs: 00164072
wait, xrefs: 00164044
open , xrefs: 00163FE5
closed, xrefs: 00163F08, 00163F2D, 00163F46, 00163F7E, 00163F97
close, xrefs: 00163EFE, 00163F18
type cdaudio alias cd wait, xrefs: 00164001
set cd door , xrefs: 00164028

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 334bd9fca7867bf78fa0cf3c8b9b4866ed2e670c819683446f69dab6150b65dd
Instruction ID: b4901609260172848d89c638eae89e0efe75cab9263f8e4756cfb217b71f7112
Opcode Fuzzy Hash: 334bd9fca7867bf78fa0cf3c8b9b4866ed2e670c819683446f69dab6150b65dd
Instruction Fuzzy Hash: 5D71E4326042169FC310EF24CC819BAB7F4EFA4754F40492DF9A697252EB31DE45CB92

Function 00155A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00155A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00155A40
SetWindowTextW.USER32(?,?), ref: 00155A57
GetDlgItem.USER32(?,000003EA), ref: 00155A6C
SetWindowTextW.USER32(00000000,?), ref: 00155A72
GetDlgItem.USER32(?,000003E9), ref: 00155A82
SetWindowTextW.USER32(00000000,?), ref: 00155A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00155AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00155AC3
GetWindowRect.USER32(?,?), ref: 00155ACC
_wcslen.LIBCMT ref: 00155B33
SetWindowTextW.USER32(?,?), ref: 00155B6F
GetDesktopWindow.USER32 ref: 00155B75
GetWindowRect.USER32(00000000), ref: 00155B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00155BD3
GetClientRect.USER32(?,?), ref: 00155BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00155C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00155C2F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 105a64c21879297c168f5f5e0ab1378a45048971bf1951eef55ff52c2f55c5c1
Instruction ID: 9869a82e08b059be5063cf942e9a35ed5a188c6ff5957060c92a4c8e5a36a763
Opcode Fuzzy Hash: 105a64c21879297c168f5f5e0ab1378a45048971bf1951eef55ff52c2f55c5c1
Instruction Fuzzy Hash: 73718131900B05EFDB20DFA8CE59AAEBBF6FF48705F104518E552A75A0D774E944CB60

Function 0016FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0016FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0016FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0016FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0016FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0016FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0016FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0016FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0016FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0016FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0016FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0016FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0016FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0016FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0016FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0016FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0016FECC
GetCursorInfo.USER32(?), ref: 0016FEDC
GetLastError.KERNEL32 ref: 0016FF1E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 7a9b941a51a3ed036949d8eef0ed3bfc0c9c9a4f408de512c7e80ad769dc7c89
Instruction ID: 8542f9cbe7cd18c5430c78731cad3f2f7e6cd3bbec406314a017fa6bf18ec69f
Opcode Fuzzy Hash: 7a9b941a51a3ed036949d8eef0ed3bfc0c9c9a4f408de512c7e80ad769dc7c89
Instruction Fuzzy Hash: F74172B1D04319AADB10DFBA9C89C6EBFE8FF04354B50456AE11DE7281DB78A901CF90

Function 001100C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 001100C6

Part of subcall function 001100ED: InitializeCriticalSectionAndSpinCount.KERNEL32(001C070C,00000FA0,E8E3878B,?,?,?,?,001323B3,000000FF), ref: 0011011C
Part of subcall function 001100ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,001323B3,000000FF), ref: 00110127
Part of subcall function 001100ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,001323B3,000000FF), ref: 00110138
Part of subcall function 001100ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0011014E
Part of subcall function 001100ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0011015C
Part of subcall function 001100ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0011016A
Part of subcall function 001100ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00110195
Part of subcall function 001100ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 001101A0

___scrt_fastfail.LIBCMT ref: 001100E7

Part of subcall function 001100A3: __onexit.LIBCMT ref: 001100A9

Strings

InitializeConditionVariable, xrefs: 00110148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00110122
SleepConditionVariableCS, xrefs: 00110154
kernel32.dll, xrefs: 00110133
WakeAllConditionVariable, xrefs: 00110162

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 88762a25e8e18bf6e3789e02b6d6127a44c2d6464f48b9ae37745a7c8dad6e69
Instruction ID: 8fc5b611726942689ab45782e0dfb4f0509a9f63aba4d4ffc36a98c31bd494f0
Opcode Fuzzy Hash: 88762a25e8e18bf6e3789e02b6d6127a44c2d6464f48b9ae37745a7c8dad6e69
Instruction Fuzzy Hash: BE21DA32E44710EBD71A6BA4AC4AB9937D4EB1DF51F110139F941D2A91DBF4DDC08BA0

Function 001530F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0015318D
_wcslen.LIBCMT ref: 001531F8

Strings

CLASS, xrefs: 00153188, 001531A5
NAME, xrefs: 00153335, 00153346
TEXT, xrefs: 0015347C
REGEXPCLASS, xrefs: 00153255, 00153266
INSTANCE, xrefs: 00153453
CLASSNN, xrefs: 001531F3, 00153204

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: ad5aa384269461da13da87f87ea2d3083ecc23c06c2fe9253eafc369eab3b2e5
Instruction ID: 825ee451b37dbab2b36b1ed8e3c6a499758a8965c5bfbe284f2a708b657f6add
Opcode Fuzzy Hash: ad5aa384269461da13da87f87ea2d3083ecc23c06c2fe9253eafc369eab3b2e5
Instruction Fuzzy Hash: 57E1D532A00516DBCB189F74C4517EDFBB1BF54791F648129E876BB240DB30AE8D9790

Function 001644C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0018CC08), ref: 00164527
_wcslen.LIBCMT ref: 0016453B
_wcslen.LIBCMT ref: 00164599
_wcslen.LIBCMT ref: 001645F4
_wcslen.LIBCMT ref: 0016463F
_wcslen.LIBCMT ref: 001646A7

Part of subcall function 0010F9F2: _wcslen.LIBCMT ref: 0010F9FD

GetDriveTypeW.KERNEL32(?,001B6BF0,00000061), ref: 00164743

Strings

ramdisk, xrefs: 001646F1
unknown, xrefs: 00164708
network, xrefs: 0016469D, 001646A2
cdrom, xrefs: 0016458F, 00164594
all, xrefs: 00164531, 00164536
fixed, xrefs: 00164635, 0016463A
removable, xrefs: 001645EA, 001645EF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 51bcecdd8f0015a477799fb85b81ab6ff813512a35f43ae8af67811ced4b5a37
Instruction ID: 6bfcc4166fe5974c204c4676ee4eed6c5157cb2ca64c32be3238bcd153d4b5c6
Opcode Fuzzy Hash: 51bcecdd8f0015a477799fb85b81ab6ff813512a35f43ae8af67811ced4b5a37
Instruction Fuzzy Hash: A4B111716083029FC714DF28CC90ABEB7E5AFA5724F50892DF596C7292E730D954CBA2

Function 00173FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0018CC08), ref: 001740BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 001740CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0018CC08), ref: 001740F2
FreeLibrary.KERNEL32(00000000,?,0018CC08), ref: 0017413E
StringFromGUID2.OLE32(?,?,00000028,?,0018CC08), ref: 001741A8
SysFreeString.OLEAUT32(00000009), ref: 00174262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 001742C8
SysFreeString.OLEAUT32(?), ref: 001742F2

Strings

GetModuleHandleExW, xrefs: 001740C7
kernel32.dll, xrefs: 001740B6

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 43343d045acf896157a0e8a03bea5ae0849768643ca865c9531049c59d98c060
Instruction ID: fa3b4101c7790a139fc54cd6b59ae26d9e2086ff0b63ae0e31307bec2436e739
Opcode Fuzzy Hash: 43343d045acf896157a0e8a03bea5ae0849768643ca865c9531049c59d98c060
Instruction Fuzzy Hash: AC121975A00119EFDB14DF94C884EAEB7B5FF49314F25C098E90A9B251D731EE86CBA0

Function 000F326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(001C1990), ref: 00132F8D
GetMenuItemCount.USER32(001C1990), ref: 0013303D
GetCursorPos.USER32(?), ref: 00133081
SetForegroundWindow.USER32(00000000), ref: 0013308A
TrackPopupMenuEx.USER32(001C1990,00000000,?,00000000,00000000,00000000), ref: 0013309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 001330A9

Strings

0, xrefs: 000F327D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 127506ff5def9914e7c5a90e7bd42d4c526fca127e92ba505e53a7d99bc9fbde
Instruction ID: c225cf58584cd90edf613d71ec75f3238bdb334916ce32a2a7e59d179d52f453
Opcode Fuzzy Hash: 127506ff5def9914e7c5a90e7bd42d4c526fca127e92ba505e53a7d99bc9fbde
Instruction Fuzzy Hash: E5710630644209BEEB359F24CC89FAEBF68FF05374F204216F6246A5E1C7B1A954DB90

Function 00186CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00186DEB

Part of subcall function 000F6B57: _wcslen.LIBCMT ref: 000F6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00186E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00186E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00186E94
DestroyWindow.USER32(?), ref: 00186EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,000F0000,00000000), ref: 00186EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00186EFD
GetDesktopWindow.USER32 ref: 00186F16
GetWindowRect.USER32(00000000), ref: 00186F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00186F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00186F4D

Part of subcall function 00109944: GetWindowLongW.USER32(?,000000EB), ref: 00109952

Strings

0, xrefs: 00186D98
tooltips_class32, xrefs: 00186E58, 00186EDD

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 735e12180c19ec85649ea46933b3fbde9810af8509c5dffc7da4d6ff18ceaf9c
Instruction ID: f1ef97986aab63d4cba6a1cebb143b4cef2ec5fd607914c07238115c567b2e47
Opcode Fuzzy Hash: 735e12180c19ec85649ea46933b3fbde9810af8509c5dffc7da4d6ff18ceaf9c
Instruction Fuzzy Hash: 6F717770144244AFDB21DF28DC58FAABBE9FB89304F14042DFA89876A1D770EA45DF61

Function 0018911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00109BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00109BB2

DragQueryPoint.SHELL32(?,?), ref: 00189147

Part of subcall function 00187674: ClientToScreen.USER32(?,?), ref: 0018769A
Part of subcall function 00187674: GetWindowRect.USER32(?,?), ref: 00187710
Part of subcall function 00187674: PtInRect.USER32(?,?,00188B89), ref: 00187720

SendMessageW.USER32(?,000000B0,?,?), ref: 001891B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 001891BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 001891DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00189225
SendMessageW.USER32(?,000000B0,?,?), ref: 0018923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00189255
SendMessageW.USER32(?,000000B1,?,?), ref: 00189277
DragFinish.SHELL32(?), ref: 0018927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00189371

Strings

@GUI_DRAGID, xrefs: 001892E9
@GUI_DRAGFILE, xrefs: 00189320
@GUI_DROPID, xrefs: 0018929E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 38f2f4ee8ab80ba1198425e1d468b86f60231460286d7ad4309dec33d6654ddc
Instruction ID: b1761d32e3874b62eec675dec1804a094213ad9518f0a4be12422d5efd5c8801
Opcode Fuzzy Hash: 38f2f4ee8ab80ba1198425e1d468b86f60231460286d7ad4309dec33d6654ddc
Instruction Fuzzy Hash: 09618B71108305AFC701EF64DC85EAFBBE8FF99350F00092DF695921A1DB309A49CBA2

Function 0016C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0016C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0016C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0016C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0016C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0016C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0016C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0016C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0016C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0016C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0016C5F0
InternetCloseHandle.WININET(00000000), ref: 0016C5FB

Strings

, xrefs: 0016C575

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: ae76e4035d1e54c328044505661c1e3419805db84997e76a9ca92119bac20edd
Instruction ID: 9ed7f296643d1d62ca412e41225f1a9cb9791d9e665db59ba4a32c5c4292e1c7
Opcode Fuzzy Hash: ae76e4035d1e54c328044505661c1e3419805db84997e76a9ca92119bac20edd
Instruction Fuzzy Hash: 74512CB1600609BFDB219F64CD48ABB7BBCFB18754F00441AF98696650DB34EA54DFA0

Function 0018856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00188592
GetFileSize.KERNEL32(00000000,00000000), ref: 001885A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 001885AD
CloseHandle.KERNEL32(00000000), ref: 001885BA
GlobalLock.KERNEL32(00000000), ref: 001885C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 001885D7
GlobalUnlock.KERNEL32(00000000), ref: 001885E0
CloseHandle.KERNEL32(00000000), ref: 001885E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 001885F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0018FC38,?), ref: 00188611
GlobalFree.KERNEL32(00000000), ref: 00188621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00188641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00188671
DeleteObject.GDI32(00000000), ref: 00188699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 001886AF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 92c33b7d8ab67035cfb68ab58b2952bfe8b3450315db60c4ad6056385366f921
Instruction ID: aedbda65a4c7f755071fca33ad9bacfa8c21c8b3bdab17a8fbda766ffc9523c8
Opcode Fuzzy Hash: 92c33b7d8ab67035cfb68ab58b2952bfe8b3450315db60c4ad6056385366f921
Instruction Fuzzy Hash: DA410975600208AFDB11DFA5DC88EAA7BB9FF89B15F104158F905E76A0DB309E41DF60

Function 001614BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00161502
VariantCopy.OLEAUT32(?,?), ref: 0016150B
VariantClear.OLEAUT32(?), ref: 00161517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 001615FB
VarR8FromDec.OLEAUT32(?,?), ref: 00161657
VariantInit.OLEAUT32(?), ref: 00161708
SysFreeString.OLEAUT32(?), ref: 0016178C
VariantClear.OLEAUT32(?), ref: 001617D8
VariantClear.OLEAUT32(?), ref: 001617E7
VariantInit.OLEAUT32(00000000), ref: 00161823

Strings

Default, xrefs: 001616AF
%4d%02d%02d%02d%02d%02d, xrefs: 00161625

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 1288d9d58f6777c75eeb7d6947cc4c7769a1d1d1aadf97bcf359ec0165ca8b96
Instruction ID: b2e31f0d3ebae4807393ec596febe2df258e640d4efa863521402a12b7129bc8
Opcode Fuzzy Hash: 1288d9d58f6777c75eeb7d6947cc4c7769a1d1d1aadf97bcf359ec0165ca8b96
Instruction Fuzzy Hash: DBD13F31A00205EBDB14AF64EC85BB9F7B1BF46700F19805AF447AB581EB70ED61DBA1

Function 0017B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 0017C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0017B6AE,?,?), ref: 0017C9B5
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017C9F1
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017CA68
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0017B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0017B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0017B80A
RegCloseKey.ADVAPI32(?), ref: 0017B87E
RegCloseKey.ADVAPI32(?), ref: 0017B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0017B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0017B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0017B922
FreeLibrary.KERNEL32(00000000), ref: 0017B983
RegCloseKey.ADVAPI32(00000000), ref: 0017B994

Strings

RegDeleteKeyExW, xrefs: 0017B8FE
advapi32.dll, xrefs: 0017B8ED

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: dd0fd7a7904546a1d545f05fc89a93532ad4da75d5b073d171211d961af09de4
Instruction ID: 351ddf72f51f7765644b3630eb8291754823694d79515bb0f673f874201f7530
Opcode Fuzzy Hash: dd0fd7a7904546a1d545f05fc89a93532ad4da75d5b073d171211d961af09de4
Instruction Fuzzy Hash: 81C17A74208201AFD714DF14C495F6ABBF5BF84308F14C49CF6AA8B6A2CB75E945CB92

Function 0017255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 001725D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 001725E8
CreateCompatibleDC.GDI32(?), ref: 001725F4
SelectObject.GDI32(00000000,?), ref: 00172601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0017266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 001726AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 001726D0
SelectObject.GDI32(?,?), ref: 001726D8
DeleteObject.GDI32(?), ref: 001726E1
DeleteDC.GDI32(?), ref: 001726E8
ReleaseDC.USER32(00000000,?), ref: 001726F3

Strings

(, xrefs: 0017268D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: b726630fe8a43f28a0f0299503f76466c0fe2f9d58d02d76e05f0050b99b995e
Instruction ID: 37f76bcc632842bbe0300166727935bd2c719ce3ffbc4f2d21bb7a5abad90723
Opcode Fuzzy Hash: b726630fe8a43f28a0f0299503f76466c0fe2f9d58d02d76e05f0050b99b995e
Instruction Fuzzy Hash: 6D61F675D00219EFCF14CFA4D884AAEBBF6FF58310F208529E959A7250D770AA41CFA0

Function 0012DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0012DAA1

Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D659
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D66B
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D67D
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D68F
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D6A1
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D6B3
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D6C5
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D6D7
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D6E9
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D6FB
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D70D
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D71F
Part of subcall function 0012D63C: _free.LIBCMT ref: 0012D731

_free.LIBCMT ref: 0012DA96

Part of subcall function 001229C8: HeapFree.KERNEL32(00000000,00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000), ref: 001229DE
Part of subcall function 001229C8: GetLastError.KERNEL32(00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000,00000000), ref: 001229F0

_free.LIBCMT ref: 0012DAB8
_free.LIBCMT ref: 0012DACD
_free.LIBCMT ref: 0012DAD8
_free.LIBCMT ref: 0012DAFA
_free.LIBCMT ref: 0012DB0D
_free.LIBCMT ref: 0012DB1B
_free.LIBCMT ref: 0012DB26
_free.LIBCMT ref: 0012DB5E
_free.LIBCMT ref: 0012DB65
_free.LIBCMT ref: 0012DB82
_free.LIBCMT ref: 0012DB9A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 3ba2d8c9c7a9ad278577c129204567240128cd6833c572c8d12c3def9179771b
Instruction ID: 0368bf4c4a8fa02ed8de8e032e8efef1a71c98d41a1ed90dfd6227d690834a4c
Opcode Fuzzy Hash: 3ba2d8c9c7a9ad278577c129204567240128cd6833c572c8d12c3def9179771b
Instruction Fuzzy Hash: 94316931604325AFEF21AB38F845B5AB7E9FF25314F514429E449D7191DF30ACA08B60

Function 0015365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0015369C
_wcslen.LIBCMT ref: 001536A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00153797
GetClassNameW.USER32(?,?,00000400), ref: 0015380C
GetDlgCtrlID.USER32(?), ref: 0015385D
GetWindowRect.USER32(?,?), ref: 00153882
GetParent.USER32(?), ref: 001538A0
ScreenToClient.USER32(00000000), ref: 001538A7
GetClassNameW.USER32(?,?,00000100), ref: 00153921
GetWindowTextW.USER32(?,?,00000400), ref: 0015395D

Strings

%s%u, xrefs: 00153734

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: adcece27a73afd642b144ad720f91c13209f693b7a2533062cb021d410a016ee
Instruction ID: 02cd1d668f445795af9df2ee64a43fc6617e6b4e0b19fc5aacff93d41a84cdee
Opcode Fuzzy Hash: adcece27a73afd642b144ad720f91c13209f693b7a2533062cb021d410a016ee
Instruction Fuzzy Hash: 9D91B4B1204606EFD719DF24C885BEAB7A9FF44385F004629FDB9CB150DB30AA59CB91

Function 00154954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00154994
GetWindowTextW.USER32(?,?,00000400), ref: 001549DA
_wcslen.LIBCMT ref: 001549EB
CharUpperBuffW.USER32(?,00000000), ref: 001549F7
_wcsstr.LIBVCRUNTIME ref: 00154A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00154A64
GetWindowTextW.USER32(?,?,00000400), ref: 00154A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00154AE6
GetClassNameW.USER32(?,?,00000400), ref: 00154B20
GetWindowRect.USER32(?,?), ref: 00154B8B

Strings

ThumbnailClass, xrefs: 00154A6F, 00154AF1

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 46a9b31964936e9f62d0c1ffc5690ff4b160a3595bb173f8fba6dfc475a0a35d
Instruction ID: d272bda697af22ab36f76cbf56696b4ed6c49c6c41f6201c088c630172f47818
Opcode Fuzzy Hash: 46a9b31964936e9f62d0c1ffc5690ff4b160a3595bb173f8fba6dfc475a0a35d
Instruction Fuzzy Hash: EB91C171008205DFDB08DF14C985BAA77E9FF84319F048469FD969E196EB30ED89CBA1

Function 0015BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(001C1990,000000FF,00000000,00000030), ref: 0015BFAC
SetMenuItemInfoW.USER32(001C1990,00000004,00000000,00000030), ref: 0015BFE1
Sleep.KERNEL32(000001F4), ref: 0015BFF3
GetMenuItemCount.USER32(?), ref: 0015C039
GetMenuItemID.USER32(?,00000000), ref: 0015C056
GetMenuItemID.USER32(?,-00000001), ref: 0015C082
GetMenuItemID.USER32(?,?), ref: 0015C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0015C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0015C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0015C145

Strings

0, xrefs: 0015BF3D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 66373fea5dbfaa66c684ddadd9ace193695a91e0d3a3940243190ffa3718f07f
Instruction ID: baa350ef4fe6e987a782d2a613ccd9be04f8986035021be0bab64e002799bb44
Opcode Fuzzy Hash: 66373fea5dbfaa66c684ddadd9ace193695a91e0d3a3940243190ffa3718f07f
Instruction Fuzzy Hash: 6B617E70A0034AEFDF15CF64DD88AEEBBA8EB05345F140055FD21AB292D771AD49CBA0

Function 0017CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0017CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0017CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0017CD48

Part of subcall function 0017CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0017CCAA
Part of subcall function 0017CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0017CCBD
Part of subcall function 0017CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0017CCCF
Part of subcall function 0017CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0017CD05
Part of subcall function 0017CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0017CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0017CCF3

Strings

RegDeleteKeyExW, xrefs: 0017CCC9
advapi32.dll, xrefs: 0017CCB8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 25e39b4aba02ea640afb3bc8e5a8262c2ee806f57a3552ce1db5a9282d7d3268
Instruction ID: 2c7a951705ad08091c25b28b63c7c989df959e448c22743a772c82a7302d6cb0
Opcode Fuzzy Hash: 25e39b4aba02ea640afb3bc8e5a8262c2ee806f57a3552ce1db5a9282d7d3268
Instruction Fuzzy Hash: 6C315A75901129BBDB218B94DC88EFFBB7CEF55790F004169B90AE2240DB749B859BF0

Function 00163D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00163D40
_wcslen.LIBCMT ref: 00163D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00163D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00163DBE
RemoveDirectoryW.KERNEL32(?), ref: 00163DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00163E55
CloseHandle.KERNEL32(00000000), ref: 00163E60
CloseHandle.KERNEL32(00000000), ref: 00163E6B

Strings

\, xrefs: 00163D77
\??\%s, xrefs: 00163D5B
:, xrefs: 00163D82

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 93f00c136f38ee39597fd25e021ed81c7b0547f8e4dba9317f0a24d70576354c
Instruction ID: 5a05bb17b490b7c42eec4e9e54b751181688248ba46aa8cf6bf4e521d32c5936
Opcode Fuzzy Hash: 93f00c136f38ee39597fd25e021ed81c7b0547f8e4dba9317f0a24d70576354c
Instruction Fuzzy Hash: A431B272900219ABDB219BA0DC89FEF77BDEF88700F5040B5F915D60A0E77497948B74

Function 0015E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0015E6B4

Part of subcall function 0010E551: timeGetTime.WINMM(?,?,0015E6D4), ref: 0010E555

Sleep.KERNEL32(0000000A), ref: 0015E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0015E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0015E727
SetActiveWindow.USER32 ref: 0015E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0015E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0015E773
Sleep.KERNEL32(000000FA), ref: 0015E77E
IsWindow.USER32 ref: 0015E78A
EndDialog.USER32(00000000), ref: 0015E79B

Strings

BUTTON, xrefs: 0015E719

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: b534029284ae9060e18f4e6e151a6fb3cf3723d62e0ff111101c0be350f87757
Instruction ID: 2b77cd5fce0c614c8b1549ca58958d3eefe2b6c3410763502d4e0e77bec1f538
Opcode Fuzzy Hash: b534029284ae9060e18f4e6e151a6fb3cf3723d62e0ff111101c0be350f87757
Instruction Fuzzy Hash: F8219670600245EFEB045FA0ECC9E253FA9FB5534AF201425FC65869A1DFB1DE889BB4

Function 0015E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0015EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0015EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0015EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0015EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0015EAA7

Strings

alias PlayMe, xrefs: 0015EA36
play PlayMe wait, xrefs: 0015EA91
play PlayMe, xrefs: 0015EAA2
close PlayMe, xrefs: 0015EA6E, 0015EA9B
open , xrefs: 0015EA0C
status PlayMe mode, xrefs: 0015EA58

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 2b14308a36909e89ac0dc45309cfb39b21cf9e70a031badd3bc614ee004cd122
Instruction ID: b9fbb275b7245596946f5ff27819ca93a70ba75700bb1c397f29cf4cf943868b
Opcode Fuzzy Hash: 2b14308a36909e89ac0dc45309cfb39b21cf9e70a031badd3bc614ee004cd122
Instruction Fuzzy Hash: FC115431A5021DBDD724A761DC4ADFF7ABCEBD1B44F400429B911A60D1EFB00A45C5B0

Function 00159F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0015A012
SetKeyboardState.USER32(?), ref: 0015A07D
GetAsyncKeyState.USER32(000000A0), ref: 0015A09D
GetKeyState.USER32(000000A0), ref: 0015A0B4
GetAsyncKeyState.USER32(000000A1), ref: 0015A0E3
GetKeyState.USER32(000000A1), ref: 0015A0F4
GetAsyncKeyState.USER32(00000011), ref: 0015A120
GetKeyState.USER32(00000011), ref: 0015A12E
GetAsyncKeyState.USER32(00000012), ref: 0015A157
GetKeyState.USER32(00000012), ref: 0015A165
GetAsyncKeyState.USER32(0000005B), ref: 0015A18E
GetKeyState.USER32(0000005B), ref: 0015A19C

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0c94470757a5d408c55132256cb40e4bad715ed28cccb4a1e6ec8d5daf60dc57
Instruction ID: d232e9a4bb53ad3567e83cb141aff2a7c7f414f08c9832890c18276ab03226ab
Opcode Fuzzy Hash: 0c94470757a5d408c55132256cb40e4bad715ed28cccb4a1e6ec8d5daf60dc57
Instruction Fuzzy Hash: B351EA30548788A9FB35DB7084507EABFB45F12341F48469ADDD25F1C2DB64AA4CC7A3

Function 00155CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00155CE2
GetWindowRect.USER32(00000000,?), ref: 00155CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00155D59
GetDlgItem.USER32(?,00000002), ref: 00155D69
GetWindowRect.USER32(00000000,?), ref: 00155D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00155DCF
GetDlgItem.USER32(?,000003E9), ref: 00155DDD
GetWindowRect.USER32(00000000,?), ref: 00155DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00155E31
GetDlgItem.USER32(?,000003EA), ref: 00155E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00155E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00155E67

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: a31240a4a8fd701be6e55b3c0f53478106987ab15fb00075c42fefc253971795
Instruction ID: 70497a96001d24f6b88e05c7b00041e20e598dff99cc8c93f9ced593a8315e8e
Opcode Fuzzy Hash: a31240a4a8fd701be6e55b3c0f53478106987ab15fb00075c42fefc253971795
Instruction Fuzzy Hash: E2510F71A00605AFDF18CFA8DD99AAEBBB6FF48301F148129F915E6690D7709E44CB60

Function 00108BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00108F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00108BE8,?,00000000,?,?,?,?,00108BBA,00000000,?), ref: 00108FC5

DestroyWindow.USER32(?), ref: 00108C81
KillTimer.USER32(00000000,?,?,?,?,00108BBA,00000000,?), ref: 00108D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00146973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00108BBA,00000000,?), ref: 001469A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00108BBA,00000000,?), ref: 001469B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00108BBA,00000000), ref: 001469D4
DeleteObject.GDI32(00000000), ref: 001469E6

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 2b461da019976d99cfa7c2e5afeae4e7c6a54106ac55361e51a4c3040325d727
Instruction ID: c50101611227abb91061a0841a6d3f92899fc73fe34dddeea0ecc26a26664d40
Opcode Fuzzy Hash: 2b461da019976d99cfa7c2e5afeae4e7c6a54106ac55361e51a4c3040325d727
Instruction Fuzzy Hash: 03616A30506600EFEB259F24DA58B65BBB1FB5231AF24451CE0C2979B1CBB1E9D0DFA1

Function 00109838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00109944: GetWindowLongW.USER32(?,000000EB), ref: 00109952

GetSysColor.USER32(0000000F), ref: 00109862

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 5fb152ba81de031c831fefd05228f5bf9475d3ec871a639eac9ed52642aa75a3
Instruction ID: 645f1adfe810042e238e96fd33453c4fac9fd21b4969d57753f69a20ac7a6ea6
Opcode Fuzzy Hash: 5fb152ba81de031c831fefd05228f5bf9475d3ec871a639eac9ed52642aa75a3
Instruction Fuzzy Hash: 03419371104648AFDB205F389CA8BB93B65AB46330F148616F9E28B2F3D7719D81DB60

Function 001596E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0013F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00159717
LoadStringW.USER32(00000000,?,0013F7F8,00000001), ref: 00159720

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0013F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00159742
LoadStringW.USER32(00000000,?,0013F7F8,00000001), ref: 00159745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00159866

Strings

Line %d:, xrefs: 001597A0
%s (%d) : ==> %s: %s %s, xrefs: 0015984A
Error: , xrefs: 0015981D
^ ERROR, xrefs: 001597FB
Line %d (File "%s"):, xrefs: 0015978F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 53d28bd0c06ea08dd24156e953ccae209ee7b2863e74bfebf59937e98b23c687
Instruction ID: 6f6abad1d41600a062d62b088849761993a8d2d9da637b7db99281a0f916afce
Opcode Fuzzy Hash: 53d28bd0c06ea08dd24156e953ccae209ee7b2863e74bfebf59937e98b23c687
Instruction Fuzzy Hash: C6415A7280021DAACB04EBE0CE86EFEB778AF64341F500025F60576492EB756F49DBA1

Function 001506DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 000F6B57: _wcslen.LIBCMT ref: 000F6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 001507A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 001507BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 001507DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00150804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0015082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00150837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0015083C

Strings

\IPC$, xrefs: 00150784
SOFTWARE\Classes\, xrefs: 0015070E
\CLSID, xrefs: 00150724

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 070f30ca968bec25821167b6b791f71727ef172d66a0014d968261582680a123
Instruction ID: 7a933d7348e717e2c73c92b78ccfa84d8bd0a55754529262401f1a7a84d7d951
Opcode Fuzzy Hash: 070f30ca968bec25821167b6b791f71727ef172d66a0014d968261582680a123
Instruction Fuzzy Hash: 3B410572D1022DEBDF12EBA4DC85DEDB778BF08390B044129E915A7161EB709E44DBA0

Function 00183F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0018403B
CreateCompatibleDC.GDI32(00000000), ref: 00184042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00184055
SelectObject.GDI32(00000000,00000000), ref: 0018405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00184068
DeleteDC.GDI32(00000000), ref: 00184072
GetWindowLongW.USER32(?,000000EC), ref: 0018407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00184092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 0018409E

Strings

static, xrefs: 00183FD3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 33242b565106c6f0048e3719d964e77a65798e8e63e9b6cfe1f28e3d53ba70f8
Instruction ID: 250235267d869fdc72a7798d04850756935494945d55a8a68ca8c0e065593774
Opcode Fuzzy Hash: 33242b565106c6f0048e3719d964e77a65798e8e63e9b6cfe1f28e3d53ba70f8
Instruction Fuzzy Hash: F1315C32501216ABDF21AFA4DC49FDB3B69EF0D724F110211FA14A65A0DB75DA50DFA0

Function 00173C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00173C5C
CoInitialize.OLE32(00000000), ref: 00173C8A
CoUninitialize.OLE32 ref: 00173C94
_wcslen.LIBCMT ref: 00173D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00173DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00173ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00173F0E
CoGetObject.OLE32(?,00000000,0018FB98,?), ref: 00173F2D
SetErrorMode.KERNEL32(00000000), ref: 00173F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00173FC4
VariantClear.OLEAUT32(?), ref: 00173FD8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: c09689144ab3ad32b12d3ea017af26a197d26c140c7af65811a987ef190c03d0
Instruction ID: 8f03e890e04936a7f6503532ab607dd1491f84d1fc366943d198885e6e906404
Opcode Fuzzy Hash: c09689144ab3ad32b12d3ea017af26a197d26c140c7af65811a987ef190c03d0
Instruction Fuzzy Hash: E7C144716082059FC700DF68C88496BB7F9FF89744F10891DF99A9B211DB31EE46DBA2

Function 00167A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00167AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00167B8F
SHGetDesktopFolder.SHELL32(?), ref: 00167BA3
CoCreateInstance.OLE32(0018FD08,00000000,00000001,001B6E6C,?), ref: 00167BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00167C74
CoTaskMemFree.OLE32(?,?), ref: 00167CCC
SHBrowseForFolderW.SHELL32(?), ref: 00167D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00167D7A
CoTaskMemFree.OLE32(00000000), ref: 00167D81
CoTaskMemFree.OLE32(00000000), ref: 00167DD6
CoUninitialize.OLE32 ref: 00167DDC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: a133405327b1c379609ee2e8c75b7cb2498436a10d3392eb19f6e17a2fdf7def
Instruction ID: f30574a9e69b0506d222b6679b3f1e09d562fd82d3b6052ce7fa99838c5ea800
Opcode Fuzzy Hash: a133405327b1c379609ee2e8c75b7cb2498436a10d3392eb19f6e17a2fdf7def
Instruction Fuzzy Hash: 52C10B75A04109AFCB14DFA4C884DAEBBF9FF48304B148599E919DB762D730EE85CB90

Function 0018541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00185504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00185515
CharNextW.USER32(00000158), ref: 00185544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00185585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0018559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001855AC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: c555b25cf6c97d5ee3df3b3d32677e677401d11249096b59d517340d0280a6b5
Instruction ID: 8f9c52756366b80b096a77a1d6bb5e8daa5edd0cf4657289d62b56dc792c7f38
Opcode Fuzzy Hash: c555b25cf6c97d5ee3df3b3d32677e677401d11249096b59d517340d0280a6b5
Instruction Fuzzy Hash: 24617E74904608EBDF10AF54CC84EFE7BBAEF05765F204155F925A6291E7748B80DFA0

Function 0014FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0014FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0014FB08
VariantInit.OLEAUT32(?), ref: 0014FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0014FB3A
VariantCopy.OLEAUT32(?,?), ref: 0014FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0014FBA1
VariantClear.OLEAUT32(?), ref: 0014FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0014FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0014FBCC
VariantClear.OLEAUT32(?), ref: 0014FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0014FBE9

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: d554774535ad2544d9b1d73e2d4c64d44f1d538fbe318bd16899e0bce07edb0f
Instruction ID: 6d5c5177a82fb70335243c6cd821e43b15729b69d0ee49523681c79bdf581a2c
Opcode Fuzzy Hash: d554774535ad2544d9b1d73e2d4c64d44f1d538fbe318bd16899e0bce07edb0f
Instruction Fuzzy Hash: B5415E35A002199FCB04DF64D854DEEBBB9EF18354F008069E945A7761CB30AA86CBA0

Function 00159C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00159CA1
GetAsyncKeyState.USER32(000000A0), ref: 00159D22
GetKeyState.USER32(000000A0), ref: 00159D3D
GetAsyncKeyState.USER32(000000A1), ref: 00159D57
GetKeyState.USER32(000000A1), ref: 00159D6C
GetAsyncKeyState.USER32(00000011), ref: 00159D84
GetKeyState.USER32(00000011), ref: 00159D96
GetAsyncKeyState.USER32(00000012), ref: 00159DAE
GetKeyState.USER32(00000012), ref: 00159DC0
GetAsyncKeyState.USER32(0000005B), ref: 00159DD8
GetKeyState.USER32(0000005B), ref: 00159DEA

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: b982cfd0136bc7e1378da8ead3380a54e7459e0345c9266a884fb443549330de
Instruction ID: 29d4bef3c350888115c91e5e98aab2d0d7d5daaf060b83386b87d7fb3e4d5619
Opcode Fuzzy Hash: b982cfd0136bc7e1378da8ead3380a54e7459e0345c9266a884fb443549330de
Instruction Fuzzy Hash: 6E4197345047CAE9FF3196A488143A5BEB0AB11345F04805ADEE65E6C2E7A59ACCC7A3

Function 0017055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 001705BC
inet_addr.WSOCK32(?), ref: 0017061C
gethostbyname.WSOCK32(?), ref: 00170628
IcmpCreateFile.IPHLPAPI ref: 00170636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 001706C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 001706E5
IcmpCloseHandle.IPHLPAPI(?), ref: 001707B9
WSACleanup.WSOCK32 ref: 001707BF

Strings

Ping, xrefs: 00170676

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 0defa75e58b149b8f4cf328fe53e1399724cae043f7e538eda4ed50ab869ff9c
Instruction ID: b6c48cb46935cf5a26ae491575257f5cdab23eaf489cef7a50096c9faf4d1199
Opcode Fuzzy Hash: 0defa75e58b149b8f4cf328fe53e1399724cae043f7e538eda4ed50ab869ff9c
Instruction Fuzzy Hash: 80915935604301DFD325DF15C889B1ABBF0AB48318F15C5A9F5A98BAA2C770ED85CF91

Function 00178CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00178CF3

Part of subcall function 00158E54: _wcslen.LIBCMT ref: 00158E77

_wcslen.LIBCMT ref: 00178D4E
_wcslen.LIBCMT ref: 00178D9C
_wcslen.LIBCMT ref: 00178DDC
_wcslen.LIBCMT ref: 00178E6E

Strings

none, xrefs: 00178E65, 00178E6A
winapi, xrefs: 00178D96, 00178D9B
stdcall, xrefs: 00178DD6, 00178DDB
cdecl, xrefs: 00178D48, 00178D4D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: f4cd81ca1b3e52b289addb184f673521a4c0c38e83f2278be90888432d94d709
Instruction ID: 16175afebb85eec46f5193b77a7a2b8952cd4727d933dc42c0309eafc370204e
Opcode Fuzzy Hash: f4cd81ca1b3e52b289addb184f673521a4c0c38e83f2278be90888432d94d709
Instruction Fuzzy Hash: 4851B131A4411A9BCB24DFACC9449FEB7B5BF64724B218229E52AE72C1DF30DE40C790

Function 0017372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00173774
CoUninitialize.OLE32 ref: 0017377F
CoCreateInstance.OLE32(?,00000000,00000017,0018FB78,?), ref: 001737D9
IIDFromString.OLE32(?,?), ref: 0017384C
VariantInit.OLEAUT32(?), ref: 001738E4
VariantClear.OLEAUT32(?), ref: 00173936

Strings

Failed to create object, xrefs: 001737E4, 0017389A
Invalid parameter, xrefs: 00173865
NULL Pointer assignment, xrefs: 0017381E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 916237e6885b119468ac5d093f76be34470d2e7187fe96fc1ac8b243e2e51b18
Instruction ID: 31cb7e7c7c586757bd238e0252835a27082374d6585205fa5860724201005d20
Opcode Fuzzy Hash: 916237e6885b119468ac5d093f76be34470d2e7187fe96fc1ac8b243e2e51b18
Instruction Fuzzy Hash: F561B170608301AFD315DF54C889FAAB7F4EF49710F008909F9999B291C770EE88DBA2

Function 00163388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 001633CF

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 001633F0

Strings

^ ERROR , xrefs: 0016349E
Error: , xrefs: 001634D1
Incorrect parameters to object property !, xrefs: 001634AB
"%s" (%d) : ==> %s:%s%s, xrefs: 00163504
Line %d (File "%s"):, xrefs: 00163443, 0016345C
"%s" (%d) : ==> %s:, xrefs: 00163522

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 5b02ba885df84ea3699877d22d8f0ac10c96751f2cfa700d9b77d906259014e4
Instruction ID: 59a9f8ec39f6e892fc4aaaa205097aaa5ce32a95ef2caf30f7c50b6d97075123
Opcode Fuzzy Hash: 5b02ba885df84ea3699877d22d8f0ac10c96751f2cfa700d9b77d906259014e4
Instruction Fuzzy Hash: 1C518C72900209AADF15EBA0CD42EFEB7B8EF14340F144065F615724A2EB356F98EB61

Function 0015B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0015B5FC
_wcslen.LIBCMT ref: 0015B608
_wcslen.LIBCMT ref: 0015B64D
_wcslen.LIBCMT ref: 0015B68C
_wcslen.LIBCMT ref: 0015B6C7

Strings

APPEND, xrefs: 0015B6C1, 0015B6C6
KEYS, xrefs: 0015B647, 0015B64C
EXISTS, xrefs: 0015B686, 0015B68B
REMOVE, xrefs: 0015B602, 0015B607

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 71dbcb6809f223651e5a6be52914e5f905bc803caeb4c29fa7ed841023ebb7a8
Instruction ID: 5dc47c9a392b1779755c3e4419e0e903ed76be3b7d31c7efbf45da043ff9133f
Opcode Fuzzy Hash: 71dbcb6809f223651e5a6be52914e5f905bc803caeb4c29fa7ed841023ebb7a8
Instruction Fuzzy Hash: 3F41E432A08026DBCB205F7DC9D05BEB7A5AFA4B59B254129EC31DF284E735CD85C790

Function 00165393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001653A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00165416
GetLastError.KERNEL32 ref: 00165420
SetErrorMode.KERNEL32(00000000,READY), ref: 001654A7

Strings

UNKNOWN, xrefs: 00165444
READY, xrefs: 00165460, 00165468
READONLY, xrefs: 00165452
INVALID, xrefs: 00165459
NOTREADY, xrefs: 0016544B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 6f2376bfc73995728bd47ee544870f3d0735821cda1269ac4d5d61a12c551b3d
Instruction ID: 1159f0f438f22888de95c33b381628e5cfe16c51e5eb62d6bce580c6f944c78e
Opcode Fuzzy Hash: 6f2376bfc73995728bd47ee544870f3d0735821cda1269ac4d5d61a12c551b3d
Instruction Fuzzy Hash: DD31C135A00608DFC710DF68C884BEABBB5FF14305F1480A5E905DB292EB71DD96CBA0

Function 00183C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00183C79
SetMenu.USER32(?,00000000), ref: 00183C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00183D10
IsMenu.USER32(?), ref: 00183D24
CreatePopupMenu.USER32 ref: 00183D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00183D5B
DrawMenuBar.USER32 ref: 00183D63

Strings

0, xrefs: 00183C54
F, xrefs: 00183D4E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 4c4b5055048ed798e6f629e35b4bba035cc579ce0c42e64483c294fd8d405fbe
Instruction ID: 2b67047b6e113740b113f449cd6a54855ae1ecac5fd18fa8fcd30de556707cb9
Opcode Fuzzy Hash: 4c4b5055048ed798e6f629e35b4bba035cc579ce0c42e64483c294fd8d405fbe
Instruction Fuzzy Hash: 12418979A01209AFDF14DFA4E844EEA7BB5FF49310F184129F916A7360D730AA10CFA0

Function 00151EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 00153CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00153CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00151F64
GetDlgCtrlID.USER32 ref: 00151F6F
GetParent.USER32 ref: 00151F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00151F8E
GetDlgCtrlID.USER32(?), ref: 00151F97
GetParent.USER32(?), ref: 00151FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00151FAE

Strings

ListBox, xrefs: 00151F21
ComboBox, xrefs: 00151EEC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 4ca1a80942e36eb31d73e34a117698dee4991bb4cc7da0414ccc6a03627fc2fd
Instruction ID: b50cb4b4054deaec882e5f3ad0529978f6e3c6c357245d31b0bf8857de9f4ccd
Opcode Fuzzy Hash: 4ca1a80942e36eb31d73e34a117698dee4991bb4cc7da0414ccc6a03627fc2fd
Instruction Fuzzy Hash: 6521BE70900218BBCF05AFA0DC85AFEBBB9EF15350B100116F961AB2A1DB75594D9BB0

Function 00151FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 00153CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00153CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00152043
GetDlgCtrlID.USER32 ref: 0015204E
GetParent.USER32 ref: 0015206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0015206D
GetDlgCtrlID.USER32(?), ref: 00152076
GetParent.USER32(?), ref: 0015208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0015208D

Strings

ListBox, xrefs: 00152002
ComboBox, xrefs: 00151FCD

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 821e64cc5f16ff4be0a10d75e885769992de4a57df3297c2f78ae04ac66fdcad
Instruction ID: 3f6938877cc2879ad3555cc2f249ce0676f113aa636a414ad033848223915164
Opcode Fuzzy Hash: 821e64cc5f16ff4be0a10d75e885769992de4a57df3297c2f78ae04ac66fdcad
Instruction Fuzzy Hash: DE21D471A00218BBCF14AFA0CC85EFEBBB9EF15340F100016F961A72A1DB754959DBB0

Function 00183A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00183A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00183AA0
GetWindowLongW.USER32(?,000000F0), ref: 00183AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00183AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00183B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00183BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00183BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00183BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00183BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00183C13

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: b57beb918d7b708e1b020423878e54f156fd7049d848e6ae003baf8f485857ef
Instruction ID: fd9b4207a74cfcb71cb5b10f88492de75b738df7aacf1d6715c856af36f06851
Opcode Fuzzy Hash: b57beb918d7b708e1b020423878e54f156fd7049d848e6ae003baf8f485857ef
Instruction Fuzzy Hash: 14616D75900248AFDB10DFA8CC81EEE77B8EF09704F14419AFA15A7292D774AE85DF50

Function 0015B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0015B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0015A1E1,?,00000001), ref: 0015B165
GetWindowThreadProcessId.USER32(00000000), ref: 0015B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0015A1E1,?,00000001), ref: 0015B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0015B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0015A1E1,?,00000001), ref: 0015B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0015A1E1,?,00000001), ref: 0015B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0015A1E1,?,00000001), ref: 0015B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0015A1E1,?,00000001), ref: 0015B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0015A1E1,?,00000001), ref: 0015B21D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 8cd6cda21926c9ef43ecef66807bbd34c1bfed560d562a11f28cc93fd1915e5f
Instruction ID: ad91f76e41ecc57a4d74ae8fd41a6187bb6eff2d5fb9e2d005e4b86716e3d6d7
Opcode Fuzzy Hash: 8cd6cda21926c9ef43ecef66807bbd34c1bfed560d562a11f28cc93fd1915e5f
Instruction Fuzzy Hash: 49315076508604EFDB109F64ECC8FADBBA9BB51312F108115FD25DA690E7B4EA848F70

Function 00122C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00122C94

Part of subcall function 001229C8: HeapFree.KERNEL32(00000000,00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000), ref: 001229DE
Part of subcall function 001229C8: GetLastError.KERNEL32(00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000,00000000), ref: 001229F0

_free.LIBCMT ref: 00122CA0
_free.LIBCMT ref: 00122CAB
_free.LIBCMT ref: 00122CB6
_free.LIBCMT ref: 00122CC1
_free.LIBCMT ref: 00122CCC
_free.LIBCMT ref: 00122CD7
_free.LIBCMT ref: 00122CE2
_free.LIBCMT ref: 00122CED
_free.LIBCMT ref: 00122CFB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1d5e95304fc2eee2a107cdb2145d9035b5772626c9d8491f20e0991e0bf97526
Instruction ID: 5c57e5e54de7f69c406bff9b0cb0ad3a6a8f190bc3ef47ff0dccb2a08f652893
Opcode Fuzzy Hash: 1d5e95304fc2eee2a107cdb2145d9035b5772626c9d8491f20e0991e0bf97526
Instruction Fuzzy Hash: EF116676500128BFCF02EF54E942CDD3BA5FF19354F9145A5F9485B222D731EAA09B90

Function 000F1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 000F1459
OleUninitialize.OLE32(?,00000000), ref: 000F14F8
UnregisterHotKey.USER32(?), ref: 000F16DD
DestroyWindow.USER32(?), ref: 001324B9
FreeLibrary.KERNEL32(?), ref: 0013251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0013254B

Strings

close all, xrefs: 000F1454

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: d54f85deb1c11797ca806bb89c1e9030902ef597e968e418903a039971914759
Instruction ID: 2c910deccf404964eec33e1e6fc3dcc7287802d3ccec20eb2278c1fc04eed87a
Opcode Fuzzy Hash: d54f85deb1c11797ca806bb89c1e9030902ef597e968e418903a039971914759
Instruction Fuzzy Hash: A4D16D31701212CFCB29EF15D899AB9F7A0BF05700F1541ADE94AABA52DB30AD12DF90

Function 00167DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00167FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00167FC1
GetFileAttributesW.KERNEL32(?), ref: 00167FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00168005
SetCurrentDirectoryW.KERNEL32(?), ref: 00168017
SetCurrentDirectoryW.KERNEL32(?), ref: 00168060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 001680B0

Strings

*.*, xrefs: 00168066

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 279d41a494d8308fcce81b6bae90e775b803c859a8ebaaca30ad8318b15d71c8
Instruction ID: 43f3b77f54b5b58a11fe5ed2a4847d3b97b2d947420defeb232259e999b47836
Opcode Fuzzy Hash: 279d41a494d8308fcce81b6bae90e775b803c859a8ebaaca30ad8318b15d71c8
Instruction Fuzzy Hash: 3081B1725082059BCB24EF54C8449BAB3E9BF88314F144D6EF885C7291EB36DD59CB92

Function 000F5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 000F5C7A

Part of subcall function 000F5D0A: GetClientRect.USER32(?,?), ref: 000F5D30
Part of subcall function 000F5D0A: GetWindowRect.USER32(?,?), ref: 000F5D71
Part of subcall function 000F5D0A: ScreenToClient.USER32(?,?), ref: 000F5D99

GetDC.USER32 ref: 001346F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00134708
SelectObject.GDI32(00000000,00000000), ref: 00134716
SelectObject.GDI32(00000000,00000000), ref: 0013472B
ReleaseDC.USER32(?,00000000), ref: 00134733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 001347C4

Strings

U, xrefs: 00134693

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 161f096ab45d1ccb48fb9723a0a17b6e59e7d83d3ef28dc15902c049e370f963
Instruction ID: 55180dfad7ed6ad84ad731801fc3a4fe8c00110cadbd0daf2abb9b68045adb81
Opcode Fuzzy Hash: 161f096ab45d1ccb48fb9723a0a17b6e59e7d83d3ef28dc15902c049e370f963
Instruction Fuzzy Hash: 3B71E035400209DFCF25CF64CD85ABA7FB5FF4A365F144269EE565A2A6C330A881DFA0

Function 0016359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 001635E4

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

LoadStringW.USER32(001C2390,?,00000FFF,?), ref: 0016360A

Strings

Error: , xrefs: 001636EF
"%s" (%d) : ==> %s:%s%s, xrefs: 00163724
^ ERROR, xrefs: 001636C9
Line %d (File "%s"):, xrefs: 0016366B
"%s" (%d) : ==> %s:, xrefs: 00163742

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: c555eaeea69d75d94052f96040405b55c5a4c28137bff17c534e0f4580fcbd1d
Instruction ID: c3152defcfb06eeb8c73b6e880a56fac0b7d3e9dedb5ab40b6a2c0405e689a44
Opcode Fuzzy Hash: c555eaeea69d75d94052f96040405b55c5a4c28137bff17c534e0f4580fcbd1d
Instruction Fuzzy Hash: 39518A71800219BADF15EBA0CC42EEEBB78AF14350F044125F615725A2EB315B99EFA1

Function 0016C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0016C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0016C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0016C2CA
GetLastError.KERNEL32 ref: 0016C322
SetEvent.KERNEL32(?), ref: 0016C336
InternetCloseHandle.WININET(00000000), ref: 0016C341

Strings

, xrefs: 0016C2BB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 4438572eeff573a2aec5daf9184f8fcdab53f647d600f7e907f893abb3fbbf70
Instruction ID: d8c98ac34ef30fc0396d315383b4591b75c0f4d5eac495b4c6fd950f11d03e7a
Opcode Fuzzy Hash: 4438572eeff573a2aec5daf9184f8fcdab53f647d600f7e907f893abb3fbbf70
Instruction Fuzzy Hash: B53167B1600208AFD7219FA49C88ABB7AFCFB59744B10851EF48A92700DB34DE549BB1

Function 0015989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00133AAF,?,?,Bad directive syntax error,0018CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 001598BC
LoadStringW.USER32(00000000,?,00133AAF,?), ref: 001598C3

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00159987

Strings

Line %d:, xrefs: 00159912
., xrefs: 0015996D
Error: , xrefs: 00159955
Line %d (File "%s"):, xrefs: 0015992D
%s (%d) : ==> %s.: %s %s, xrefs: 001598F1

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 91ab75f386db2d72e718bccb9c99afcc206911b1c43cfd34c67fb385ffdfb90b
Instruction ID: 1551e71147d2c5152d684204ee1fc9ea58160edc7a092b3cedf441d803af3be9
Opcode Fuzzy Hash: 91ab75f386db2d72e718bccb9c99afcc206911b1c43cfd34c67fb385ffdfb90b
Instruction Fuzzy Hash: 04219C3280021EEBCF16EF90CC06EFE7779BF28304F044429F615664A2EB719618DB61

Function 0015209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 001520AB
GetClassNameW.USER32(00000000,?,00000100), ref: 001520C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0015214D

Strings

SHELLDLL_DefView, xrefs: 001520CC
largeicons, xrefs: 001520E1
smallicons, xrefs: 00152115
details, xrefs: 001520FB
list, xrefs: 0015212F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: c1095624df2c154b9735a3bb0aecc3cacdd5952c8c2e4a79aeebbbf893b75739
Instruction ID: ea4f1dff36729025ba7e6a01152fe5a96364d198ae4b8eb95a078bcf2dbb5beb
Opcode Fuzzy Hash: c1095624df2c154b9735a3bb0aecc3cacdd5952c8c2e4a79aeebbbf893b75739
Instruction Fuzzy Hash: 5311E377688B06FAFB092320EC06DE7379DCF16725B210026FE15A90D2FB7168895A54

Function 00128D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0c27b9775b74c15c4f14e320945bd5ff751f584afd3919fc1e46fa20b186c9
Instruction ID: f87d234c3246c9854109a305edfb000123434ba47c8d230d5e6eab0ab74b52c5
Opcode Fuzzy Hash: 8e0c27b9775b74c15c4f14e320945bd5ff751f584afd3919fc1e46fa20b186c9
Instruction Fuzzy Hash: 51C1F175E04269AFDF15DFACE841BADBBB4BF19310F044099F815A7392CB309992CB64

Function 0012CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0012CEB7
_free.LIBCMT ref: 0012CF22
_free.LIBCMT ref: 0012CF48
_free.LIBCMT ref: 0012CF71
_free.LIBCMT ref: 0012CFA9
_free.LIBCMT ref: 0012CFDA
_free.LIBCMT ref: 0012D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0012D09C
_free.LIBCMT ref: 0012D0B5

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 0a6d5cff5135514c34935a14acaf47e0d7eafc5fa5d3eaeeb26efe8daa457067
Instruction ID: 3050cd66edd3e7db123c6b2f16c73606e666f993f427e0ecb0a07fb90800e0e5
Opcode Fuzzy Hash: 0a6d5cff5135514c34935a14acaf47e0d7eafc5fa5d3eaeeb26efe8daa457067
Instruction Fuzzy Hash: 69613471A04330ABDF25AFB4FD81A7E7BA5AF19310F04026DFA4597281E7319A6187D0

Function 001850D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00185186
ShowWindow.USER32(?,00000000), ref: 001851C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 001851CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 001851D1

Part of subcall function 00186FBA: DeleteObject.GDI32(00000000), ref: 00186FE6

GetWindowLongW.USER32(?,000000F0), ref: 0018520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0018521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0018524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00185287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00185296

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: e4e3048c26bb7848c835cd7a967965348a798f22007eace6cb96e96f63f4aef8
Instruction ID: b42147d0f915cbb5b0518fa7802ab9386044963fe8ea43d2cc83a369e17cd5ce
Opcode Fuzzy Hash: e4e3048c26bb7848c835cd7a967965348a798f22007eace6cb96e96f63f4aef8
Instruction Fuzzy Hash: D7519F30A50A08FEEF24AF24CC4ABD93B67FB05365F244011F615962E1CB75AB90DF51

Function 00108B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00146890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 001468A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 001468B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 001468D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 001468F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00108874,00000000,00000000,00000000,000000FF,00000000), ref: 00146901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0014691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00108874,00000000,00000000,00000000,000000FF,00000000), ref: 0014692D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: d584be678437d0bffc12376faadef8660df48ab96101b9019b5308e15d20db9b
Instruction ID: ad74394847d0c01dc6b6e0e9d8d2dcbcb01204df3204b3d31139b4879daee645
Opcode Fuzzy Hash: d584be678437d0bffc12376faadef8660df48ab96101b9019b5308e15d20db9b
Instruction Fuzzy Hash: C7517870600209EFDB24CF24CC95FAA7BB5FB59764F104528F992976E0DBB0EA90DB50

Function 0016C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0016C182
GetLastError.KERNEL32 ref: 0016C195
SetEvent.KERNEL32(?), ref: 0016C1A9

Part of subcall function 0016C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0016C272
Part of subcall function 0016C253: GetLastError.KERNEL32 ref: 0016C322
Part of subcall function 0016C253: SetEvent.KERNEL32(?), ref: 0016C336
Part of subcall function 0016C253: InternetCloseHandle.WININET(00000000), ref: 0016C341

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 784d04ab934fb5afae5973b70a332bfdb79a6d102b1254f01a8cead48f77195b
Instruction ID: f1d8016261e4274d902f3edc7d69b865c35c570f380310d9a9122c52a79cba09
Opcode Fuzzy Hash: 784d04ab934fb5afae5973b70a332bfdb79a6d102b1254f01a8cead48f77195b
Instruction Fuzzy Hash: 56318B71200605EFDB219FA5DC54A77BBF9FF29300B04842EF99A82A10D731E9649BE0

Function 001525A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00153A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00153A57
Part of subcall function 00153A3D: GetCurrentThreadId.KERNEL32 ref: 00153A5E
Part of subcall function 00153A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001525B3), ref: 00153A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 001525BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 001525DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 001525DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 001525E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00152601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00152605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0015260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00152623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00152627

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 8b4907febf25d1ec1b18a8e369f62e15c2bfd59dc7e241f3dbcf53937ecb2249
Instruction ID: 58a16c88f186ceddd1f623b9568f8cb5a0787c9ef71b098f16c430ce8ef7f088
Opcode Fuzzy Hash: 8b4907febf25d1ec1b18a8e369f62e15c2bfd59dc7e241f3dbcf53937ecb2249
Instruction Fuzzy Hash: 3C01B531290210FBFB1067689C8EF993F59DB5AB52F100011F724AF1D5C9F115888AB9

Function 00151803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00151449,?,?,00000000), ref: 0015180C
HeapAlloc.KERNEL32(00000000,?,00151449,?,?,00000000), ref: 00151813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00151449,?,?,00000000), ref: 00151828
GetCurrentProcess.KERNEL32(?,00000000,?,00151449,?,?,00000000), ref: 00151830
DuplicateHandle.KERNEL32(00000000,?,00151449,?,?,00000000), ref: 00151833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00151449,?,?,00000000), ref: 00151843
GetCurrentProcess.KERNEL32(00151449,00000000,?,00151449,?,?,00000000), ref: 0015184B
DuplicateHandle.KERNEL32(00000000,?,00151449,?,?,00000000), ref: 0015184E
CreateThread.KERNEL32(00000000,00000000,00151874,00000000,00000000,00000000), ref: 00151868

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 66ccb08de796eb556c4d897c854bf79cc33f06be7f0b58e718e1bead0b6af2f1
Instruction ID: dd8d4dba958235c76516d6cc798ed0808715928bcb4327a0c0a27f26505494ea
Opcode Fuzzy Hash: 66ccb08de796eb556c4d897c854bf79cc33f06be7f0b58e718e1bead0b6af2f1
Instruction Fuzzy Hash: 6601BBB5240308FFE710ABA5DC8DF6B3BACEB89B11F004411FA05DB6A1DA719940CB70

Function 0017A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0015D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0015D501
Part of subcall function 0015D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0015D50F
Part of subcall function 0015D4DC: CloseHandle.KERNEL32(00000000), ref: 0015D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0017A16D
GetLastError.KERNEL32 ref: 0017A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0017A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0017A268
GetLastError.KERNEL32(00000000), ref: 0017A273
CloseHandle.KERNEL32(00000000), ref: 0017A2C4

Strings

SeDebugPrivilege, xrefs: 0017A18F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 60e6f64e0e2feaf2f61bf1a2053fa0d7ff54d2d8ff94ebc33900fbb83b8537ca
Instruction ID: 182fc03f58a02b674f03a427412afed3d15410b73675bc19b634d2a84e4731b6
Opcode Fuzzy Hash: 60e6f64e0e2feaf2f61bf1a2053fa0d7ff54d2d8ff94ebc33900fbb83b8537ca
Instruction Fuzzy Hash: AB61B130204242AFE310DF14C494F69BBE1AF94318F54C49CE46A4BBA3C776ED89CB92

Function 00183886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00183925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0018393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00183954
_wcslen.LIBCMT ref: 00183999
SendMessageW.USER32(?,00001057,00000000,?), ref: 001839C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 001839F4

Strings

SysListView32, xrefs: 001838F7

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: ce33c44f2a08cd8dc780b5654ba8149125e43663f8ed68d5ff8b8aa61d3d1452
Instruction ID: 91976a75c241708ceb103de9b0f3b7175485d57ec4fffe75dbfbd4d6c1ad5cd3
Opcode Fuzzy Hash: ce33c44f2a08cd8dc780b5654ba8149125e43663f8ed68d5ff8b8aa61d3d1452
Instruction Fuzzy Hash: C841A371A00218ABDF21AF64CC49FEA7BA9EF18754F140526F958E7281D771DB84CF90

Function 0015BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0015BCFD
IsMenu.USER32(00000000), ref: 0015BD1D
CreatePopupMenu.USER32 ref: 0015BD53
GetMenuItemCount.USER32(01285CC0), ref: 0015BDA4
InsertMenuItemW.USER32(01285CC0,?,00000001,00000030), ref: 0015BDCC

Strings

0, xrefs: 0015BCA8
2, xrefs: 0015BD37

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: ca0703a5342728df2ae5ee39449050d6b285601ccfac7499175258c16a4c57e2
Instruction ID: 1bca8cc0efeab824b2c44ebe208271fd379081985a1c151f9a5c6a6481c2f9d3
Opcode Fuzzy Hash: ca0703a5342728df2ae5ee39449050d6b285601ccfac7499175258c16a4c57e2
Instruction Fuzzy Hash: 1D519D70A08209DBDF14CFE8D8C4BAEBBF4AF5531AF144119EC219B290D7709949CB61

Function 0015C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0015C913

Strings

info, xrefs: 0015C8B4
blank, xrefs: 0015C895
stop, xrefs: 0015C8E4
warning, xrefs: 0015C8FC
question, xrefs: 0015C8CC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 9e65a3e153562eb078a9e2b52ebec2ceb6ea0527d7053da768130e5cf295d8d4
Instruction ID: ef0b869099598aaacf4ff8c06851a2c50f0df071d76c8331187d5c3db8cbca49
Opcode Fuzzy Hash: 9e65a3e153562eb078a9e2b52ebec2ceb6ea0527d7053da768130e5cf295d8d4
Instruction Fuzzy Hash: 88112B32689306FEE7085F54EC83CEA779CDF2571AB21003EF910AA2C2DB745E4452E4

Function 0015DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0015DE42
gethostname.WSOCK32(?,00000100), ref: 0015DE5C
gethostbyname.WSOCK32(?), ref: 0015DE69
inet_ntoa.WSOCK32(?), ref: 0015DEAB
_strcat.LIBCMT ref: 0015DEB9
WSACleanup.WSOCK32 ref: 0015DEDE

Strings

0.0.0.0, xrefs: 0015DE87

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: d1a8aaf884283af7d744d18f22a4015cbc5aa0de7aca51a051fdab328add9fff
Instruction ID: 3d9021ee8290c8edc7844c023a5dfb4332341a7af91035e3d1486c07880e7379
Opcode Fuzzy Hash: d1a8aaf884283af7d744d18f22a4015cbc5aa0de7aca51a051fdab328add9fff
Instruction Fuzzy Hash: B611E731904119EFDB34AB20AC0BEDE77ACDB25712F010179F955AA091EF718AC58BA0

Function 00189F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00109BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00109BB2

GetSystemMetrics.USER32(0000000F), ref: 00189FC7
GetSystemMetrics.USER32(0000000F), ref: 00189FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0018A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0018A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0018A263
ShowWindow.USER32(00000003,00000000), ref: 0018A282
InvalidateRect.USER32(?,00000000,00000001), ref: 0018A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 0018A2CA

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 69acdcc9c28ad187e40f25ae8e978213f1e0431d93189d10dd09748ba4b3dacf
Instruction ID: 93ee61159d4a4bffb726106bcb542836e585469d512890fc7e3eaedc3a9e47f7
Opcode Fuzzy Hash: 69acdcc9c28ad187e40f25ae8e978213f1e0431d93189d10dd09748ba4b3dacf
Instruction Fuzzy Hash: 3CB19C31600215EFEF24DF68C989BAE7BB2FF44701F59806AEC459B295D731AA40CF61

Function 0015ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0015ED2A
_wcslen.LIBCMT ref: 0015ED3B
_wcslen.LIBCMT ref: 0015ED79
_wcslen.LIBCMT ref: 0015EDAF
_wcslen.LIBCMT ref: 0015EDDF
_wcslen.LIBCMT ref: 0015EDEF
_wcslen.LIBCMT ref: 0015EE2B
_wcslen.LIBCMT ref: 0015EE5A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 75d8992b8e2c98298385d7fc32fcd467d15999830b54ce5ba64a59867ed54280
Instruction ID: d22c3a03121d9f43e4061b37c3a521e7ada30803814886d3fa9ad4afc059c239
Opcode Fuzzy Hash: 75d8992b8e2c98298385d7fc32fcd467d15999830b54ce5ba64a59867ed54280
Instruction Fuzzy Hash: F0418565C10118B6CB15EBF4888A9DFB7B8EF55710F508572E924E3122FB34D395C3A5

Function 0010F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0014682C,00000004,00000000,00000000), ref: 0010F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0014682C,00000004,00000000,00000000), ref: 0014F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0014682C,00000004,00000000,00000000), ref: 0014F454

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 7fe4217b91ae4882d6b6d70f997254bd9f6763a35d08f512f2c26a54a9ccca79
Instruction ID: c1a91ee1966d080f9f5d067f4e74c21e45664668157dd638e74b4aa1c9f82bb7
Opcode Fuzzy Hash: 7fe4217b91ae4882d6b6d70f997254bd9f6763a35d08f512f2c26a54a9ccca79
Instruction Fuzzy Hash: A1412C31208640BAC7388F29D889B2A7B92BB9A318F15403DF0C752EF1C7B1A983C751

Function 00182D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00182D1B
GetDC.USER32(00000000), ref: 00182D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00182D2E
ReleaseDC.USER32(00000000,00000000), ref: 00182D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00182D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00182D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00185A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00182DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00182DE1

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: acadffcff62240dd27baeaad1bc042da3079e59d5317d2e2c31e826ee5c9afac
Instruction ID: b1b337fbfa2095ef78d28a12c8878e9d8b19ed6f9b644924e621934da38dccaf
Opcode Fuzzy Hash: acadffcff62240dd27baeaad1bc042da3079e59d5317d2e2c31e826ee5c9afac
Instruction Fuzzy Hash: 37319A76201214BFEB218F50DC8AFEB3FA9EF09751F044065FE089A291D6759D80CBB0

Function 00155622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00155637
_memcmp.LIBVCRUNTIME ref: 00155659
_memcmp.LIBVCRUNTIME ref: 00155671
_memcmp.LIBVCRUNTIME ref: 00155684
_memcmp.LIBVCRUNTIME ref: 0015569E
_memcmp.LIBVCRUNTIME ref: 001556B1
_memcmp.LIBVCRUNTIME ref: 001556C9
_memcmp.LIBVCRUNTIME ref: 001556E4

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 48c2ec69b7605722669435d0c181335cfd275bde436066947cb915c5fbf54ea0
Instruction ID: 05ec2b8ba0bb17b2d606f6fced827bf2117892d3b5cdbf2a7b41168d1577e528
Opcode Fuzzy Hash: 48c2ec69b7605722669435d0c181335cfd275bde436066947cb915c5fbf54ea0
Instruction Fuzzy Hash: 0821C561641A09F7D31C65218DA2FFA735FBF24396F540034FE249E581F720EE1986A5

Function 00174FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00175007
NULL Pointer assignment, xrefs: 0017502E, 00175383

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 71217996fa692a3f6d48054c088cdbe7fdd52ef373759981cf734ecc28447fcf
Instruction ID: fc0546559f8af6b81f482c1be8238fde600053c1d90016a29fa0280cdf23e48c
Opcode Fuzzy Hash: 71217996fa692a3f6d48054c088cdbe7fdd52ef373759981cf734ecc28447fcf
Instruction Fuzzy Hash: 57D1B575A0060A9FDF14CF98C881BAEB7B6FF48344F14C469E919AB291D7B0DD45CBA0

Function 00131522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 001315CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00131651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001316E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 001316FB

Part of subcall function 00123820: RtlAllocateHeap.NTDLL(00000000,?,001C1444,?,0010FDF5,?,?,000FA976,00000010,001C1440,000F13FC,?,000F13C6,?,000F1129), ref: 00123852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00131777
__freea.LIBCMT ref: 001317A2
__freea.LIBCMT ref: 001317AE

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: ff22acc8a258d9284b154a33c3220b8d25ca8f08da7ae65de5d421f4051a782b
Instruction ID: 894214bfd54694f4f9b642c859ba8258a43d71f44babeafd9db7dd7d2071ba7b
Opcode Fuzzy Hash: ff22acc8a258d9284b154a33c3220b8d25ca8f08da7ae65de5d421f4051a782b
Instruction Fuzzy Hash: EB91B372E00216BADF258FB4CC81AEE7BB5AF59710F194669E901E7241DB35DD40CBA0

Function 00174523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00174648
VariantInit.OLEAUT32(?), ref: 00174749
VariantClear.OLEAUT32(?), ref: 00174753
VariantClear.OLEAUT32(?), ref: 001747B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0017472C
Null Object assignment in FOR..IN loop, xrefs: 001745D8, 00174706, 001747BE

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 7f8f8fa2ed6dfca59ae6327584ee4db8915dd1081b4e8c9444e3423a9ba1238e
Instruction ID: 2661f3f4ee08e9365f2f646856108f1123d21acb369290c4360bc110e822c91e
Opcode Fuzzy Hash: 7f8f8fa2ed6dfca59ae6327584ee4db8915dd1081b4e8c9444e3423a9ba1238e
Instruction Fuzzy Hash: B0918E71A00219ABDF28CFA5D885FEEBBB8EF46710F10C559F519AB280D7709941CFA0

Function 00161187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0016125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00161284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 001612A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 001612D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0016135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 001613C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00161430

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 5000ea23f52d53e0a7c6e4425fa27eb7b6cf296b30e5ff754d7f9129e70412f1
Instruction ID: b69b8c38bda3605b93d486949efa4d4ac29f431285b15b0f07bfe4477ddfdc19
Opcode Fuzzy Hash: 5000ea23f52d53e0a7c6e4425fa27eb7b6cf296b30e5ff754d7f9129e70412f1
Instruction Fuzzy Hash: 5A91F472A00208AFDB01DFA4CC95BFEB7B5FF44311F294029E901E7291DB74A951CB90

Function 0010948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 653bbe3f50a263e99079ea2346b592a17a106d060a765d62519167517d0e7347
Instruction ID: 4af704bbfd3b63d87bcb6ed64425705abcf9987c03597652dba63e497bc2ffca
Opcode Fuzzy Hash: 653bbe3f50a263e99079ea2346b592a17a106d060a765d62519167517d0e7347
Instruction Fuzzy Hash: 5C913A71D00219EFCB14CFA9CC84AEEBBB8FF49320F148556E555B7292D7B4AA41CB60

Function 00173947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0017396B
CharUpperBuffW.USER32(?,?), ref: 00173A7A
_wcslen.LIBCMT ref: 00173A8A
VariantClear.OLEAUT32(?), ref: 00173C1F

Part of subcall function 00160CDF: VariantInit.OLEAUT32(00000000), ref: 00160D1F
Part of subcall function 00160CDF: VariantCopy.OLEAUT32(?,?), ref: 00160D28
Part of subcall function 00160CDF: VariantClear.OLEAUT32(?), ref: 00160D34

Strings

Incorrect Parameter format, xrefs: 001739A6, 00173BA1
AUTOIT.ERROR, xrefs: 00173A80, 00173A85

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: febdabebb4304eb10f259dc1a10ebb40e9b931ce1e4fb95e6f3da6bbc1c46ff0
Instruction ID: ca0a340cdde89d8c1cf2b1d2cb4eff567568bdf7a3c3294fed2131471c52597e
Opcode Fuzzy Hash: febdabebb4304eb10f259dc1a10ebb40e9b931ce1e4fb95e6f3da6bbc1c46ff0
Instruction Fuzzy Hash: FB9144756083059FC704EF24C48196AB7F4BF89714F14886EF89A9B352DB30EE46DB92

Function 00174BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0015000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0014FF41,80070057,?,?,?,0015035E), ref: 0015002B
Part of subcall function 0015000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0014FF41,80070057,?,?), ref: 00150046
Part of subcall function 0015000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0014FF41,80070057,?,?), ref: 00150054
Part of subcall function 0015000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0014FF41,80070057,?), ref: 00150064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00174C51
_wcslen.LIBCMT ref: 00174D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00174DCF
CoTaskMemFree.OLE32(?), ref: 00174DDA

Strings

NULL Pointer assignment, xrefs: 00174E23, 00174E52

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: e2cc3d49a8ca4dfd207d81ae2e92713d65bde646ab50bcb52c662b43a605d471
Instruction ID: 916c91939ef68da5980e63d369d48591328f30923f2111e63f52e877307a40e2
Opcode Fuzzy Hash: e2cc3d49a8ca4dfd207d81ae2e92713d65bde646ab50bcb52c662b43a605d471
Instruction Fuzzy Hash: FE911671D0021DEFDF15DFA4C891AEEB7B9BF08310F108169E919AB251EB749A45CFA0

Function 001820FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00182183
GetMenuItemCount.USER32(00000000), ref: 001821B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 001821DD
_wcslen.LIBCMT ref: 00182213
GetMenuItemID.USER32(?,?), ref: 0018224D
GetSubMenu.USER32(?,?), ref: 0018225B

Part of subcall function 00153A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00153A57
Part of subcall function 00153A3D: GetCurrentThreadId.KERNEL32 ref: 00153A5E
Part of subcall function 00153A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001525B3), ref: 00153A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 001822E3

Part of subcall function 0015E97B: Sleep.KERNELBASE ref: 0015E9F3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: d910357d58e8bd54f953838bb6fed53fc5f08d7d2e33ba724ee0be3a5ded5d40
Instruction ID: 50dd4fa4d02d637f59d7b5cd1a5df9f3847d1cc0ccd0c5ce266b0997eb905ac3
Opcode Fuzzy Hash: d910357d58e8bd54f953838bb6fed53fc5f08d7d2e33ba724ee0be3a5ded5d40
Instruction Fuzzy Hash: F3718F75A00205AFCB15EFA4C885AAEB7F2FF48310F158469E916EB351D774EE418FA0

Function 00187E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01285DB0), ref: 00187F37
IsWindowEnabled.USER32(01285DB0), ref: 00187F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0018801E
SendMessageW.USER32(01285DB0,000000B0,?,?), ref: 00188051
IsDlgButtonChecked.USER32(?,?), ref: 00188089
GetWindowLongW.USER32(01285DB0,000000EC), ref: 001880AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 001880C3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 6dd505cf397dc7189eb721ced3120f67e57878f22282c61d652e6c4f19a0d092
Instruction ID: df630e514cf5d3b3cb59abacfe98346162f2a3f488184b5a508da2e78cc6e08b
Opcode Fuzzy Hash: 6dd505cf397dc7189eb721ced3120f67e57878f22282c61d652e6c4f19a0d092
Instruction Fuzzy Hash: 0E719E74608204AFEB25AF55C884FEA7BB5EF1A300F244459FA65972A1CB31EE44DF60

Function 0015AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0015AEF9
GetKeyboardState.USER32(?), ref: 0015AF0E
SetKeyboardState.USER32(?), ref: 0015AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0015AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0015AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0015AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0015B020

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: ff1dedb4b26733e3b9d93d3fba32cf5720c657c47ec5a5a039bfb3a38c56a385
Instruction ID: 2940bac8338457c5a82a17334995711842592c079b3383d549ebd404c45b48e0
Opcode Fuzzy Hash: ff1dedb4b26733e3b9d93d3fba32cf5720c657c47ec5a5a039bfb3a38c56a385
Instruction Fuzzy Hash: F851E4A06487D5BDFB3642348845BBABEA95F06305F08858AF9F5498C2D398ACCCD761

Function 0015ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0015AD19
GetKeyboardState.USER32(?), ref: 0015AD2E
SetKeyboardState.USER32(?), ref: 0015AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0015ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0015ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0015AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0015AE38

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4049874712b9398d26b5145c7f0df1ad0860760ac29226ca2ecd8424f7843837
Instruction ID: 68bce5e06c40ce6d92264219ae94c19119c3e2a8518f3ebbe569eba5b6874090
Opcode Fuzzy Hash: 4049874712b9398d26b5145c7f0df1ad0860760ac29226ca2ecd8424f7843837
Instruction Fuzzy Hash: 1A515BA15843D5BDFB3343748C46B7ABEA8AF05302F488648E4E55E8C2D394EC8CD362

Function 0012542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00133CD6,?,?,?,?,?,?,?,?,00125BA3,?,?,00133CD6,?,?), ref: 00125470
__fassign.LIBCMT ref: 001254EB
__fassign.LIBCMT ref: 00125506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00133CD6,00000005,00000000,00000000), ref: 0012552C
WriteFile.KERNEL32(?,00133CD6,00000000,00125BA3,00000000,?,?,?,?,?,?,?,?,?,00125BA3,?), ref: 0012554B
WriteFile.KERNEL32(?,?,00000001,00125BA3,00000000,?,?,?,?,?,?,?,?,?,00125BA3,?), ref: 00125584

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: d34b4ff070f3f6e4a7bb7d3e4029e92a9c45632b9f130ccdde31802fe8797d2e
Instruction ID: 71a0ea087f8ab439e433c5a02d10e85990f7a95256d48f601015cbf093558fee
Opcode Fuzzy Hash: d34b4ff070f3f6e4a7bb7d3e4029e92a9c45632b9f130ccdde31802fe8797d2e
Instruction Fuzzy Hash: 5F5108709006589FDB11CFA8EC85AEEBBFAEF09300F14411AF555E7291D730DA91CB60

Function 00112D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00112D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00112D53
_ValidateLocalCookies.LIBCMT ref: 00112DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00112E0C
_ValidateLocalCookies.LIBCMT ref: 00112E61

Strings

csm, xrefs: 00112DF6

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d40f52848d1c100f91edc515ccdc26d2f8d32541fde60d4d48e22c3d11fcb7e7
Instruction ID: 8f567aa43d0f80b0d29b3bf0df6a1ea21d7951d3fae5e63734fe2da52368093f
Opcode Fuzzy Hash: d40f52848d1c100f91edc515ccdc26d2f8d32541fde60d4d48e22c3d11fcb7e7
Instruction Fuzzy Hash: 3F41D334A00218AFCF18DFA8D845ADEBBB4BF44324F148175F9146B392D731AAA1CBD0

Function 001710B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0017304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0017307A
Part of subcall function 0017304E: _wcslen.LIBCMT ref: 0017309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00171112
WSAGetLastError.WSOCK32 ref: 00171121
WSAGetLastError.WSOCK32 ref: 001711C9
closesocket.WSOCK32(00000000), ref: 001711F9

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: e05ff712359b5251dc298ba1059dada6ea26f2a8d5e0d6abe612487440b9a7f0
Instruction ID: 11c102bbe3a2c71455c09eaa4b7d73c18a0afaf0b0d51b4f83cedc6630d0bf9c
Opcode Fuzzy Hash: e05ff712359b5251dc298ba1059dada6ea26f2a8d5e0d6abe612487440b9a7f0
Instruction Fuzzy Hash: 5141D431600608AFDB109F68C885BA9B7FAEF45324F54C059FD199F292C774AE85CBE1

Function 0015CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0015DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0015CF22,?), ref: 0015DDFD

Part of subcall function 0015DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0015CF22,?), ref: 0015DE16

lstrcmpiW.KERNEL32(?,?), ref: 0015CF45
MoveFileW.KERNEL32(?,?), ref: 0015CF7F
_wcslen.LIBCMT ref: 0015D005
_wcslen.LIBCMT ref: 0015D01B
SHFileOperationW.SHELL32(?), ref: 0015D061

Strings

\*.*, xrefs: 0015CFF3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 09706628d50574f272460e795b85313b721f52ca872fcd142e1bc72e3667f382
Instruction ID: 136902024817ab1b7c4d41bb47aa4b418ad8fae82f16e68589a6d3d2926c4366
Opcode Fuzzy Hash: 09706628d50574f272460e795b85313b721f52ca872fcd142e1bc72e3667f382
Instruction Fuzzy Hash: B8415571905218DFDF16EFA4DD81ADEB7B9AF18381F1000E6E915EB142EB34A788CB50

Function 00182DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00182E1C
GetWindowLongW.USER32(?,000000F0), ref: 00182E4F
GetWindowLongW.USER32(?,000000F0), ref: 00182E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00182EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00182EE0
GetWindowLongW.USER32(?,000000F0), ref: 00182EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00182F0B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2d3a58228a0829668bdc7c35377123fb5eb75ad8265029d60698d87b443b69df
Instruction ID: 065909004eacca40dc579503df70555be0c357f041788dce44d7e74e1c2ad504
Opcode Fuzzy Hash: 2d3a58228a0829668bdc7c35377123fb5eb75ad8265029d60698d87b443b69df
Instruction Fuzzy Hash: E3310330644250AFDB22DF58DC84FA53BE1EB9A714F250165F9018B6B2CB71EA80DF55

Function 00157726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00157769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0015778F
SysAllocString.OLEAUT32(00000000), ref: 00157792
SysAllocString.OLEAUT32(?), ref: 001577B0
SysFreeString.OLEAUT32(?), ref: 001577B9
StringFromGUID2.OLE32(?,?,00000028), ref: 001577DE
SysAllocString.OLEAUT32(?), ref: 001577EC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f802992a6551e81eab197c4543508bb29675b9f3f0525d866fbb3930ba52eb45
Instruction ID: d97aa77f498c76474b83227a5caddaf904d7636ffb1ec7fcffb01bfd260f1e75
Opcode Fuzzy Hash: f802992a6551e81eab197c4543508bb29675b9f3f0525d866fbb3930ba52eb45
Instruction Fuzzy Hash: 8821A176604219EFDB10DFA8EC89CBB73ACEB093647008025BD24DB190D770DD8587A0

Function 001577FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00157842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00157868
SysAllocString.OLEAUT32(00000000), ref: 0015786B
SysAllocString.OLEAUT32 ref: 0015788C
SysFreeString.OLEAUT32 ref: 00157895
StringFromGUID2.OLE32(?,?,00000028), ref: 001578AF
SysAllocString.OLEAUT32(?), ref: 001578BD

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 969a6efde99b79d4baee472e3cd378c9e124fab2c25f00749954f1d77cebcbf6
Instruction ID: bb339a0de3766756910a8e10e0ee0c1903593cdd776216f888de2233487eb4f4
Opcode Fuzzy Hash: 969a6efde99b79d4baee472e3cd378c9e124fab2c25f00749954f1d77cebcbf6
Instruction Fuzzy Hash: DB218E31608214EFDB109BA8EC8DDAA77ACEB093607108125B925CF6E1D770DD85CB74

Function 001604D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 001604F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0016052E

Strings

nul, xrefs: 00160567

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: a921b67de4279a9cb4f11ab0e1087aae9d5ef5f13a28ceffa2c585a858f5310a
Instruction ID: c7e3a79eae82252a32a886b26b83d01fa48193049e3502c7faa8e4256955ca0d
Opcode Fuzzy Hash: a921b67de4279a9cb4f11ab0e1087aae9d5ef5f13a28ceffa2c585a858f5310a
Instruction Fuzzy Hash: 22217F75500305AFDF219F29DC44A9B77B4BF59724F204A19F8A2D72E0E77099A0CF60

Function 001605A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 001605C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00160601

Strings

nul, xrefs: 00160639

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 15867fc8981e649bab8ebf62ad229d547d5a4221cbd57e4f5957b9e1c8c02fb6
Instruction ID: 22d80c6d820274c3c637d4c7d3696713a36fe3a8f3fc273758f7d0e56a055fed
Opcode Fuzzy Hash: 15867fc8981e649bab8ebf62ad229d547d5a4221cbd57e4f5957b9e1c8c02fb6
Instruction Fuzzy Hash: 5F2192755003159FDB219F69CC44EAB77E4BF99720F204A19F8A1E72E0E7B099B0CB60

Function 001840AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000F604C
Part of subcall function 000F600E: GetStockObject.GDI32(00000011), ref: 000F6060
Part of subcall function 000F600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 000F606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00184112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0018411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0018412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00184139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00184145

Strings

Msctls_Progress32, xrefs: 001840E3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 456d3ce3c5b80b1c7ce8939ca7358b3504a15f50fe623f9cefe9707a61369978
Instruction ID: 9f2ec0646b29543176ad02b6de0b4ef6f31bb63a2cdfe329341115af9b176f5b
Opcode Fuzzy Hash: 456d3ce3c5b80b1c7ce8939ca7358b3504a15f50fe623f9cefe9707a61369978
Instruction Fuzzy Hash: F21190B215021ABEEF119F64CC85EE77F5DEF08798F114110BA18A2190CB72DC619BA4

Function 0012D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0012D7A3: _free.LIBCMT ref: 0012D7CC

_free.LIBCMT ref: 0012D82D

Part of subcall function 001229C8: HeapFree.KERNEL32(00000000,00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000), ref: 001229DE
Part of subcall function 001229C8: GetLastError.KERNEL32(00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000,00000000), ref: 001229F0

_free.LIBCMT ref: 0012D838
_free.LIBCMT ref: 0012D843
_free.LIBCMT ref: 0012D897
_free.LIBCMT ref: 0012D8A2
_free.LIBCMT ref: 0012D8AD
_free.LIBCMT ref: 0012D8B8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 7e5b3528496bf36bdfde9f18fddd86f0eb83fa01a12e6e5ca9635f9e98989a01
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: A1112971540B24BADA21BFF0EC46FCB7B9CAF24704F800825F299A6092DB79A5658761

Function 0015DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0015DA74
LoadStringW.USER32(00000000), ref: 0015DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0015DA91
LoadStringW.USER32(00000000), ref: 0015DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0015DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0015DAB9

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 224eaec020f864662ce1b64b641ec3259e26e5c4fba410eaab2e33c9483c3fe8
Instruction ID: 6fc2a38b72e9c60c5dbb2f6bccccd08ad55a8f260a56c5b03aaffba0eee503c8
Opcode Fuzzy Hash: 224eaec020f864662ce1b64b641ec3259e26e5c4fba410eaab2e33c9483c3fe8
Instruction Fuzzy Hash: 990162F6500208BFE710ABA0DD89EE7326CE708301F4004A2B716E6441E7749E848FB5

Function 0016096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0127E7D8,0127E7D8), ref: 0016097B
EnterCriticalSection.KERNEL32(0127E7B8,00000000), ref: 0016098D
TerminateThread.KERNEL32(?,000001F6), ref: 0016099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 001609A9
CloseHandle.KERNEL32(?), ref: 001609B8
InterlockedExchange.KERNEL32(0127E7D8,000001F6), ref: 001609C8
LeaveCriticalSection.KERNEL32(0127E7B8), ref: 001609CF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 79a64b7357fbd532e64455b9d37e12a345e72e1903b7a299e67fd5b80fbe8718
Instruction ID: 55d5ce67c80575c63311d76a74469028deafe1f0a69467da4af9a7fdffea7c23
Opcode Fuzzy Hash: 79a64b7357fbd532e64455b9d37e12a345e72e1903b7a299e67fd5b80fbe8718
Instruction Fuzzy Hash: 0FF0C932442A12ABD7525BA4EE8DAD6BB2ABF05716F402025F20290CA1C77596B5CFE0

Function 000F5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 000F5D30
GetWindowRect.USER32(?,?), ref: 000F5D71
ScreenToClient.USER32(?,?), ref: 000F5D99
GetClientRect.USER32(?,?), ref: 000F5ED7
GetWindowRect.USER32(?,?), ref: 000F5EF8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 72d23e96c600b075a372ed0f91b00a3c7d4e6bd3b316d8a0fc2ddd5780559389
Instruction ID: 2db28dc6ff197dc3fbb38c6990a36fa1de8587ca96f7422cbf463e78786a77f2
Opcode Fuzzy Hash: 72d23e96c600b075a372ed0f91b00a3c7d4e6bd3b316d8a0fc2ddd5780559389
Instruction Fuzzy Hash: 42B17934A00A4ADBDB24CFA9C8807FEB7F1FF58311F14841AE9A9D7650DB34AA51DB50

Function 001201B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 001200BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001200D6
__allrem.LIBCMT ref: 001200ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0012010B
__allrem.LIBCMT ref: 00120122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00120140

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 2b7f5839a0d7e5dbb6af720f1c6ad0d59d4cc98858522e4bddd9a4eb58c927c7
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: B2815A72A00716AFE7299F28DC41BAB73E8AF55364F24423EF511D7282E7B0D9518750

Function 00171D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00173149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,0017101C,00000000,?,?,00000000), ref: 00173195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00171DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00171DE1
WSAGetLastError.WSOCK32 ref: 00171DF2
inet_ntoa.WSOCK32(?), ref: 00171E8C
htons.WSOCK32(?,?,?,?,?), ref: 00171EDB
_strlen.LIBCMT ref: 00171F35

Part of subcall function 001539E8: _strlen.LIBCMT ref: 001539F2

Part of subcall function 000F6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0010CF58,?,?,?), ref: 000F6DBA
Part of subcall function 000F6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0010CF58,?,?,?), ref: 000F6DED

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: f2fda434aeeabd53e791931cc16714db44558c1ff36ae2e688abf9320c284c2d
Instruction ID: 02a280df61c53d7d90cf732b5a022d68823c62c73b51410c7b559c04e38cc1e3
Opcode Fuzzy Hash: f2fda434aeeabd53e791931cc16714db44558c1ff36ae2e688abf9320c284c2d
Instruction Fuzzy Hash: 4FA1CF31104300AFC324DF28C895F6A77B5AF95318F54895CF59A9B2A3CB71EE86CB91

Function 001261FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,001182D9,001182D9,?,?,?,0012644F,00000001,00000001,8BE85006), ref: 00126258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0012644F,00000001,00000001,8BE85006,?,?,?), ref: 001262DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001263D8
__freea.LIBCMT ref: 001263E5

Part of subcall function 00123820: RtlAllocateHeap.NTDLL(00000000,?,001C1444,?,0010FDF5,?,?,000FA976,00000010,001C1440,000F13FC,?,000F13C6,?,000F1129), ref: 00123852

__freea.LIBCMT ref: 001263EE
__freea.LIBCMT ref: 00126413

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: dabff288e02ac5f6e277921d18daf154feba85da7b1c8a7b1b829e2ef1638660
Instruction ID: 19a10fc750306c41ebc713e16c7eae188f91fb134c1b7868f9a52aa49313f376
Opcode Fuzzy Hash: dabff288e02ac5f6e277921d18daf154feba85da7b1c8a7b1b829e2ef1638660
Instruction Fuzzy Hash: 6351D172A00226AFEB299F64EC81EAF77A9EF54750F154669FC09D61C0DB34DC60C6A0

Function 0017BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 0017C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0017B6AE,?,?), ref: 0017C9B5
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017C9F1
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017CA68
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0017BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0017BD25
RegCloseKey.ADVAPI32(00000000), ref: 0017BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0017BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0017BDF3
RegCloseKey.ADVAPI32(?), ref: 0017BDFF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: af5a36e551a937cb4a6541f27f04b82699ff3562d018b933bf106af65d67efa4
Instruction ID: f6de32d9368e8e01eb05ef1032229ea0e3ae8310c2f690db99bee5aedf1b5d5d
Opcode Fuzzy Hash: af5a36e551a937cb4a6541f27f04b82699ff3562d018b933bf106af65d67efa4
Instruction Fuzzy Hash: DC818970208241AFC714DF64C881E6ABBF5FF84348F14896CF5998B2A2DB31ED45CB92

Function 0014F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0014F7B9
SysAllocString.OLEAUT32(00000001), ref: 0014F860
VariantCopy.OLEAUT32(0014FA64,00000000), ref: 0014F889
VariantClear.OLEAUT32(0014FA64), ref: 0014F8AD
VariantCopy.OLEAUT32(0014FA64,00000000), ref: 0014F8B1
VariantClear.OLEAUT32(?), ref: 0014F8BB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 7b8d3e7643a3d11ef30c659e5cd7a1cb309cc2e0e7a0420c6cd00cfd67635456
Instruction ID: fa8ca18aab4ae73c644e00189fc15136b7b0978ecac50b20469ebaa3e1b125fc
Opcode Fuzzy Hash: 7b8d3e7643a3d11ef30c659e5cd7a1cb309cc2e0e7a0420c6cd00cfd67635456
Instruction Fuzzy Hash: 4A51D735A00310BACF28AB65D895B29B3A4EF55314F25846FF905DF3A2DB708C46C7A6

Function 0016910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 000F7620: _wcslen.LIBCMT ref: 000F7625

Part of subcall function 000F6B57: _wcslen.LIBCMT ref: 000F6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 001694E5
_wcslen.LIBCMT ref: 00169506
_wcslen.LIBCMT ref: 0016952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00169585

Strings

X, xrefs: 00169412

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 7998e3903fc644a587cb3f7ab48e230f56510236a7dced48ffc26afc96b47009
Instruction ID: ad9caaf86878364c4ed6c640965fca46b977d0290313e954f4c569cb6336c7a9
Opcode Fuzzy Hash: 7998e3903fc644a587cb3f7ab48e230f56510236a7dced48ffc26afc96b47009
Instruction Fuzzy Hash: 71E19E31608340DFC724EF24C891BAAB7E4BF85314F04896DF9899B2A2DB31DD45CB92

Function 0010920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00109BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00109BB2

BeginPaint.USER32(?,?,?), ref: 00109241
GetWindowRect.USER32(?,?), ref: 001092A5
ScreenToClient.USER32(?,?), ref: 001092C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 001092D3
EndPaint.USER32(?,?,?,?,?), ref: 00109321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 001471EA

Part of subcall function 00109339: BeginPath.GDI32(00000000), ref: 00109357

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 5c953a5fa0c77bb8b6cf856e28b1dfc0ea4dc40b60dd8a472b5691de45417430
Instruction ID: 7802b09b733c001120a83c92ed40cf5fd8fd330693f4e5081de42fbe4237d9b1
Opcode Fuzzy Hash: 5c953a5fa0c77bb8b6cf856e28b1dfc0ea4dc40b60dd8a472b5691de45417430
Instruction Fuzzy Hash: 7D419E70104200AFD721DF24CC94FBA7BB8EB56724F140629F9948B6F2C7719985DBA1

Function 001607EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0016080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00160847
EnterCriticalSection.KERNEL32(?), ref: 00160863
LeaveCriticalSection.KERNEL32(?), ref: 001608DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 001608F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00160921

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 55a947e10292075dfad86f1b094fc9e95f782ed9ab1e77d6c64326452768987c
Instruction ID: dc0c015a0ebda73c89fe220bc572fa18c2c499da5470ee5972375b6bb5f77d7c
Opcode Fuzzy Hash: 55a947e10292075dfad86f1b094fc9e95f782ed9ab1e77d6c64326452768987c
Instruction Fuzzy Hash: 87418831900205EFDF15EF54DC85AAA77B9FF08310F1040A9ED049A296DB70DEA5CBA0

Function 001881DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0014F3AB,00000000,?,?,00000000,?,0014682C,00000004,00000000,00000000), ref: 0018824C
EnableWindow.USER32(?,00000000), ref: 00188272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 001882D1
ShowWindow.USER32(?,00000004), ref: 001882E5
EnableWindow.USER32(?,00000001), ref: 0018830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0018832F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 1c7b55b33bc975db555e5909814594d4c1f39dfb0131a39a407d06e2ec83f7dc
Instruction ID: b2630589ddc023b291e4b338a659d56e9b415b3d591342e90000117d4bd82f3e
Opcode Fuzzy Hash: 1c7b55b33bc975db555e5909814594d4c1f39dfb0131a39a407d06e2ec83f7dc
Instruction Fuzzy Hash: 93419634601644AFDB22EF15D895FE47BF1BB06714F585169F9088B663CB31A981CF50

Function 00154C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00154C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00154CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00154CEA
_wcslen.LIBCMT ref: 00154D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00154D10
_wcsstr.LIBVCRUNTIME ref: 00154D1A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 3a17fde76d10ec271f0b80e66a19c973d934eb10b0248067a8a299001112200e
Instruction ID: 003a501ffb086acc360e6cb5db4cdd10531e2685290c59f3578461326e6cfeb7
Opcode Fuzzy Hash: 3a17fde76d10ec271f0b80e66a19c973d934eb10b0248067a8a299001112200e
Instruction Fuzzy Hash: 13210731204200BBEB255B65DC0AEBB7BA8DF55754F104039FC05CE191EBB1DD8583A0

Function 0016581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 000F3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000F3A97,?,?,000F2E7F,?,?,?,00000000), ref: 000F3AC2

_wcslen.LIBCMT ref: 0016587B
CoInitialize.OLE32(00000000), ref: 00165995
CoCreateInstance.OLE32(0018FCF8,00000000,00000001,0018FB68,?), ref: 001659AE
CoUninitialize.OLE32 ref: 001659CC

Strings

.lnk, xrefs: 00165876, 001658C1, 00165985

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 48803638e4633cc3e14849c546de70b2d89ef641f3012e30e44952510870f0a6
Instruction ID: cbc0cad450aed91a6e7a0baf8488f1fe07240f56259ad56e79b67119c7eb58dd
Opcode Fuzzy Hash: 48803638e4633cc3e14849c546de70b2d89ef641f3012e30e44952510870f0a6
Instruction Fuzzy Hash: 17D16271608705DFC714DF24C880A6ABBE2EF89714F14885DF88A9B362DB31ED45CB92

Function 0015175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00150FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00150FCA
Part of subcall function 00150FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00150FD6
Part of subcall function 00150FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00150FE5
Part of subcall function 00150FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00150FEC
Part of subcall function 00150FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00151002

GetLengthSid.ADVAPI32(?,00000000,00151335), ref: 001517AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 001517BA
HeapAlloc.KERNEL32(00000000), ref: 001517C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 001517DA
GetProcessHeap.KERNEL32(00000000,00000000,00151335), ref: 001517EE
HeapFree.KERNEL32(00000000), ref: 001517F5

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 1b32214a7b56fa1a5b94e01fe161d3e3a7d3adaa43017386ea70c29a64b3b23c
Instruction ID: d569bf2ddb8adec5743aadea6e4434d7c7017d47d4640101e1e88765724bda11
Opcode Fuzzy Hash: 1b32214a7b56fa1a5b94e01fe161d3e3a7d3adaa43017386ea70c29a64b3b23c
Instruction Fuzzy Hash: 8B11B232500605FFDB159FA8DC89FAF7BB9EF49356F104118F851AB210D735AA88CBA0

Function 001514CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 001514FF
OpenProcessToken.ADVAPI32(00000000), ref: 00151506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00151515
CloseHandle.KERNEL32(00000004), ref: 00151520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0015154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00151563

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 183ef738c8270ea6eb91c72144259e43742901bc17c98eb29ac5c48bca182397
Instruction ID: 93839bdcb9e92669dd824a116f8046ce91257567ae5124d1abee17cee0bcc2ca
Opcode Fuzzy Hash: 183ef738c8270ea6eb91c72144259e43742901bc17c98eb29ac5c48bca182397
Instruction Fuzzy Hash: 2A116772100209FFDB128FA8ED49FDA7BA9EB48745F044024FE15A6060D3758EA4EBA0

Function 00113382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00113379,00112FE5), ref: 00113390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0011339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001133B7
SetLastError.KERNEL32(00000000,?,00113379,00112FE5), ref: 00113409

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f4b06028d6fde942974eb859cc26059e9ae126c036926570408b9262c6398420
Instruction ID: aac62f75d19ded38c05d76c0878b39e3a1bf9f8163b48a1946361b7b605bce48
Opcode Fuzzy Hash: f4b06028d6fde942974eb859cc26059e9ae126c036926570408b9262c6398420
Instruction Fuzzy Hash: 2B012832318311BEAA1D3B747C855D62A54FB153793200339F430845F8EF114EC29598

Function 00122D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00125686,00133CD6,?,00000000,?,00125B6A,?,?,?,?,?,0011E6D1,?,001B8A48), ref: 00122D78
_free.LIBCMT ref: 00122DAB
_free.LIBCMT ref: 00122DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0011E6D1,?,001B8A48,00000010,000F4F4A,?,?,00000000,00133CD6), ref: 00122DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0011E6D1,?,001B8A48,00000010,000F4F4A,?,?,00000000,00133CD6), ref: 00122DEC
_abort.LIBCMT ref: 00122DF2

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 9cf435faff8aceda236ccec220f445f66d3f14fe662270d31367140bcfbb6226
Instruction ID: 147be4280d5a4a4eb8a6a88a9f9e9ca2c73ef2f0097aed7bc5325b5bba0612a7
Opcode Fuzzy Hash: 9cf435faff8aceda236ccec220f445f66d3f14fe662270d31367140bcfbb6226
Instruction Fuzzy Hash: 94F0C83650463477C61227B9BC06E5E2659BFE17A1F250518F824935D2EF34897252B0

Function 00188A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00109639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00109693
Part of subcall function 00109639: SelectObject.GDI32(?,00000000), ref: 001096A2
Part of subcall function 00109639: BeginPath.GDI32(?), ref: 001096B9
Part of subcall function 00109639: SelectObject.GDI32(?,00000000), ref: 001096E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00188A4E
LineTo.GDI32(?,00000003,00000000), ref: 00188A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00188A70
LineTo.GDI32(?,00000000,00000003), ref: 00188A80
EndPath.GDI32(?), ref: 00188A90
StrokePath.GDI32(?), ref: 00188AA0

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 1b5b1bddba443aed13e41eeda66ff6a401f1e42a47a0c5dea3edb6ad3a2ad6fb
Instruction ID: 28dd4a116b08331b9c1cb5bc1f9254cbecd1cdafd4b26dec7cf8f5ce7b3ec4bf
Opcode Fuzzy Hash: 1b5b1bddba443aed13e41eeda66ff6a401f1e42a47a0c5dea3edb6ad3a2ad6fb
Instruction Fuzzy Hash: C211DB7604010DFFDF129F94DC88EAA7F6DEB08394F048012BA199A5A1C7719E95DFB0

Function 001551FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00155218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00155229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00155230
ReleaseDC.USER32(00000000,00000000), ref: 00155238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0015524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00155261

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 64c782875f582111b7078d5bd3b36974f3da441b9017acd4341d87f19ee84b97
Instruction ID: 6f9f49009803e887d32b8d4468b9c1561753287bafab844d794328d633838f4b
Opcode Fuzzy Hash: 64c782875f582111b7078d5bd3b36974f3da441b9017acd4341d87f19ee84b97
Instruction Fuzzy Hash: B3018B75A00708FBEB109BB69C49A4EBFB8EF48752F144065FA04EB780DA709904CBA0

Function 000F1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 000F1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 000F1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 000F1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 000F1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 000F1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 000F1C22

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d762b6154266ed32e5ac8ac9586c4b16d52d276ba3f68d85c658ddc6110ca546
Instruction ID: 752f049f11360961aacc4195630658dcc5d08ccc41fb511c9c50b566499ed7fe
Opcode Fuzzy Hash: d762b6154266ed32e5ac8ac9586c4b16d52d276ba3f68d85c658ddc6110ca546
Instruction Fuzzy Hash: C1016CB09027597DE3008F5A8C85B52FFA8FF19354F00411B915C47A41C7F5A864CBE5

Function 0015EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0015EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0015EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0015EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0015EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0015EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0015EB75

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: e863c0a3744407b022bf29a4a4c6c15f95229d718fd9a90c61302872d8e9d49a
Instruction ID: 786e448da68eead59f1f6fcd6c7fa5de90cbec467d17781c2d3c3fdc599c6d2e
Opcode Fuzzy Hash: e863c0a3744407b022bf29a4a4c6c15f95229d718fd9a90c61302872d8e9d49a
Instruction Fuzzy Hash: 0AF01772640158BBE6215B629C4EEEB3A7CEBCAB11F000168FA11D1591E7B05B418BF5

Function 00147439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00147452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00147469
GetWindowDC.USER32(?), ref: 00147475
GetPixel.GDI32(00000000,?,?), ref: 00147484
ReleaseDC.USER32(?,00000000), ref: 00147496
GetSysColor.USER32(00000005), ref: 001474B0

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 113bc5e3d6a2aa0fd8a479f0c8a439ed9164d4f2f3187bcf1923732b372377d3
Instruction ID: 452a5cecb9692a7742e9ab962a837a6805372a49c74aab7b34139414a7121b98
Opcode Fuzzy Hash: 113bc5e3d6a2aa0fd8a479f0c8a439ed9164d4f2f3187bcf1923732b372377d3
Instruction Fuzzy Hash: 2A014B31500215EFDB515FA4EC48BFABBB6FF04321F654164F915A25F1CB311E91ABA0

Function 00151874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0015187F
UnloadUserProfile.USERENV(?,?), ref: 0015188B
CloseHandle.KERNEL32(?), ref: 00151894
CloseHandle.KERNEL32(?), ref: 0015189C
GetProcessHeap.KERNEL32(00000000,?), ref: 001518A5
HeapFree.KERNEL32(00000000), ref: 001518AC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 9165240739a5666fc3e9749b534b08f42368eb6c9be971a7be81e8e836dbbea0
Instruction ID: 9a22e9f6c99abaaf1844a526b00496f1a2e94e1cd22dc47ef0b3577cc32848b0
Opcode Fuzzy Hash: 9165240739a5666fc3e9749b534b08f42368eb6c9be971a7be81e8e836dbbea0
Instruction Fuzzy Hash: CAE0E536004101FBDB015FA1ED0CD0ABF39FF49B22B108220F22581874CB3295A1EFA0

Function 0015C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F7620: _wcslen.LIBCMT ref: 000F7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0015C6EE
_wcslen.LIBCMT ref: 0015C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0015C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0015C7CA

Strings

0, xrefs: 0015C6AF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 2e6bae570216eb61ad6f1a235fb1a81e01a24a49405140540ae9bee1254b2be5
Instruction ID: c242ad35986f598cfc19bbe57c9281298dcd5baa4a66cdb721a9cb10f3bb5241
Opcode Fuzzy Hash: 2e6bae570216eb61ad6f1a235fb1a81e01a24a49405140540ae9bee1254b2be5
Instruction Fuzzy Hash: 0A51EE71604301DFC7149E28C885BABB7E4AB59311F040A2DFDA5EBA91DB70D948CBD2

Function 0017AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0017AEA3

Part of subcall function 000F7620: _wcslen.LIBCMT ref: 000F7625

GetProcessId.KERNEL32(00000000), ref: 0017AF38
CloseHandle.KERNEL32(00000000), ref: 0017AF67

Strings

<, xrefs: 0017AE6B
@, xrefs: 0017AE72

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 811093c59500b5ca26d04a15502e3142a5b062c1c1c6b82e1c8b9217a3ad2b16
Instruction ID: aeb0b0112984be766f9b5a58b986996797e56930f0909f328b2364ada20d2cbc
Opcode Fuzzy Hash: 811093c59500b5ca26d04a15502e3142a5b062c1c1c6b82e1c8b9217a3ad2b16
Instruction Fuzzy Hash: 57718C70A00619DFCB14DF64C495AAEBBF0FF48310F448499E85AAB792CB74ED85CB91

Function 0015719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00157206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0015723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0015724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 001572CF

Strings

DllGetClassObject, xrefs: 00157242

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 727061918718ed8162737a03d727b348850cf9606cd7bb43443f4c41d4996ef6
Instruction ID: 126916d0a3e95495c41aefb6daac1289fd9dfffc54e98e24db551957e88997a2
Opcode Fuzzy Hash: 727061918718ed8162737a03d727b348850cf9606cd7bb43443f4c41d4996ef6
Instruction Fuzzy Hash: 1341B371604204EFDB15CF54D886A9A7BB9EF44311F1480ADFD159F28AD7B0DE49CBA0

Function 00183D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00183E35
IsMenu.USER32(?), ref: 00183E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00183E92
DrawMenuBar.USER32 ref: 00183EA5

Strings

0, xrefs: 00183D89

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: a15e1afebb9fe32f197c0e19ce6b6bfaca3c5425be52a4a7bd9d2f8398bc1831
Instruction ID: 5e38caa5fa3056645e9b9ab42d302cfc7df9e30114f200540f5bbecca1fac698
Opcode Fuzzy Hash: a15e1afebb9fe32f197c0e19ce6b6bfaca3c5425be52a4a7bd9d2f8398bc1831
Instruction Fuzzy Hash: 01414675A01209AFDB10EF50D884EEABBB9FF49754F084129E925A7250D730EF45DFA0

Function 00151DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 00153CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00153CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00151E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00151E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00151EA9

Part of subcall function 000F6B57: _wcslen.LIBCMT ref: 000F6B6A

Strings

ListBox, xrefs: 00151E25
ComboBox, xrefs: 00151DF0

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: f2a3fb720a1388fcbcace70c3b7667d16aa0922b364241709ac819ca8d39e522
Instruction ID: 8e64988ebc9ea63a8ee7580695e02a56957fd0416e9da2fc33ef40f41c4540f4
Opcode Fuzzy Hash: f2a3fb720a1388fcbcace70c3b7667d16aa0922b364241709ac819ca8d39e522
Instruction Fuzzy Hash: 38212671A00108BADB16AB64CC46EFFB7B9DF46390B144129FC31AB5E1DB744A4E9660

Function 0017C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0017C9F1
_wcslen.LIBCMT ref: 0017CA68
_wcslen.LIBCMT ref: 0017CA9E
_wcslen.LIBCMT ref: 0017CAF9
_wcslen.LIBCMT ref: 0017CB2F
_wcslen.LIBCMT ref: 0017CB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 0017CA62, 0017CA67
HKLM, xrefs: 0017CA98, 0017CA9D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: d63f674f54837814b5290efdec14021f8ed15a6510f37fa87a475adc630e6ae9
Instruction ID: 278f51ba16198a55b74aa8aae8f7802390313a9b5e08495f927071d7c42a724e
Opcode Fuzzy Hash: d63f674f54837814b5290efdec14021f8ed15a6510f37fa87a475adc630e6ae9
Instruction Fuzzy Hash: 7A31D572A0056E4BCB20EE2C99415BE33B15BB1795B55802DE849AB385FB71CD80D3E0

Function 00182F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00182F8D
LoadLibraryW.KERNEL32(?), ref: 00182F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00182FA9
DestroyWindow.USER32(?), ref: 00182FB1

Strings

SysAnimate32, xrefs: 00182F68

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: a04ae6fd95e057ae826dcddbc670a8f4b112a154aa0a3b32ea480d7ad78903fb
Instruction ID: 174afbfe0acafcbef2f120d6389b65de0458bcf63852d399cafa5fc273e2780a
Opcode Fuzzy Hash: a04ae6fd95e057ae826dcddbc670a8f4b112a154aa0a3b32ea480d7ad78903fb
Instruction Fuzzy Hash: 1B21AC71204209BBEB126F64DC80EBB77B9EF59364F100628FA50D21D0D771DD91DB60

Function 00114D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00114D1E,001228E9,?,00114CBE,001228E9,001B88B8,0000000C,00114E15,001228E9,00000002), ref: 00114D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00114DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00114D1E,001228E9,?,00114CBE,001228E9,001B88B8,0000000C,00114E15,001228E9,00000002,00000000), ref: 00114DC3

Strings

CorExitProcess, xrefs: 00114D98
mscoree.dll, xrefs: 00114D86

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 756e7a53b0f83d8f4a64b3e7c9e75f03e2741306fee088ec63ea04d2d541ee95
Instruction ID: acac110ff2cc105f570490989f8d6f816ba37e4266381cdf08512dabb09118c7
Opcode Fuzzy Hash: 756e7a53b0f83d8f4a64b3e7c9e75f03e2741306fee088ec63ea04d2d541ee95
Instruction Fuzzy Hash: 5AF04F35A40208BBDF159F94EC49BEDBBB5EF58B52F0001A8F905A2660CB705AC4CBE1

Function 0014D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0014D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0014D3BF
FreeLibrary.KERNEL32(00000000), ref: 0014D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0014D3B9
X64, xrefs: 0014D2A8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 4e1601fd85746b530ea466e7b72503ec5dcfb73d3b5433310f04bb8338a88914
Instruction ID: 0452031029dedfb1e56f25c3faea4737e1d6283780523b81a0d923fc85c3700f
Opcode Fuzzy Hash: 4e1601fd85746b530ea466e7b72503ec5dcfb73d3b5433310f04bb8338a88914
Instruction Fuzzy Hash: 68F05C71506611DBDF352B106C48E5977147F11F01B968089F401F1575DBB0CE8487E2

Function 000F4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,000F4EDD,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 000F4EAE
FreeLibrary.KERNEL32(00000000,?,?,000F4EDD,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 000F4EA8
kernel32.dll, xrefs: 000F4E94

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: a2435f24dedb9a55298a3c4b2c5049defefa3168cbb461aa7cab9193f403636f
Instruction ID: d5bd982cf8bda10637e5d89b82e8f43cfa08908358978a823b1568a6316e08d3
Opcode Fuzzy Hash: a2435f24dedb9a55298a3c4b2c5049defefa3168cbb461aa7cab9193f403636f
Instruction Fuzzy Hash: 3DE0CD35A015229BD3721B257C5CBBF75D4AFC1F627050115FE00D2A00DB70CE4596F0

Function 000F4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00133CDE,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 000F4E74
FreeLibrary.KERNEL32(00000000,?,?,00133CDE,?,001C1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 000F4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 000F4E6E
kernel32.dll, xrefs: 000F4E5B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 5795d62f0c39f23b0dd40fab3bf65132d6ef613d87b65381dc66dcf9b1081b1d
Instruction ID: c02b68109985c789f304177aa7491c52c51b1c050d3b1f7d89816a5a4c6a6077
Opcode Fuzzy Hash: 5795d62f0c39f23b0dd40fab3bf65132d6ef613d87b65381dc66dcf9b1081b1d
Instruction Fuzzy Hash: 25D0C231502A219787321B247C0CEDB2A58AF81F513050210FE00A2910CF30CF4597F0

Function 00162947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00162C05
DeleteFileW.KERNEL32(?), ref: 00162C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00162C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00162CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00162CC0

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 847023ddae86d87d87098f2b1a58bd9abaebca9481291cf4ffb81f473a47f2c1
Instruction ID: 98f2094c71cb7fdd2e69951c1118ce600daadb0024a4affb9b2fa1c78a9ecba7
Opcode Fuzzy Hash: 847023ddae86d87d87098f2b1a58bd9abaebca9481291cf4ffb81f473a47f2c1
Instruction Fuzzy Hash: CCB15D7290051DABDF25DBA4CC85EEEB7BDEF58310F1040A6F609E7141EB309A948FA1

Function 0017A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0017A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0017A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0017A468
CloseHandle.KERNEL32(?), ref: 0017A63D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: a338aeb2ca08ad68ce617ddfd19cbaa2b7cf04f9e7dfcd546b761db81ff86d85
Instruction ID: 9e61aceb1566b62a6f67590820f74b07ebfc0b09c32e7398e6dd0540ecc663c4
Opcode Fuzzy Hash: a338aeb2ca08ad68ce617ddfd19cbaa2b7cf04f9e7dfcd546b761db81ff86d85
Instruction Fuzzy Hash: 0DA1C2716043019FE720DF24C886F2AB7E1AF88714F54881CF99ADB6D2D7B1ED418B92

Function 0015E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0015DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0015CF22,?), ref: 0015DDFD

Part of subcall function 0015DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0015CF22,?), ref: 0015DE16

Part of subcall function 0015E199: GetFileAttributesW.KERNEL32(?,0015CF95), ref: 0015E19A

lstrcmpiW.KERNEL32(?,?), ref: 0015E473
MoveFileW.KERNEL32(?,?), ref: 0015E4AC
_wcslen.LIBCMT ref: 0015E5EB
_wcslen.LIBCMT ref: 0015E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0015E650

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 3a40413edff8f25e4d289a2674e3c73b544771ec257a9cf89fca0706e9ff215b
Instruction ID: ad64176c9b04fce7193bcc377e9ec7df03aaa62c678c581c54c5e53a2a30efed
Opcode Fuzzy Hash: 3a40413edff8f25e4d289a2674e3c73b544771ec257a9cf89fca0706e9ff215b
Instruction Fuzzy Hash: 3B5174B28083459BC728DB90D8819DB73ECAF94341F00492EFA99D7191EF74A68CC766

Function 0017B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 0017C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0017B6AE,?,?), ref: 0017C9B5
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017C9F1
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017CA68
Part of subcall function 0017C998: _wcslen.LIBCMT ref: 0017CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0017BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0017BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0017BB63
RegCloseKey.ADVAPI32(?,?), ref: 0017BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0017BBB3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 3b54b062bb8df4f31f0d3569525b6b7f5817c6c6da2e391f80cbc61cc5c81d5c
Instruction ID: bdc587c05d201330719430dcd4c83d310ceceba9cc3cdef92f5cae6818286dfa
Opcode Fuzzy Hash: 3b54b062bb8df4f31f0d3569525b6b7f5817c6c6da2e391f80cbc61cc5c81d5c
Instruction Fuzzy Hash: DB617831208205AFC314DF24C491F6ABBF5BF84348F54896CF4998B2A2DB31ED45CB92

Function 00158BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00158BCD
VariantClear.OLEAUT32 ref: 00158C3E
VariantClear.OLEAUT32 ref: 00158C9D
VariantClear.OLEAUT32(?), ref: 00158D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00158D3B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 14a0a7af30121777c2f48407189f73043131b32d167348672c50ab4759a84253
Instruction ID: d0fa29f1b9ad318cb11854f259aef7acf3797866c9f82b3e8f56985c6a771219
Opcode Fuzzy Hash: 14a0a7af30121777c2f48407189f73043131b32d167348672c50ab4759a84253
Instruction Fuzzy Hash: 765159B5A00219EFCB14CF68C894AAAB7F9FF89310B158559ED15EB350E730E951CFA0

Function 00168AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00168BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00168BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00168C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00168C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00168C5F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: c2f41092831bdac6ea0ea35f497559d5188da4cf22df431f2d71d5fef569ca41
Instruction ID: dde271ad5a3b97590a57cd2dc8ed6b28b08ab29a08226b5b5d1b69e075040c96
Opcode Fuzzy Hash: c2f41092831bdac6ea0ea35f497559d5188da4cf22df431f2d71d5fef569ca41
Instruction Fuzzy Hash: 14517B35A006199FCB00DF64C881EADBBF1FF48314F088058E949AB7A2CB75ED55DBA1

Function 00178EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00178F40
GetProcAddress.KERNEL32(00000000,?), ref: 00178FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00178FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00179032
FreeLibrary.KERNEL32(00000000), ref: 00179052

Part of subcall function 0010F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00161043,?,753CE610), ref: 0010F6E6
Part of subcall function 0010F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0014FA64,00000000,00000000,?,?,00161043,?,753CE610,?,0014FA64), ref: 0010F70D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 01d7b649a968f141a108436b7beadb424e6be63adb78f3f74277e81db556d390
Instruction ID: 440ace6ed03f97b561547f2b503e59120308f9f15200e70e0a109c79734a85ff
Opcode Fuzzy Hash: 01d7b649a968f141a108436b7beadb424e6be63adb78f3f74277e81db556d390
Instruction Fuzzy Hash: 10515834600209DFCB14DF58C4949ADBBF1FF49324B05C0A8E90A9B762DB31EE86CB91

Function 00186B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00186C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00186C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00186C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0016AB79,00000000,00000000), ref: 00186C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00186CC7

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: cd347fddd49dd2a1d648ce0069ab6c73c0720e3550462fa4256c0ebc5ad997aa
Instruction ID: c8e9dd8d62f0a1e92e14722bbea526a0964fad3cae952172115fb848d8407782
Opcode Fuzzy Hash: cd347fddd49dd2a1d648ce0069ab6c73c0720e3550462fa4256c0ebc5ad997aa
Instruction Fuzzy Hash: 8441AF35A04104AFDB24EF28CC58FA97BA5EB0A350F150228E899A73E1C371EF41DF90

Function 00122051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001220C3
_free.LIBCMT ref: 001220E3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9fa3b90f3e5e863227f136ad7a84bf014f9127c0545252ba83ba671a9bb6bdc3
Instruction ID: ffb35b11fcab5c95ce002e5b19b2ccc266ac14023e2c74631e6bbcfdf5c4f289
Opcode Fuzzy Hash: 9fa3b90f3e5e863227f136ad7a84bf014f9127c0545252ba83ba671a9bb6bdc3
Instruction Fuzzy Hash: 6241D136A00220AFCB24DF79D881A9DB7E5EF89314F1545A8FA15EB391DB31AD11CB80

Function 0010912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00109141
ScreenToClient.USER32(00000000,?), ref: 0010915E
GetAsyncKeyState.USER32(00000001), ref: 00109183
GetAsyncKeyState.USER32(00000002), ref: 0010919D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: e9a5c5075f53144b2bfea3ca98802e04092bbbea87290325b79bba69af5eb7e1
Instruction ID: 4a66076ebbddc5bd520e4b4a235c5a70692138b716c4fc8a7de46480402672d8
Opcode Fuzzy Hash: e9a5c5075f53144b2bfea3ca98802e04092bbbea87290325b79bba69af5eb7e1
Instruction Fuzzy Hash: 4F415E71A0860AFBDF19AF64C854BEEB774FF05320F208215E469A72E1C7706A50CB91

Function 00163874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 001638CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00163922
TranslateMessage.USER32(?), ref: 0016394B
DispatchMessageW.USER32(?), ref: 00163955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00163966

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 855509f09273a5f9cfedfcdbfe9f9490312085bc76b2ea74b1b81d61e0c0e9e3
Instruction ID: 28be9fa626371dee3f3d8636e8cf00cfbca21e8914da742289ce4afeccd63a8c
Opcode Fuzzy Hash: 855509f09273a5f9cfedfcdbfe9f9490312085bc76b2ea74b1b81d61e0c0e9e3
Instruction Fuzzy Hash: 23318670544342AEEB29CB749C48FB73BA8EB16308F14056DE472825A1E7B4DAD5CF61

Function 0016CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0016CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0016CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0016C21E,00000000), ref: 0016CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0016C21E,00000000), ref: 0016CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0016C21E,00000000), ref: 0016CFF2

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 840c34562e52c2f1169cd7263bb1121b600b91e67cf076654d3995ffffe43622
Instruction ID: b874a541de4369348f818b6aeec58ec8be7f58c250f35d9e708d575b2b53dda0
Opcode Fuzzy Hash: 840c34562e52c2f1169cd7263bb1121b600b91e67cf076654d3995ffffe43622
Instruction Fuzzy Hash: 55318E71600205EFDB24DFA5DC84ABBBBFAEB14310B10446EF596D2540DB30AE51DBE0

Function 00151901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00151915
PostMessageW.USER32(00000001,00000201,00000001), ref: 001519C1
Sleep.KERNEL32(00000000,?,?,?), ref: 001519C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 001519DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 001519E2

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: f4881fcff5aa0f389c1f94039fe9bbe17d4eaea4ee4731fb7a7897b96e5398bd
Instruction ID: b081f614b19516b73cf6c0d4f17021019bb4c8c7d78c43f493fe5408d5bedee5
Opcode Fuzzy Hash: f4881fcff5aa0f389c1f94039fe9bbe17d4eaea4ee4731fb7a7897b96e5398bd
Instruction Fuzzy Hash: 70318F71900219EFCB04CFA8C999BDE7BB5EB45319F104229FD21AB2D1D7709A58CB90

Function 00185706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00185745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0018579D
_wcslen.LIBCMT ref: 001857AF
_wcslen.LIBCMT ref: 001857BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00185816

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 3df56d55da1f996ac04c49966234ca9868c1658d45ef8bb2697f95b59efa9dde
Instruction ID: aa895032f7c05e28a08b6c053fe25f995720615cfd4a77dc822cc48327cefd61
Opcode Fuzzy Hash: 3df56d55da1f996ac04c49966234ca9868c1658d45ef8bb2697f95b59efa9dde
Instruction Fuzzy Hash: 952187759046189ADB20AFA0CC85AEDBB79FF14724F108126F919DA190E7708BC5CF50

Function 00170930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00170951
GetForegroundWindow.USER32 ref: 00170968
GetDC.USER32(00000000), ref: 001709A4
GetPixel.GDI32(00000000,?,00000003), ref: 001709B0
ReleaseDC.USER32(00000000,00000003), ref: 001709E8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 4ec1d2b87bca86c349d64bb080ee936d429aa3fc691e8054d5f894eaa3e62446
Instruction ID: 0bb6b30c92fc65dda9fb9ac975fa1445dd4d4c6a29ae6b402b4b219200b610d6
Opcode Fuzzy Hash: 4ec1d2b87bca86c349d64bb080ee936d429aa3fc691e8054d5f894eaa3e62446
Instruction Fuzzy Hash: 6F216D35600204EFD704EF65DD99AAEBBF9EF48704F148068E94A97762DB30AD44DBA0

Function 0012CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0012CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0012CDE9

Part of subcall function 00123820: RtlAllocateHeap.NTDLL(00000000,?,001C1444,?,0010FDF5,?,?,000FA976,00000010,001C1440,000F13FC,?,000F13C6,?,000F1129), ref: 00123852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0012CE0F
_free.LIBCMT ref: 0012CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0012CE31

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 575e745f574a93064107987725f7abd49f37e24776bd76691d66c1c9e709c3d4
Instruction ID: e9e48cea9eff3f119ec12fa348dae25ae7cd0e168b74d43549dbf365cd39e0b9
Opcode Fuzzy Hash: 575e745f574a93064107987725f7abd49f37e24776bd76691d66c1c9e709c3d4
Instruction Fuzzy Hash: 860171726016357F272116BA7C8CD7F6D6DEBC6BA13160129FE05C7201EB718E2282F1

Function 00109639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00109693
SelectObject.GDI32(?,00000000), ref: 001096A2
BeginPath.GDI32(?), ref: 001096B9
SelectObject.GDI32(?,00000000), ref: 001096E2

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 28fd8207bac7e6f4e3cdf091201bf0db7e328767587414c2af2133a19b924e25
Instruction ID: 022672cbfaa48b6f6c9f7bb8ea199ec0fb061b202315c5781a2120f1b3d458ae
Opcode Fuzzy Hash: 28fd8207bac7e6f4e3cdf091201bf0db7e328767587414c2af2133a19b924e25
Instruction Fuzzy Hash: C5217970842305EBDB119F24EC28BA93FA9BB52769F100216F850A75F2D3B199D1CFE0

Function 00155711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00155726
_memcmp.LIBVCRUNTIME ref: 00155744
_memcmp.LIBVCRUNTIME ref: 00155757
_memcmp.LIBVCRUNTIME ref: 0015576F
_memcmp.LIBVCRUNTIME ref: 00155787

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9864add0ff674c50c5e0c52beea7089bb37511266773169b793b2cc001913d44
Instruction ID: 6a5344d9c97474f9e7a5e243bfbe3763a69b5ff1222ee5667aadec4a2c8c38bc
Opcode Fuzzy Hash: 9864add0ff674c50c5e0c52beea7089bb37511266773169b793b2cc001913d44
Instruction Fuzzy Hash: 6D01F561241A09FBD30C61119D92FFBB35FAB343A6F910034FE249E242F720EE5587A0

Function 00122DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0011F2DE,00123863,001C1444,?,0010FDF5,?,?,000FA976,00000010,001C1440,000F13FC,?,000F13C6), ref: 00122DFD
_free.LIBCMT ref: 00122E32
_free.LIBCMT ref: 00122E59
SetLastError.KERNEL32(00000000,000F1129), ref: 00122E66
SetLastError.KERNEL32(00000000,000F1129), ref: 00122E6F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 856d1930b272e4056fec51bfd65e4f6ec9fedd050a449324c0ba3f315d6319bf
Instruction ID: a8f1f4b77ef58dce2c54a21dcffdecd313a1079c108031f194ef59dc82ba88b0
Opcode Fuzzy Hash: 856d1930b272e4056fec51bfd65e4f6ec9fedd050a449324c0ba3f315d6319bf
Instruction Fuzzy Hash: 06012832205630BBC62667797C46D3F265DABE53B5B230128F821A32D2EF74CC716270

Function 0015000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0014FF41,80070057,?,?,?,0015035E), ref: 0015002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0014FF41,80070057,?,?), ref: 00150046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0014FF41,80070057,?,?), ref: 00150054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0014FF41,80070057,?), ref: 00150064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0014FF41,80070057,?,?), ref: 00150070

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: fdbf8662ede236aaf0a7c4c2e98e04559e668aca7525ed90933a1a2b06319bff
Instruction ID: 62563a0a2332ff8cad462726e0100617f9d5663833f1ec5b3c03b18ad00ec584
Opcode Fuzzy Hash: fdbf8662ede236aaf0a7c4c2e98e04559e668aca7525ed90933a1a2b06319bff
Instruction Fuzzy Hash: D801A272600204FFDB124FA8DC44BAA7BEDEF48792F144128FD05DA250D771DE848BA0

Function 001510F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00151114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00150B9B,?,?,?), ref: 00151120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00150B9B,?,?,?), ref: 0015112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00150B9B,?,?,?), ref: 00151136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0015114D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: c5876ced27679efd851bd55bf4521c3c3f323c2661bd725cbadb32c53af6dd34
Instruction ID: c2b8f1f91fd5a00baf67a6febfae1f7e2a821cfe8f1722c0acd1b6bd74ecf8f1
Opcode Fuzzy Hash: c5876ced27679efd851bd55bf4521c3c3f323c2661bd725cbadb32c53af6dd34
Instruction Fuzzy Hash: 67014679200605FFDB124BA4EC89A6A3B6EEF893A1B250458FA41C6360DB31DD408BB0

Function 00150FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00150FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00150FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00150FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00150FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00151002

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 84a107a2df5e7aed704fa4d58010ae9f8e9beba630682a09bb3e7e5e02132bcc
Instruction ID: b5aa9699b0cc1f30041289f72a0bb8857da36eb19aa4015cc56d419f3ec0bff9
Opcode Fuzzy Hash: 84a107a2df5e7aed704fa4d58010ae9f8e9beba630682a09bb3e7e5e02132bcc
Instruction Fuzzy Hash: B0F03739201311FBDB224FA4AC8DF563BA9EF89762F604414FA458A291CB70D9808BB0

Function 00151014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0015102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00151036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00151045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0015104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00151062

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 57d70dff9a13a2bc952a142f4e7c619f79772ce2b18f96a131610913a7d7f1c5
Instruction ID: 8aae2749fe35278bbdd201ed7f11d3e09393f170f2f78c8c9fb5793db28f21d9
Opcode Fuzzy Hash: 57d70dff9a13a2bc952a142f4e7c619f79772ce2b18f96a131610913a7d7f1c5
Instruction Fuzzy Hash: 89F04F39100311FBD7225FA4EC49F563B6DEF89761F200814FD45CA290CB70D9808BB0

Function 0016030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0016017D,?,001632FC,?,00000001,00132592,?), ref: 00160324
CloseHandle.KERNEL32(?,?,?,?,0016017D,?,001632FC,?,00000001,00132592,?), ref: 00160331
CloseHandle.KERNEL32(?,?,?,?,0016017D,?,001632FC,?,00000001,00132592,?), ref: 0016033E
CloseHandle.KERNEL32(?,?,?,?,0016017D,?,001632FC,?,00000001,00132592,?), ref: 0016034B
CloseHandle.KERNEL32(?,?,?,?,0016017D,?,001632FC,?,00000001,00132592,?), ref: 00160358
CloseHandle.KERNEL32(?,?,?,?,0016017D,?,001632FC,?,00000001,00132592,?), ref: 00160365

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4f7088c67775eeb7a636fea9f2cb6a4bbee38c7740d6fdc3e484357a048323b6
Instruction ID: e1292cc86761ec9ae310f739b293be35a854c21aca06d63009386876fcaee3b5
Opcode Fuzzy Hash: 4f7088c67775eeb7a636fea9f2cb6a4bbee38c7740d6fdc3e484357a048323b6
Instruction Fuzzy Hash: 9F019072801B159FC7329F66DC80813F7F5BF542163158A3ED19652A31C371A965DF80

Function 0012D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0012D752

Part of subcall function 001229C8: HeapFree.KERNEL32(00000000,00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000), ref: 001229DE
Part of subcall function 001229C8: GetLastError.KERNEL32(00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000,00000000), ref: 001229F0

_free.LIBCMT ref: 0012D764
_free.LIBCMT ref: 0012D776
_free.LIBCMT ref: 0012D788
_free.LIBCMT ref: 0012D79A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5de56ddbd97059ecfa0811f6eafd3c8a0e49a268220436ae3a6f639feb77a3dc
Instruction ID: 5c9b51fc0ca1095e02989c848b5cce7d36863b53e5b5bd85cb430453b9c27b20
Opcode Fuzzy Hash: 5de56ddbd97059ecfa0811f6eafd3c8a0e49a268220436ae3a6f639feb77a3dc
Instruction Fuzzy Hash: 96F0FF32544235AB9A25FB64F9C6C1A77DDBB587187E50D05F148D7901C734FCD087A4

Function 00155C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00155C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00155C6F
MessageBeep.USER32(00000000), ref: 00155C87
KillTimer.USER32(?,0000040A), ref: 00155CA3
EndDialog.USER32(?,00000001), ref: 00155CBD

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 68264cd6ea99a1adc3ad1db2db7f94b35b862cb251ea14bd34911bdb26580122
Instruction ID: d3db10d8893758050091c27c23b79edf70232bfd85631ec19cee5f836b893b50
Opcode Fuzzy Hash: 68264cd6ea99a1adc3ad1db2db7f94b35b862cb251ea14bd34911bdb26580122
Instruction Fuzzy Hash: 0F018B30500B04DBEB245B10DD5EFA577BDBF00706F040569A553659E1E7F05AC88B90

Function 001222A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001222BE

Part of subcall function 001229C8: HeapFree.KERNEL32(00000000,00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000), ref: 001229DE
Part of subcall function 001229C8: GetLastError.KERNEL32(00000000,?,0012D7D1,00000000,00000000,00000000,00000000,?,0012D7F8,00000000,00000007,00000000,?,0012DBF5,00000000,00000000), ref: 001229F0

_free.LIBCMT ref: 001222D0
_free.LIBCMT ref: 001222E3
_free.LIBCMT ref: 001222F4
_free.LIBCMT ref: 00122305

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e5fa88b0a1e6a5aa9c8328dc44041bebf65f90669adab1508bda15ee06738f7c
Instruction ID: 415255d896077e00a9558e344924b1620bb112ebc325200f5d2d0ff9797b5c7f
Opcode Fuzzy Hash: e5fa88b0a1e6a5aa9c8328dc44041bebf65f90669adab1508bda15ee06738f7c
Instruction Fuzzy Hash: 96F0B775841131AB8A12AF54BC01C4D3F65FB2DB65755060AF420D7AB2C73589E1EFE4

Function 001095C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 001095D4
StrokeAndFillPath.GDI32(?,?,001471F7,00000000,?,?,?), ref: 001095F0
SelectObject.GDI32(?,00000000), ref: 00109603
DeleteObject.GDI32 ref: 00109616
StrokePath.GDI32(?), ref: 00109631

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 3616aa8aebe874cab58d82badddabb940b47937319bc5afb15b145fad1ed3a4b
Instruction ID: 0cb8b9b30de554d4828dae922ccf8e428c1efa8497eba43368004d976695ad2e
Opcode Fuzzy Hash: 3616aa8aebe874cab58d82badddabb940b47937319bc5afb15b145fad1ed3a4b
Instruction Fuzzy Hash: D1F03C34045704EBDB565F65ED6CB643F61AB02366F048214F465558F2C7718AE1DF60

Function 00120F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 001210F9
__freea.LIBCMT ref: 00121117

Part of subcall function 00121537: _free.LIBCMT ref: 0012154F

Strings

am/pm, xrefs: 0012117A
a/p, xrefs: 001211DE

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: c73f45404dda54d9279b29cb133887a4d7401e97f8cf64d6a2f1267996ffd679
Instruction ID: 001d55d714598d4fb9931a2acda86b0a5a559a6842cd36a44cc29761f60f5675
Opcode Fuzzy Hash: c73f45404dda54d9279b29cb133887a4d7401e97f8cf64d6a2f1267996ffd679
Instruction Fuzzy Hash: 56D11531900226FBCB28DF68E845BFEB7B2FF25720F250159E9019B650D3759DA1CB91

Function 00177B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00110242: EnterCriticalSection.KERNEL32(001C070C,001C1884,?,?,0010198B,001C2518,?,?,?,000F12F9,00000000), ref: 0011024D
Part of subcall function 00110242: LeaveCriticalSection.KERNEL32(001C070C,?,0010198B,001C2518,?,?,?,000F12F9,00000000), ref: 0011028A

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 001100A3: __onexit.LIBCMT ref: 001100A9

__Init_thread_footer.LIBCMT ref: 00177BFB

Part of subcall function 001101F8: EnterCriticalSection.KERNEL32(001C070C,?,?,00108747,001C2514), ref: 00110202
Part of subcall function 001101F8: LeaveCriticalSection.KERNEL32(001C070C,?,00108747,001C2514), ref: 00110235

Strings

G, xrefs: 00177C7F
5, xrefs: 00177C78
Variable must be of type 'Object'., xrefs: 00177C3A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 48bd5a84d4d9cc9fbc1dd2b7920d0afc3ec87eec4b3e747fc67bfad36330c0e9
Instruction ID: d8698c88a102b7cce60996f020b3fabebe042c536ce4d4532aac0151af590970
Opcode Fuzzy Hash: 48bd5a84d4d9cc9fbc1dd2b7920d0afc3ec87eec4b3e747fc67bfad36330c0e9
Instruction Fuzzy Hash: 6D916770A04209AFCB15EF94D991DFDB7B2BF59300F108059F81AAB292DB71AE81DB51

Function 00152716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0015B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,001521D0,?,?,00000034,00000800,?,00000034), ref: 0015B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00152760

Part of subcall function 0015B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,001521FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0015B3F8

Part of subcall function 0015B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0015B355
Part of subcall function 0015B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00152194,00000034,?,?,00001004,00000000,00000000), ref: 0015B365
Part of subcall function 0015B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00152194,00000034,?,?,00001004,00000000,00000000), ref: 0015B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 001527CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0015281A

Strings

@, xrefs: 00152832

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 132bd2a090a505611412aa4fa4745664cd69a4130943534b5d220bf8bcfb7861
Instruction ID: a5f51078c03fbd031bc8c0c367d3c2421784b05ca335f3f5f0ed31c044793d94
Opcode Fuzzy Hash: 132bd2a090a505611412aa4fa4745664cd69a4130943534b5d220bf8bcfb7861
Instruction Fuzzy Hash: 73411C72900218FFDB10DBA4CD85AEEBBB8AF19700F104059FA55BB181DB706E49CBA1

Function 0012172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00121769
_free.LIBCMT ref: 00121834
_free.LIBCMT ref: 0012183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00121760, 00121767, 00121796, 001217CE

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 0e9ea9bf171e0cf62e02c6213911a305fa89241e9fd5e6727527406b0653c22b
Instruction ID: 0f0b2735c2617cc641bb456c7a03d9add02475ec43ccd6c4d26093985736ca8c
Opcode Fuzzy Hash: 0e9ea9bf171e0cf62e02c6213911a305fa89241e9fd5e6727527406b0653c22b
Instruction Fuzzy Hash: CD315275A40268FFDB25DF99E885D9EBBFCEBA5310B24416AF804D7211D7708E90CB90

Function 0015C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0015C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0015C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,001C1990,01285CC0), ref: 0015C395

Strings

0, xrefs: 0015C2DF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: f2693324a3292c078555941c754b6e23107b1697e35955c15d8128b0a228c940
Instruction ID: 176773c9b5f587ac2e3a92478c5f201cd99960cd972041261a1f7d28ad056a2b
Opcode Fuzzy Hash: f2693324a3292c078555941c754b6e23107b1697e35955c15d8128b0a228c940
Instruction Fuzzy Hash: 3F418E31204305DFDB24DF25D884B6ABBE4BF95321F148A1DFDB59B291D730A908CBA2

Function 00184416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0018CC08,00000000,?,?,?,?), ref: 001844AA
GetWindowLongW.USER32 ref: 001844C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 001844D7

Strings

SysTreeView32, xrefs: 0018447C

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: b1ece548f6877d9b25d91b61eea349db940557ec88970bfe64dbf9d3c1e76058
Instruction ID: bb53dba220093af1d8f9d342b7ade8293e4e46a8c74d0a75c177a88916ec85d3
Opcode Fuzzy Hash: b1ece548f6877d9b25d91b61eea349db940557ec88970bfe64dbf9d3c1e76058
Instruction Fuzzy Hash: BD31A031210206AFDF20AF78DC45BEA7BA9EB09334F204725F975921E1DB70EE509B60

Function 0017304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0017335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00173077,?,?), ref: 00173378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0017307A
_wcslen.LIBCMT ref: 0017309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00173106

Strings

255.255.255.255, xrefs: 00173095, 0017309A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 202d28f63f10c0c7e7d75aca9494b07c4a76e9a43c3d79f5bbaec19c109e13ad
Instruction ID: fd0c02414006f164aae73de47becd68f8ca83e17bff22395e3d2278a08c249da
Opcode Fuzzy Hash: 202d28f63f10c0c7e7d75aca9494b07c4a76e9a43c3d79f5bbaec19c109e13ad
Instruction Fuzzy Hash: 2F31E4392042059FCB24CF28C585EAA77F0EF54318F65C059E9298B792DB32EF41D761

Function 00183EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00183F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00183F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00183F78

Strings

SysMonthCal32, xrefs: 00183F0B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 3a6c7bd7efb8027ee4957d5ee90cad33a13e77c9b69cb3d3be7ee3d6cde37f23
Instruction ID: 102583b7ea27a743bad2f3ef8cf2cba8caa9bc12fceb150db7fc04394a2ae3ff
Opcode Fuzzy Hash: 3a6c7bd7efb8027ee4957d5ee90cad33a13e77c9b69cb3d3be7ee3d6cde37f23
Instruction Fuzzy Hash: 86218D32610219BBDF159F50CC46FEA3B75EF48714F150214FA156B1D0D7B5EA948BA0

Function 00184653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00184705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00184713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0018471A

Strings

msctls_updown32, xrefs: 00184684

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: f7d6dad66a9fcafaea41a333aa59d0d60f2d3f4527eedc38a794aa1d11b86aaa
Instruction ID: 3da0df05331fd17a797139b8ee2644d496d712904b526b8564f07388b6a8e6a7
Opcode Fuzzy Hash: f7d6dad66a9fcafaea41a333aa59d0d60f2d3f4527eedc38a794aa1d11b86aaa
Instruction Fuzzy Hash: 8C213CB5600209AFDB11EF68DCC1DB737ADEF5A3A8B140059FA009B291DB71ED51DB60

Function 001595AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0015961D

Strings

#requireadmin, xrefs: 001595D9
#notrayicon, xrefs: 001595B7
#OnAutoItStartRegister, xrefs: 001595F3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: b749118f6b8257b65491eb1ad10cbf7791e946596dbebd176885154335a68678
Instruction ID: 0504af04b48e2c75fa7059aa1acb882c40d5c251b2842297380b7249b1047972
Opcode Fuzzy Hash: b749118f6b8257b65491eb1ad10cbf7791e946596dbebd176885154335a68678
Instruction Fuzzy Hash: 23212672204211E6C735AA24D802FF773989FA1311F54443AFD699B082EB519E9EC2D6

Function 001837B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00183840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00183850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00183876

Strings

Listbox, xrefs: 0018380F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 9d8cb0335b813d4ebbce76c77ee2affac395b8ad13b5f71e6b6daf4a79b3277f
Instruction ID: b7ce9c51b09e5903d3e28bb50c3f40151fffd2bbc5a85eaa157ff5c2be3c5c71
Opcode Fuzzy Hash: 9d8cb0335b813d4ebbce76c77ee2affac395b8ad13b5f71e6b6daf4a79b3277f
Instruction Fuzzy Hash: B4218072610118BBEF119F54CC85FBB376AEF89B50F158124F9149B190CB71DE528BA0

Function 001649F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00164A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00164A5C
SetErrorMode.KERNEL32(00000000,?,?,0018CC08), ref: 00164AD0

Strings

%lu, xrefs: 00164A6F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 0c116e451b9e9063924d85bacbea57dd4f2ffdc47fa5a03f5db10756f7a520db
Instruction ID: 9205fa6cc3efe7eb7087a29bc37d6fb2719b48ff633c9180d0abbeb602b8af85
Opcode Fuzzy Hash: 0c116e451b9e9063924d85bacbea57dd4f2ffdc47fa5a03f5db10756f7a520db
Instruction Fuzzy Hash: 81313275A00109EFDB10DF54C985EAA7BF8EF09308F1480A9F909DB652D771EE45CBA1

Function 001841EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0018424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00184264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00184271

Strings

msctls_trackbar32, xrefs: 00184226

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 87523980355d8237d21c6ea0238ce279dbc4d7583780f06900d8b3516022addf
Instruction ID: b671f1cbc91e7990fb95acf13a14ff2dfb1fe8b6c7b925e84dc3df2d5d3d44e1
Opcode Fuzzy Hash: 87523980355d8237d21c6ea0238ce279dbc4d7583780f06900d8b3516022addf
Instruction Fuzzy Hash: 7911E331244209BFEF20AF28DC06FEB3BADEF95B54F110124FA55E2090DB71D8619B20

Function 00152F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F6B57: _wcslen.LIBCMT ref: 000F6B6A

Part of subcall function 00152DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00152DC5
Part of subcall function 00152DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00152DD6
Part of subcall function 00152DA7: GetCurrentThreadId.KERNEL32 ref: 00152DDD
Part of subcall function 00152DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00152DE4

GetFocus.USER32 ref: 00152F78

Part of subcall function 00152DEE: GetParent.USER32(00000000), ref: 00152DF9

GetClassNameW.USER32(?,?,00000100), ref: 00152FC3
EnumChildWindows.USER32(?,0015303B), ref: 00152FEB

Strings

%s%d, xrefs: 00152FFF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: d56b710923237cf0ee84387bcb56dfc9c6ad7d06d77a4ed0d65f86ad3e78ffa1
Instruction ID: eca87d42ce31f79389cd461d14dfccb3a41aaa0fd4c5215a3a59b00ee28720c5
Opcode Fuzzy Hash: d56b710923237cf0ee84387bcb56dfc9c6ad7d06d77a4ed0d65f86ad3e78ffa1
Instruction Fuzzy Hash: CF11D271200209ABCF547FA0CC85EEE376AAF94305F044075FD299B292DF719A498B70

Function 00185882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001858C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001858EE
DrawMenuBar.USER32(?), ref: 001858FD

Strings

0, xrefs: 0018588F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 0c44023b298c4a2a8b41291321b2e074f118d6720390006048d8c32cedf12880
Instruction ID: aae8371064d96f73a60a766195927ff23502cdebe356ccfcb616aed7a4e56bd9
Opcode Fuzzy Hash: 0c44023b298c4a2a8b41291321b2e074f118d6720390006048d8c32cedf12880
Instruction Fuzzy Hash: 0B016D31A00218EFDB21AF11EC45BAEBBB5FB45364F1080A9E849D61A1DB708B85DF71

Function 0015007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa01006183b9095f6c50304096f16956a0546e5f11bdd066d07337b915a9dad
Instruction ID: 88b69e83d85fee4d4c32e8dbc58cf0b6f564f34fd5b9c948c3cfbd4c812a5f01
Opcode Fuzzy Hash: caa01006183b9095f6c50304096f16956a0546e5f11bdd066d07337b915a9dad
Instruction Fuzzy Hash: 5FC14875A0020AEFCB15CFA4C894AAEB7B5FF48305F218598E915EF251D731EE85CB90

Function 00123E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00123F0B
__alldvrm.LIBCMT ref: 0012410C
__alldvrm.LIBCMT ref: 0012412E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: b728c2e60fa098436020a5940d057246490c576778993339ca583c644485270f
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: EAA19972E003A69FEB25CF18E8917EEBBE4EF21350F18416DE5958B281C3389DA1C750

Function 0017342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00173459
CoUninitialize.OLE32 ref: 00173463
VariantInit.OLEAUT32(?), ref: 0017346E
VariantClear.OLEAUT32(?), ref: 0017371B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: a33d391fb3e35d35a57deb723decc9c5873118fe720cdb8cd2393a6d561f76a4
Instruction ID: 9600a86dc95d96378e49ff034806d3f250996f511a164a0c1b20124c8ff933f2
Opcode Fuzzy Hash: a33d391fb3e35d35a57deb723decc9c5873118fe720cdb8cd2393a6d561f76a4
Instruction Fuzzy Hash: 2FA157752047049FC704DF28C485A6AB7F5FF88710F058859F99A9B3A2DB70EE05DB92

Function 00150436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0018FC08,?), ref: 001505F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0018FC08,?), ref: 00150608
CLSIDFromProgID.OLE32(?,?,00000000,0018CC40,000000FF,?,00000000,00000800,00000000,?,0018FC08,?), ref: 0015062D
_memcmp.LIBVCRUNTIME ref: 0015064E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 3a8c36eaa1cca49efc5b800f7901ca90622562edd319817edafada03ff35896a
Instruction ID: c35b9b8d8dac788dac6509a12181f57ea95d7cc4d96403de65c8ec95428a53e7
Opcode Fuzzy Hash: 3a8c36eaa1cca49efc5b800f7901ca90622562edd319817edafada03ff35896a
Instruction Fuzzy Hash: F981F871A00109EFCB05DFD4C984EEEB7B9FF89315F204558E916AB250DB71AE4ACB60

Function 00131391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001314C0

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 23e203fd88db7b660dc03cd8c767745437c5761fae7f5d583d0a968b178fb7e1
Instruction ID: 4a2f887661766f451abe67392f2f0575779c88a1ae9a45f14c24af21ea916321
Opcode Fuzzy Hash: 23e203fd88db7b660dc03cd8c767745437c5761fae7f5d583d0a968b178fb7e1
Instruction Fuzzy Hash: 8D412931A00110BBDF297BBDAC46AFE3AA5FF61370F144239F819D7192EB3488919361

Function 00186278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001862E2
ScreenToClient.USER32(?,?), ref: 00186315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00186382

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 8d919ad12a713b8396756bd7f2794336e8cbc905e308b130c5a7103ca16c041a
Instruction ID: 09a9c6a426d2d7817f6507678752ba915ca76c135e6d7d4ca62ec5f890d36325
Opcode Fuzzy Hash: 8d919ad12a713b8396756bd7f2794336e8cbc905e308b130c5a7103ca16c041a
Instruction Fuzzy Hash: 8D512C74A00209EFDB10EF58D880AAE7BB6FF55364F108169F9599B291D730EE81CF90

Function 00171AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00171AFD
WSAGetLastError.WSOCK32 ref: 00171B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00171B8A
WSAGetLastError.WSOCK32 ref: 00171B94

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 28069fd67aa39801c1b8c1a1e2450ddf5e32227b91228eb15fca3277e66a8c10
Instruction ID: 299c030fd0ed9c3dfb2e34a4d13b006f90cf56eed8757e2ca0f8aea9905e8731
Opcode Fuzzy Hash: 28069fd67aa39801c1b8c1a1e2450ddf5e32227b91228eb15fca3277e66a8c10
Instruction Fuzzy Hash: 0141AF34600200AFE720AF24C886F7A77E5AB48718F54C458FA5A9F7D3D7B2ED418B90

Function 0012B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453ff6822e88818cdeef457545b78c4f1ca6f6788718d0c44a9627f01ff0b13e
Instruction ID: 483118c3b68bb8e4b1c122af1de5f3c50ee0590c14e7cebae7200733104b9d14
Opcode Fuzzy Hash: 453ff6822e88818cdeef457545b78c4f1ca6f6788718d0c44a9627f01ff0b13e
Instruction Fuzzy Hash: 2D412972A04764BFD725AF38DC81BAEBBE9EB98710F10453EF542DB282D37199518780

Function 001656D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00165783
GetLastError.KERNEL32(?,00000000), ref: 001657A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 001657CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 001657FA

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 47f39b5da91b7ad9ca759a4096a57ae204d044a1ac79cd673129ccd7dad2f9c3
Instruction ID: 97714084506ba3c266e60c03c8847d4899af91bd39cad6d6eb5e00ffa746104d
Opcode Fuzzy Hash: 47f39b5da91b7ad9ca759a4096a57ae204d044a1ac79cd673129ccd7dad2f9c3
Instruction Fuzzy Hash: 8F417E39200A15DFCB10DF15C544A6EBBE2EF88720F588488E94AAB762CB74FD44DB91

Function 0012D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00116D71,00000000,00000000,001182D9,?,001182D9,?,00000001,00116D71,8BE85006,00000001,001182D9,001182D9), ref: 0012D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0012D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0012D9AB
__freea.LIBCMT ref: 0012D9B4

Part of subcall function 00123820: RtlAllocateHeap.NTDLL(00000000,?,001C1444,?,0010FDF5,?,?,000FA976,00000010,001C1440,000F13FC,?,000F13C6,?,000F1129), ref: 00123852

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 04f8a35793cd32299123699aa40c4d794a1d4401cb8bb5bc9d52214c99913b2e
Instruction ID: 811803c74717347bd2a9ad5668081983dbb889ee27c8ef162bf42eb542afb779
Opcode Fuzzy Hash: 04f8a35793cd32299123699aa40c4d794a1d4401cb8bb5bc9d52214c99913b2e
Instruction Fuzzy Hash: 3131D272A0021AABDF28DF64EC85EAE7BA5EB40314F050168FC04D7250E735CDA0CBA0

Function 001852C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00185352
GetWindowLongW.USER32(?,000000F0), ref: 00185375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00185382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001853A8

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 4278b05bf0a764fd96d768154eb2ad3291fcc3cf5b8065136c4f8d345abc6bf6
Instruction ID: 71a935cf62d23bfaccdf54ff65ea12bf0889a2bb742a70ecd7a0f2f4143344aa
Opcode Fuzzy Hash: 4278b05bf0a764fd96d768154eb2ad3291fcc3cf5b8065136c4f8d345abc6bf6
Instruction Fuzzy Hash: 5331AD34A55A08BFEB24AA14CC46FE83767FB053D1F584101BE10962E1C7B09F80EF92

Function 0015AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0015ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0015AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0015AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0015ACC6

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 1e192e84d69f97429f2f00b2b288a95ca1e8241abd65f453425036285491cc07
Instruction ID: 4019782d245c1c06bf3aaff6935b6e0aa482d40447c725eebfbfe3c16248c0fb
Opcode Fuzzy Hash: 1e192e84d69f97429f2f00b2b288a95ca1e8241abd65f453425036285491cc07
Instruction Fuzzy Hash: 24312830A80218EFEF34CB64CC057FA7BA5AF45312F84431AE8A55E1D0D3749A8987A2

Function 00187674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0018769A
GetWindowRect.USER32(?,?), ref: 00187710
PtInRect.USER32(?,?,00188B89), ref: 00187720
MessageBeep.USER32(00000000), ref: 0018778C

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: c70ca5df36b868fece19c9f5069a36544a3fbda0a7adf61a3a99b9c6cb73b78b
Instruction ID: 48e98abdcb4a1c950c4ac2d898076f9678450d1f79db5ce3336d9566a7d463c5
Opcode Fuzzy Hash: c70ca5df36b868fece19c9f5069a36544a3fbda0a7adf61a3a99b9c6cb73b78b
Instruction Fuzzy Hash: 8E41B234605254EFCB01EF58C898EA97BF5FF4A314F2941A8E814DB6A1D730EA81CF90

Function 001816DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 001816EB

Part of subcall function 00153A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00153A57
Part of subcall function 00153A3D: GetCurrentThreadId.KERNEL32 ref: 00153A5E
Part of subcall function 00153A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,001525B3), ref: 00153A65

GetCaretPos.USER32(?), ref: 001816FF
ClientToScreen.USER32(00000000,?), ref: 0018174C
GetForegroundWindow.USER32 ref: 00181752

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: d5013485d722806143b784a2f4ca8d7909bd21a65d4f6395b20d239cb629fa79
Instruction ID: a90cc83fe443a30dd6365bab49b69a3812854a0b97f2692294b846d8f09211b7
Opcode Fuzzy Hash: d5013485d722806143b784a2f4ca8d7909bd21a65d4f6395b20d239cb629fa79
Instruction Fuzzy Hash: 2A313D76D00149AFDB00EFA9C881CEEBBFDEF48304B5480A9E515E7612DB319E45CBA1

Function 0015DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 000F7620: _wcslen.LIBCMT ref: 000F7625

_wcslen.LIBCMT ref: 0015DFCB
_wcslen.LIBCMT ref: 0015DFE2
_wcslen.LIBCMT ref: 0015E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0015E018

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: dcb67c935e5bfcbac8d16dc3b26e94174e5ac79d4fcadf9a8e5120805b377930
Instruction ID: 7fa9c4dd1b46364f84f45abdc438d45f4b3a1552bdcb661d44142051f08ac130
Opcode Fuzzy Hash: dcb67c935e5bfcbac8d16dc3b26e94174e5ac79d4fcadf9a8e5120805b377930
Instruction Fuzzy Hash: ED21A071900218EFCB24EFA8D882BAEB7F8EF55750F104065E914BB281D7709E41CBA1

Function 0015D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0015D501
Process32FirstW.KERNEL32(00000000,?), ref: 0015D50F
Process32NextW.KERNEL32(00000000,?), ref: 0015D52F
CloseHandle.KERNEL32(00000000), ref: 0015D5DC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 8877ea4fb4dd1901f4d7b515a02e00bab4f5439b6d26f9aa313d9743c998774d
Instruction ID: c7e835d488157b286248b7889aa4dadcbd90137d0073ab56b5e91c634116be52
Opcode Fuzzy Hash: 8877ea4fb4dd1901f4d7b515a02e00bab4f5439b6d26f9aa313d9743c998774d
Instruction Fuzzy Hash: A731E471108305DFD310EF50D885ABFBBF8EF99344F44052CF591861A2EB719A89CBA2

Function 00188FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00109BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00109BB2

GetCursorPos.USER32(?), ref: 00189001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00147711,?,?,?,?,?), ref: 00189016
GetCursorPos.USER32(?), ref: 0018905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00147711,?,?,?), ref: 00189094

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 1f2f3a6ae675af7999556c61078c6fb1281db1bb3b2337669205f3a231dacab1
Instruction ID: e7232dc9e22b14d975062d76edb52cee62044605576358a5cc4bcc371dcddc86
Opcode Fuzzy Hash: 1f2f3a6ae675af7999556c61078c6fb1281db1bb3b2337669205f3a231dacab1
Instruction Fuzzy Hash: C921A335600018FFCB159F94CC58EFA7BB9EF4A350F184155F5065B661C7359A90DF60

Function 0015D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0018CB68), ref: 0015D2FB
GetLastError.KERNEL32 ref: 0015D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0015D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0018CB68), ref: 0015D376

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: bca993ecab8d8bbc0ae62182535902fb54f90bfd8dae417bfa1b77f6d267d593
Instruction ID: 3004e561324aa8fd4750366f37c71f992c9bef2997a98927bd553eca0abe7d11
Opcode Fuzzy Hash: bca993ecab8d8bbc0ae62182535902fb54f90bfd8dae417bfa1b77f6d267d593
Instruction Fuzzy Hash: 542194B0505201DFC720DF24D8818AA77E4BF55365F504A1DF8A5CB2A1D730DA4ACB93

Function 00151571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00151014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0015102A
Part of subcall function 00151014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00151036
Part of subcall function 00151014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00151045
Part of subcall function 00151014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0015104C
Part of subcall function 00151014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00151062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 001515BE
_memcmp.LIBVCRUNTIME ref: 001515E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00151617
HeapFree.KERNEL32(00000000), ref: 0015161E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: fac22ebc58d565d1bf5ad6ef87f107ee662494c3dba7095e060bef06645d47be
Instruction ID: b472019443ee03f4295a24a1b3121e64306c7a72494d37b5873161cc81af42e4
Opcode Fuzzy Hash: fac22ebc58d565d1bf5ad6ef87f107ee662494c3dba7095e060bef06645d47be
Instruction Fuzzy Hash: 2C218C31E40108FFDF01DFA4C949BEEB7B8EF44356F084459E861AB241E770AA49CBA0

Function 00182782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0018280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00182824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00182832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00182840

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 45b64143c27eb765e41c6bd9bed7536d4d2f0810d53d049700991a71535960bb
Instruction ID: 70e08d3afc79ebb6ef4bf5baf7ee068119a6bdb17811bdab6f783815ed0736b2
Opcode Fuzzy Hash: 45b64143c27eb765e41c6bd9bed7536d4d2f0810d53d049700991a71535960bb
Instruction Fuzzy Hash: 95210331304511AFDB15AB24C844FAA7B95EF46324F148158F4268BAE2C775FE82CBD0

Function 001578F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00158D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0015790A,?,000000FF,?,00158754,00000000,?,0000001C,?,?), ref: 00158D8C
Part of subcall function 00158D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00158DB2
Part of subcall function 00158D7D: lstrcmpiW.KERNEL32(00000000,?,0015790A,?,000000FF,?,00158754,00000000,?,0000001C,?,?), ref: 00158DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00158754,00000000,?,0000001C,?,?,00000000), ref: 00157923
lstrcpyW.KERNEL32(00000000,?), ref: 00157949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00158754,00000000,?,0000001C,?,?,00000000), ref: 00157984

Strings

cdecl, xrefs: 0015797B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: a90ddbaa1078ed5ad6604071dc3d7831da2efcf665fcb06f75471173d5ffad16
Instruction ID: 33b62e47e89f91bc5b9f95b3342054939230a00a0b17b31be1990fdc1832eabf
Opcode Fuzzy Hash: a90ddbaa1078ed5ad6604071dc3d7831da2efcf665fcb06f75471173d5ffad16
Instruction Fuzzy Hash: BC11063A200242EBCB15AF35D846E7A77A5FF95365B00402AFC52CB2A4EB719905C7A1

Function 00187CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00187D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00187D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00187D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0016B7AD,00000000), ref: 00187D6B

Part of subcall function 00109BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00109BB2

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 41eacba15eb16b36da9248898a6d996f79d34b096914ec5247f19ccac4ef0476
Instruction ID: 83055c1fece9abcd7fddc5e9a66a264579c6b189ac0c1c7ee3077901cb0f4e82
Opcode Fuzzy Hash: 41eacba15eb16b36da9248898a6d996f79d34b096914ec5247f19ccac4ef0476
Instruction Fuzzy Hash: D2119032604655AFCB10AFA8CC04EA63BA5AF463A0B254728F835D76F1E730DA51CF90

Function 00185660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 001856BB
_wcslen.LIBCMT ref: 001856CD
_wcslen.LIBCMT ref: 001856D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00185816

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 7b3519c8eae8e9630b82647a1bea2be1a1e83b279cca864583a53c0d7ac544bc
Instruction ID: a2027e29f99b858b943f0883170f2fd95ed3731f3fba12969724809adcdf3959
Opcode Fuzzy Hash: 7b3519c8eae8e9630b82647a1bea2be1a1e83b279cca864583a53c0d7ac544bc
Instruction Fuzzy Hash: D911D075A00608A6DF20AF61CC85AEE7BBDEF11764B60403AF915D6081FB70CB84CFA0

Function 00121D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb33f4c4e0d3283a155896d12d5601e41cc8872fc0215a3b83fd1593ff5f81d
Instruction ID: eaca994d17d81730304c5bcf1debdad95687bede2cbd1a1b9007ce64698c19e2
Opcode Fuzzy Hash: edb33f4c4e0d3283a155896d12d5601e41cc8872fc0215a3b83fd1593ff5f81d
Instruction Fuzzy Hash: 8701A2B220563EBEFB2566B87CC8F67665CDF653B8B310325F521511D2DB708C614270

Function 00151A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00151A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00151A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00151A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00151A8A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fd762d1a6faef08c93d48a42b584f313b59e3c22587d1c292897734178274705
Instruction ID: 4f88c1e8f1d7f7c32ed11d197110bf9110035adfb8b883c495b857391530c242
Opcode Fuzzy Hash: fd762d1a6faef08c93d48a42b584f313b59e3c22587d1c292897734178274705
Instruction Fuzzy Hash: 0B113C3AD01219FFEB12DBA4CD85FADBB79EB04750F200091EA10B7290D7716E50DB94

Function 0015E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0015E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0015E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0015E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0015E24D

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: e091f763b1ddfbd15e2d17aa5123003d3d5bb657f24665c4822ca25281995b1e
Instruction ID: aef3130b0e9fa3ff6380b858b0246a839acbcd09a6aef1a0c1ff599787b6781c
Opcode Fuzzy Hash: e091f763b1ddfbd15e2d17aa5123003d3d5bb657f24665c4822ca25281995b1e
Instruction Fuzzy Hash: B2110876D04294FBC7059FA8AC09E9E7FADEB45325F004255F825D7691D7B0CA4487B0

Function 0011D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0011CFF9,00000000,00000004,00000000), ref: 0011D218
GetLastError.KERNEL32 ref: 0011D224
__dosmaperr.LIBCMT ref: 0011D22B
ResumeThread.KERNEL32(00000000), ref: 0011D249

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 930b9a13747c3eeb2c5449dc1391e1f45bc9a8fb9276cb74b85db1ca26ddd53c
Instruction ID: 563cd8f57516fe3c9d362aef78090fec894a6fb9f89fc8c57b2de693e150403f
Opcode Fuzzy Hash: 930b9a13747c3eeb2c5449dc1391e1f45bc9a8fb9276cb74b85db1ca26ddd53c
Instruction Fuzzy Hash: F901D236805214BBCB195BA5EC09BEE7B69EF91330F200239F925921D0DF71C982C7E1

Function 00189EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00109BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00109BB2

GetClientRect.USER32(?,?), ref: 00189F31
GetCursorPos.USER32(?), ref: 00189F3B
ScreenToClient.USER32(?,?), ref: 00189F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00189F7A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 37102388f7be05a35677fb69a4fb6c7416a6b50144412587cd9aa66adde39c33
Instruction ID: 25030b567a8736c3332366072016ba68c25c666990ba91d8e90c0240edfa9fa3
Opcode Fuzzy Hash: 37102388f7be05a35677fb69a4fb6c7416a6b50144412587cd9aa66adde39c33
Instruction Fuzzy Hash: A511363290011AABDB05EFA8D885DFE7BB9FB05311F140455FA12E3541D330BB81CBA1

Function 000F600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000F604C
GetStockObject.GDI32(00000011), ref: 000F6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 000F606A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 6804d9312940cf0e59b476a5c1d5cfa5aa38d585b4c2f8a596f4375df08a5a2a
Instruction ID: 1b796bdf399cc2408e0263732acb86d16161fdba743ef91791e3b5b6fc1dcb7a
Opcode Fuzzy Hash: 6804d9312940cf0e59b476a5c1d5cfa5aa38d585b4c2f8a596f4375df08a5a2a
Instruction Fuzzy Hash: 92115B7250150CBFEF224FA49C54EFBBBA9EF193A4F140215FA1552510DB32ADA0ABA0

Function 00113B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00113B56

Part of subcall function 00113AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00113AD2
Part of subcall function 00113AA3: ___AdjustPointer.LIBCMT ref: 00113AED

_UnwindNestedFrames.LIBCMT ref: 00113B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00113B7C
CallCatchBlock.LIBVCRUNTIME ref: 00113BA4

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: c2d57956a74a9ca28b5f7ab9c9061dd6183b0cf84e65e5b2c722bf558725426e
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 38014C72100148BBDF165E95CC42EEB3F6DEF58B54F044024FE5896121D732E9A1EBA0

Function 00123073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,000F13C6,00000000,00000000,?,0012301A,000F13C6,00000000,00000000,00000000,?,0012328B,00000006,FlsSetValue), ref: 001230A5
GetLastError.KERNEL32(?,0012301A,000F13C6,00000000,00000000,00000000,?,0012328B,00000006,FlsSetValue,00192290,FlsSetValue,00000000,00000364,?,00122E46), ref: 001230B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0012301A,000F13C6,00000000,00000000,00000000,?,0012328B,00000006,FlsSetValue,00192290,FlsSetValue,00000000), ref: 001230BF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 9904b6e3c8860a344a2aef0567cf20ff9d9ea42222233434841d99b44bfd2d30
Instruction ID: 0874994478794ffd6d5770a0d564aca89c54f44d10827c39d98d435098878425
Opcode Fuzzy Hash: 9904b6e3c8860a344a2aef0567cf20ff9d9ea42222233434841d99b44bfd2d30
Instruction Fuzzy Hash: D101F732701236ABCB314B78BC48A577B98AF05B61B110620F925E3680C735DA91C7F4

Function 00157464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0015747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00157497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 001574AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 001574CA

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: f16d3a1b5d264521e8c55de04a6e87ae8805ec9af2e90919c52b4f5759dc83c7
Instruction ID: 74e113ba0fea50df1d8798f954d117a1a61c990ce8cb7afd81d4f85b6e800461
Opcode Fuzzy Hash: f16d3a1b5d264521e8c55de04a6e87ae8805ec9af2e90919c52b4f5759dc83c7
Instruction Fuzzy Hash: 3911A1B1209310DFE7208F24EC0EF927BFCEB00B01F108569AE26DA591D770E948DBA1

Function 0015B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0015ACD3,?,00008000), ref: 0015B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0015ACD3,?,00008000), ref: 0015B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0015ACD3,?,00008000), ref: 0015B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0015ACD3,?,00008000), ref: 0015B126

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: b221dbbf086b0fd5d5fa0c1d39e1c57a7b669b8300cb13dec67719270c406723
Instruction ID: f0d745a5a21f51bdf5b26c3b3df9ad322a017063ecbf70e81a7a11bd8b9dce66
Opcode Fuzzy Hash: b221dbbf086b0fd5d5fa0c1d39e1c57a7b669b8300cb13dec67719270c406723
Instruction Fuzzy Hash: 17118E70C0591CDBCF04AFE5E9D86EEBB78FF09712F014085D951B6181CB3046548BA1

Function 00187E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00187E33
ScreenToClient.USER32(?,?), ref: 00187E4B
ScreenToClient.USER32(?,?), ref: 00187E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00187E8A

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 2e945e575bc9305ec7f6464286a00e1f694e3d5a2b21f8dceff53c7f547ac439
Instruction ID: 4ba8f06983456d2a44781fc814ccec2717d4fb1f54282258416672c0cfea31eb
Opcode Fuzzy Hash: 2e945e575bc9305ec7f6464286a00e1f694e3d5a2b21f8dceff53c7f547ac439
Instruction Fuzzy Hash: C91159B9D00249AFDB41DF98C444AEEBBF5FF18310F505066E925E3610D735AA54CF90

Function 00152DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00152DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00152DD6
GetCurrentThreadId.KERNEL32 ref: 00152DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00152DE4

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: e6e7070591377315ad5d0876b76fe31125048ae45a2659d1c57660f5d585fb52
Instruction ID: fbf34ee85a1ee66b45b94dd5ad6a4f7b7e751efc1038bac609f0998c9c73370c
Opcode Fuzzy Hash: e6e7070591377315ad5d0876b76fe31125048ae45a2659d1c57660f5d585fb52
Instruction Fuzzy Hash: B1E06D72101224BAD7201BA2AC0DEEB3E6CEB43BA2F100125F905D5580AAB48A84C7F0

Function 00188863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00109639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00109693
Part of subcall function 00109639: SelectObject.GDI32(?,00000000), ref: 001096A2
Part of subcall function 00109639: BeginPath.GDI32(?), ref: 001096B9
Part of subcall function 00109639: SelectObject.GDI32(?,00000000), ref: 001096E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00188887
LineTo.GDI32(?,?,?), ref: 00188894
EndPath.GDI32(?), ref: 001888A4
StrokePath.GDI32(?), ref: 001888B2

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 1aedc7e6f017b04982d068307d5cb0018bdc25d52c94b2b3a1e76e45480c70c0
Instruction ID: 15e8d6f6abea08ad66d825bc584132889a2bc2f3c6297a63aac7cbab0461e395
Opcode Fuzzy Hash: 1aedc7e6f017b04982d068307d5cb0018bdc25d52c94b2b3a1e76e45480c70c0
Instruction Fuzzy Hash: 34F0583A041258FAEB126F94AC0EFCE3F69AF06310F448000FA11654E2C7B556A1CFF9

Function 001098B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 001098CC
SetTextColor.GDI32(?,?), ref: 001098D6
SetBkMode.GDI32(?,00000001), ref: 001098E9
GetStockObject.GDI32(00000005), ref: 001098F1

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: e0b7abb8220a1abdcc2c12093b3ea381dd775a599d3adfef37fa62be30d6090b
Instruction ID: 8ac71da311eb20c361a65bced925149adaba717d6e81aca08f1c81fb4af00d21
Opcode Fuzzy Hash: e0b7abb8220a1abdcc2c12093b3ea381dd775a599d3adfef37fa62be30d6090b
Instruction Fuzzy Hash: 3BE06D31244680EEDB215B74BC1DBE83F21AB52336F04821AF6FA584E1C37147809B20

Function 0015162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00151634
OpenThreadToken.ADVAPI32(00000000,?,?,?,001511D9), ref: 0015163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,001511D9), ref: 00151648
OpenProcessToken.ADVAPI32(00000000,?,?,?,001511D9), ref: 0015164F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 0e371202cc7992e045c6543ebd23036d312e13c1f3061ba114c76dbf92375532
Instruction ID: 2fff5fc2c856cec035d9a1cfac52833c4676f93217207fa1f85a6ab8f50526a5
Opcode Fuzzy Hash: 0e371202cc7992e045c6543ebd23036d312e13c1f3061ba114c76dbf92375532
Instruction Fuzzy Hash: FBE08C36602211EBD7201FB0AE0DB873B7CAF557D2F158808FA46CD480E7748685CBB0

Function 0014D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0014D858
GetDC.USER32(00000000), ref: 0014D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0014D882
ReleaseDC.USER32(?), ref: 0014D8A3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 42c072a43d950df7255a1677bbd9920e55348069314dea4fac60862cbc94ca4e
Instruction ID: 11be9e7c22a09f7ac1fb266cc4a54a887ca181a11f941fd9169e1e1eb6848386
Opcode Fuzzy Hash: 42c072a43d950df7255a1677bbd9920e55348069314dea4fac60862cbc94ca4e
Instruction Fuzzy Hash: 3BE01AB4800205DFCF419FB0E908A6DFBB1FB08310F218029F94AE7750D7384A81AFA0

Function 0014D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0014D86C
GetDC.USER32(00000000), ref: 0014D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0014D882
ReleaseDC.USER32(?), ref: 0014D8A3

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 13cb96aa3f938bd05ae9db1ecd57eac0a2992443f0225b5bf3e089c89c30c7f8
Instruction ID: a31a2857f73e8a87c427082e14fcd9e170d883c07cb7b563d5bdce4516f81fd5
Opcode Fuzzy Hash: 13cb96aa3f938bd05ae9db1ecd57eac0a2992443f0225b5bf3e089c89c30c7f8
Instruction Fuzzy Hash: 58E01A74800204DFCB409FB0E80866DBBB1BB08310B208018F94AE7750D7385A41AFA0

Function 00164D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 000F7620: _wcslen.LIBCMT ref: 000F7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00164ED4

Strings

LPT, xrefs: 00164DFB
*, xrefs: 00164E10

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 546961e6707e50873364ed3986f4949162f7763df762faa4a0e4029cbb0955e7
Instruction ID: 0929ad786dd2826c3a148265c45662a66ccd5efca0b8d19c9cbe1549b5c6fa5e
Opcode Fuzzy Hash: 546961e6707e50873364ed3986f4949162f7763df762faa4a0e4029cbb0955e7
Instruction Fuzzy Hash: 28916F75A002049FCB14DF58C884EAABBF1BF44304F198099E84A9F7A2D775EE95CB91

Function 0011E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0011E30D

Strings

pow, xrefs: 0011E2E5, 0011E302

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 2c3ec7d5b6e26c1fc04f444b73c52c8fe8ef1426cedc88b94546b837337d2c9f
Instruction ID: 646feca231328544d6a0545f875035b00c7ab5884ee8018230305a5765b3ebea
Opcode Fuzzy Hash: 2c3ec7d5b6e26c1fc04f444b73c52c8fe8ef1426cedc88b94546b837337d2c9f
Instruction Fuzzy Hash: 56519E61A1C116A6CB1D77A4E9013FB3BE4EB10740F3449B9E8E5832E9DB348CE19A46

Function 0010E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0010E1B1

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 98f05476cd6e86dd86b5277e1fcfe6f9ebb719f293e07c7b832a7fdc43c57c39
Instruction ID: f2a9a773dba71ca2c3cc2e7ab65f313e567229ea999d17f98ec522fcc2346672
Opcode Fuzzy Hash: 98f05476cd6e86dd86b5277e1fcfe6f9ebb719f293e07c7b832a7fdc43c57c39
Instruction Fuzzy Hash: 5B513175900246DFDB19DF68C481AFA7BE8FF25320F244469F8919B2E0DB309D42CBA0

Function 0010F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0010F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0010F2BB

Strings

@, xrefs: 0010F2AF

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 9e9f99fc77c2303fc749eeef2bfef7196ec9fe8a4269bbc48186bdf56b5d3133
Instruction ID: 5dd16a07fe9d755a07a4b4427590319d82d91c7fb1c14b795cd33dbe9f66d16b
Opcode Fuzzy Hash: 9e9f99fc77c2303fc749eeef2bfef7196ec9fe8a4269bbc48186bdf56b5d3133
Instruction Fuzzy Hash: 0A5138714087499BE320AF14D886BABBBF8FF85300F81485DF2D941196EB718969CB67

Function 00175745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 001757E0
_wcslen.LIBCMT ref: 001757EC

Strings

CALLARGARRAY, xrefs: 001757E6, 001757EB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 63f32d044ab79ee4cca9180f2ab4e7b1f9e51ceaf8f2cafb55f125c7200792e4
Instruction ID: 16323ea2e8973aeec230ffa12d62b9ceb02493bac0b4f83bbdf2bf735c612af1
Opcode Fuzzy Hash: 63f32d044ab79ee4cca9180f2ab4e7b1f9e51ceaf8f2cafb55f125c7200792e4
Instruction Fuzzy Hash: A341A371E001099FCB14DFAAC8859FEBBB5FF59314F50806DE509A7291D7B09D81CB91

Function 0016D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0016D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0016D13A

Strings

|, xrefs: 0016D10B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: af1d46497e2feb8ce7dcbc1fd0eb441193edd1e47b3ca977c700728acb3b1536
Instruction ID: b20cdc1b8e3dc55b63bfcab6d3c95e9ae9937b036c43930a761419db939990d9
Opcode Fuzzy Hash: af1d46497e2feb8ce7dcbc1fd0eb441193edd1e47b3ca977c700728acb3b1536
Instruction Fuzzy Hash: F8316F71D00209ABCF15EFA4DC85EEEBFB9FF05300F000059F915A6162DB71AA56DB60

Function 0018356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00183621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0018365C

Strings

static, xrefs: 001835BC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 3cc0acafee04432f4c5d52ee4a31644d34f9907c40025c543a17e729afe3bc52
Instruction ID: f7002059b05c38f96e68b3cf7bbea586524e2b99bec3481f481958d7e998ccc4
Opcode Fuzzy Hash: 3cc0acafee04432f4c5d52ee4a31644d34f9907c40025c543a17e729afe3bc52
Instruction Fuzzy Hash: 2E318F71110604AEDB10AF28DC81EFB73A9FF58B60F148619F9A597280DB31EE91DB60

Function 00184537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0018461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00184634

Strings

', xrefs: 0018458E

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: cc4154f11d62733b75d56932a704986899eadacd2b55fc43b0b3d95fd0fa4044
Instruction ID: 50b09982501d1a10137e303672f0f498e5e73c554843ec88bf3fbda181db8111
Opcode Fuzzy Hash: cc4154f11d62733b75d56932a704986899eadacd2b55fc43b0b3d95fd0fa4044
Instruction Fuzzy Hash: D631F874A0130A9FDB14DFA9C991BDE7BB5FF49304F24406AE905AB351EB70AA41CF90

Function 001831EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0018327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00183287

Strings

Combobox, xrefs: 00183249

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 94b878e2a28c036d5b396edc9e1d85a2faedbe8552fc4ec7559aa60a227d14a8
Instruction ID: 909f3ab2ac30d44de702d2d745b0fa2a377361baf35dbd0302c7a005b2ded5ba
Opcode Fuzzy Hash: 94b878e2a28c036d5b396edc9e1d85a2faedbe8552fc4ec7559aa60a227d14a8
Instruction Fuzzy Hash: 7A11B2713002087FEF25AE54DC84EFB3B6BEB947A4F144124F92897291D771DE519B60

Function 00183710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 000F600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 000F604C
Part of subcall function 000F600E: GetStockObject.GDI32(00000011), ref: 000F6060
Part of subcall function 000F600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 000F606A

GetWindowRect.USER32(00000000,?), ref: 0018377A
GetSysColor.USER32(00000012), ref: 00183794

Strings

static, xrefs: 00183757

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 4f5fb087b35ced35f015c45b42b101392e9c43033e3819669849d450ef833f10
Instruction ID: 521327ee90b5b5769ed0488bc480e248fe3d937e4e9a6bc451b651cfccd28600
Opcode Fuzzy Hash: 4f5fb087b35ced35f015c45b42b101392e9c43033e3819669849d450ef833f10
Instruction Fuzzy Hash: DB1129B2610209AFDF01EFA8CC45EEA7BB8FB08754F044515F965E2250E735E9519B60

Function 0016CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0016CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0016CDA6

Strings

<local>, xrefs: 0016CD66

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: d4d90453718aa9e53614941bcae699779e29114cf316d063d1108e284f7470d5
Instruction ID: fe49612588eab254b6e732c8496631b251150788bb1c99e17b30b3bdc9b8acd1
Opcode Fuzzy Hash: d4d90453718aa9e53614941bcae699779e29114cf316d063d1108e284f7470d5
Instruction Fuzzy Hash: CA11C271205631BAD7385BA68C49EF7BEACEF227A4F00422AB58983080D7749964D6F0

Function 00183429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 001834AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 001834BA

Strings

edit, xrefs: 0018348F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: fe9aa20388ff4cdae77138136ac35a15ad9fa66019273f660f9336f1acc7da9c
Instruction ID: d2cc7d6f1f22f718e67261adf8b1257ab3a3208d13ec7f622ddc4b9440a74549
Opcode Fuzzy Hash: fe9aa20388ff4cdae77138136ac35a15ad9fa66019273f660f9336f1acc7da9c
Instruction Fuzzy Hash: 35116D71100108AAEF12AE64DC84AFB376AEF15B74F644724F971931D0C771DE919B60

Function 00156C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00156CB6
_wcslen.LIBCMT ref: 00156CC2

Strings

STOP, xrefs: 00156CBC, 00156CC1

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: dd50dc7bb5274a9ed277edfcdae533fac785ec71e157573355b74dadf37510e3
Instruction ID: d631c2cb9df639cd72934d147070b116833b25e8e39cc1bafcfd9517258e098e
Opcode Fuzzy Hash: dd50dc7bb5274a9ed277edfcdae533fac785ec71e157573355b74dadf37510e3
Instruction Fuzzy Hash: 5C01A13260052ACA8B219FFDDC819BF77B5EB617617910928EC729B191EB31D948C690

Function 00151CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 00153CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00153CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00151D4C

Strings

ListBox, xrefs: 00151D16
ComboBox, xrefs: 00151CEB

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 254546a4f84b34197a2512180d31282b5151b020c990db38478b3be45b80d5fe
Instruction ID: 6a5195c517f70f3be0cc97db5ffea2de433f4d74922de3bd162fac9e8a043bba
Opcode Fuzzy Hash: 254546a4f84b34197a2512180d31282b5151b020c990db38478b3be45b80d5fe
Instruction Fuzzy Hash: 2401F531600218EBCB09EFA0CD15AFE7379EB56390B04091AEC325B2C2EB71590D9660

Function 00151BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 00153CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00153CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00151C46

Strings

ListBox, xrefs: 00151C10
ComboBox, xrefs: 00151BE5

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 52c9888ff64d6bd96de0da9071ac51b0d76146ee2ec4d6bae861fcd10840db64
Instruction ID: 2ee8ba31eec6b176974f635f8dc15d55cf84411bad1527e16b2e0896376704a6
Opcode Fuzzy Hash: 52c9888ff64d6bd96de0da9071ac51b0d76146ee2ec4d6bae861fcd10840db64
Instruction Fuzzy Hash: E401F771680108B6CB09EB90CA52BFF77A99F11380F14001AED266B282EB219F0CD6B1

Function 00151C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 00153CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00153CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00151CC8

Strings

ListBox, xrefs: 00151C94
ComboBox, xrefs: 00151C69

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 294cade37e0c0e787d67fe4709c5fd34e81054db5cdcbcb079fd803a7d1a4145
Instruction ID: 0e391b694c6b3b43b0f034c8f1dc45fbc640a31abae2bc1b2d0f08d98c2913d2
Opcode Fuzzy Hash: 294cade37e0c0e787d67fe4709c5fd34e81054db5cdcbcb079fd803a7d1a4145
Instruction Fuzzy Hash: 3601DB71640118B7CB05EB90CB02BFE77A99B11381F540015BD2177282EB619F0DD6B1

Function 00151D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000F9CB3: _wcslen.LIBCMT ref: 000F9CBD

Part of subcall function 00153CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00153CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00151DD3

Strings

ListBox, xrefs: 00151DA0
ComboBox, xrefs: 00151D75

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 4c91ccbc7f70d5dd6c9432fe44c7251d8040fb5a98521e26bce262adfc450d78
Instruction ID: 3f0cf56b60ba13063b980df7d014badc20dd866d72218f924c6e602b305e3f3c
Opcode Fuzzy Hash: 4c91ccbc7f70d5dd6c9432fe44c7251d8040fb5a98521e26bce262adfc450d78
Instruction Fuzzy Hash: 61F0F471A40218B6CB09EBE4CD56BFE7778AB01380F440915FD32AB2C2EB705A0C82A0

Function 0017747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00177493
_wcslen.LIBCMT ref: 001774B9

Strings

3, 3, 16, 1, xrefs: 00177483

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 354bd5e4823b49385acf83fa98663c95c184764e4f6116a29b7f21e98a45ff1d
Instruction ID: edaaaa6efc127a3db624b107674156e662621b10aeaabd324ac219aaf7c8f6a5
Opcode Fuzzy Hash: 354bd5e4823b49385acf83fa98663c95c184764e4f6116a29b7f21e98a45ff1d
Instruction Fuzzy Hash: 6CE02B02204220119235127AACC19BF56D9DFD9B50B14183BF98AC22F6EB948DD193A0

Function 00150B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00150B23

Strings

AutoIt, xrefs: 00150B17
Error allocating memory., xrefs: 00150B1C

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 5c3c23fdac2932f35f788efabecdff6a550a8a0baf457a991157028f10c32ef6
Instruction ID: ac2dfca994b6bb61b4dbd8ef356e13e4ab05a2b5f28e8d0ef9eada5181d1246d
Opcode Fuzzy Hash: 5c3c23fdac2932f35f788efabecdff6a550a8a0baf457a991157028f10c32ef6
Instruction Fuzzy Hash: A0E0D83124430826D22437947C03FC97B858F15F15F10046AFB98598C38BE2259007F9

Function 00110D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0010F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00110D71,?,?,?,000F100A), ref: 0010F7CE

IsDebuggerPresent.KERNEL32(?,?,?,000F100A), ref: 00110D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,000F100A), ref: 00110D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00110D7F

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 5daa03bdf6f3b1097fce8563a5d58f9cae2c208357b0e5ed57b7923ee54b1a0f
Instruction ID: 5c4a216e9a5fe8a779a59c09feec6df022296eb33ded2f4a23918d622e56b7d8
Opcode Fuzzy Hash: 5daa03bdf6f3b1097fce8563a5d58f9cae2c208357b0e5ed57b7923ee54b1a0f
Instruction Fuzzy Hash: 40E06D746007418BD731AFB8E8087827BE1AB18744F00493DE486C6A92EBF4E5C58BE1

Function 00163017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0016302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00163044

Strings

aut, xrefs: 00163038

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 2ac8d16d01552b01f18d5234d8e5b4400d4733ce71e4edf5e29acef35719708e
Instruction ID: 775464494a4cac1c4dcab0a5398dc345f2276aea76899cee45620a1a35a6671e
Opcode Fuzzy Hash: 2ac8d16d01552b01f18d5234d8e5b4400d4733ce71e4edf5e29acef35719708e
Instruction Fuzzy Hash: 86D05E7250032867DA20A7A4AC4EFCB7A7CDB04750F0002A1B655E24D1DBB49A84CBE0

Function 0014D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0014D220

Strings

X64, xrefs: 0014D2A8
%.3d, xrefs: 0014D22B

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: af89d0aaab9eaba988ea0805b6945627d7018afda71d3a831235d38c117f6611
Instruction ID: 37f7fc87eb92c35668b38948c2d86a55fea1f04127342cea7f9e03653e9f45b7
Opcode Fuzzy Hash: af89d0aaab9eaba988ea0805b6945627d7018afda71d3a831235d38c117f6611
Instruction Fuzzy Hash: 81D01271808109EACF9496D0EC49CBAB3BCBB18341F518462F80791090D7B4C5486B61

Function 00182322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0018232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0018233F

Part of subcall function 0015E97B: Sleep.KERNELBASE ref: 0015E9F3

Strings

Shell_TrayWnd, xrefs: 00182325

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 6a9f167fa7c57b153dee43d441b393e1106e976836ce9abc7b49b86bc92bddd1
Instruction ID: b3925143930c8dba38e55ee8062fc24cd178a65fbc63b775d0e418fa8cd48821
Opcode Fuzzy Hash: 6a9f167fa7c57b153dee43d441b393e1106e976836ce9abc7b49b86bc92bddd1
Instruction Fuzzy Hash: 38D022323C0300B7E668B330DC0FFC67A049B10B00F104912B705AA1D0CAF0A845CBA0

Function 00182356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0018236C
PostMessageW.USER32(00000000), ref: 00182373

Part of subcall function 0015E97B: Sleep.KERNELBASE ref: 0015E9F3

Strings

Shell_TrayWnd, xrefs: 00182365

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 684b5c467b2f90b7332460050c4133148f007730ab88f06c207e9952edd258b7
Instruction ID: 56dcbb21debd2be6ee5ccaa88d7deb540dd4ee14f02ac2379ad76d97814d0355
Opcode Fuzzy Hash: 684b5c467b2f90b7332460050c4133148f007730ab88f06c207e9952edd258b7
Instruction Fuzzy Hash: 3AD022323C0300BBE668B330DC0FFC676049B10B00F104912B701EA1D0CAF0B845CBA4

Function 0012BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0012BE93
GetLastError.KERNEL32 ref: 0012BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0012BEFC

Memory Dump Source

Source File: 00000000.00000002.2904894013.00000000000F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.2904874905.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2904956110.00000000001B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905042174.00000000001BC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2905062625.00000000001C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: d0ccdf8038657d4cbd7ed74422c9a1ee1e74dc0b4d6d0be550615d8fd4abdc38
Instruction ID: 236857deb8058400e87cff6bbafcfad2f2783b4ea704462d66c2af78c67e40c2
Opcode Fuzzy Hash: d0ccdf8038657d4cbd7ed74422c9a1ee1e74dc0b4d6d0be550615d8fd4abdc38
Instruction Fuzzy Hash: B2413835608226EFCF258F64FDC4ABA7BA5EF01320F154169F969972A1DB308D61CB60

Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725734536&P2=404&P3=2&P4=HZyZCpjvtvEsj9AQQUAOcfXwpT5P1CqgwuE6lAyTtmiB2PMIRmOaDySoNtOxlRwPH9qZ%2fNmInPyF8M9QeMdTKg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: +C7/aPGTCdKAMU6XLtmJHNSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zzBvX73tGYgumKy&MD=hZ8pXY2C HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725734536&P2=404&P3=2&P4=HZyZCpjvtvEsj9AQQUAOcfXwpT5P1CqgwuE6lAyTtmiB2PMIRmOaDySoNtOxlRwPH9qZ%2fNmInPyF8M9QeMdTKg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: +C7/aPGTCdKAMU6XLtmJHNSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zzBvX73tGYgumKy&MD=hZ8pXY2C HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.228
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.65.238

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0e00f2d3-da92-4a76-9003-31ebd7e4f5f4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2a82bf36-3109-499c-a09b-dd0f41a0a5df.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\47155aac-479d-4ec1-84f4-f9c668b9bec4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\55671503-efd2-4539-a0c0-4338fd35365c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\574b6902-6bad-4524-b9b8-522d1058595e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\58bf19db-d52e-4607-8b79-3c50f8d40d55.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\b7657620-5c5d-465b-8de5-7c4edd145049.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D363F1-1C80.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D363F1-1D84.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1337456d-e740-471d-b72b-0924a5afacbe.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\522ecc12-af21-4c9a-bd54-b5dc7f9f285c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\5e28b23a-fb8b-4067-b53a-0a6766b9947e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6cad41c5-f774-4a76-8839-31ec1d79c7c1.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre