Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502268
MD5:	4ea77c57cb0e4de372edd5e2d1ae4a82
SHA1:	0eb5ce10901508bd6617b8312cfbe41e1ebf7b23
SHA256:	accf43f97945d8b74f25174f9b69a8df69bd60386bd1a74ae53bc7c927495bfc
Tags:	exe
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

file.exe (PID: 1456 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4EA77C57CB0E4DE372EDD5E2D1AE4A82)

msedge.exe (PID: 3428 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 4776 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,15235259341285427299,2014034070172722539,262144 --disable-features=TranslateUI /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2528 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7252 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8340 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4864 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8416 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7476 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8428 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7476 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 9200 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2120,i,13241068222075852022,1718950494124032018,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=2108 --field-trial-handle=2120,i,13241068222075852022,1718950494124032018,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8416 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 420 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=2032,i,11473371370327430198,7085008301225761356,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.3412352804.0000000000E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?GG
Source: file.exe, 00000000.00000002.3412352804.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3412352804.0000000000E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.6.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.6.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.6.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.6.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.6.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.6.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.3412352804.0000000000E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password
Source: Web Data.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Top Sites.5.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.5.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49766 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0058EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0058EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0058ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0058ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0058EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0057AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0057AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005A9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_005A9576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.2163045777.00000000005D2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_130af297-5
Source: file.exe, 00000000.00000000.2163045777.00000000005D2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1b860f9b-a
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fc23e203-7
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c5836b66-1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0057D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0057D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00571201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00571201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0057E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0057E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00582046	0_2_00582046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00518060	0_2_00518060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00578298	0_2_00578298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054E4FF	0_2_0054E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054676B	0_2_0054676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005A4873	0_2_005A4873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051CAF0	0_2_0051CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053CAA0	0_2_0053CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052CC39	0_2_0052CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00546DD9	0_2_00546DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052B119	0_2_0052B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005191C0	0_2_005191C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00531394	0_2_00531394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053781B	0_2_0053781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052997D	0_2_0052997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00517920	0_2_00517920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00537A4A	0_2_00537A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00537CA7	0_2_00537CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059BE44	0_2_0059BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00549EEE	0_2_00549EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051BF40	0_2_0051BF40

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0052F9F2 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00530A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00519CB3 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.evad.winEXE@72/302@14/9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005837B5 GetLastError,FormatMessageW,

0_2_005837B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005710BF AdjustTokenPrivileges,CloseHandle,		0_2_005710BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005716C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_005716C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005851CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_005851CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0059A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0059A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0058648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0058648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005142A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_005142A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\7487b225-6db5-4b93-a765-50311d58ce49.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.5.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,15235259341285427299,2014034070172722539,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7252 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4864 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7476 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7476 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2120,i,13241068222075852022,1718950494124032018,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=2108 --field-trial-handle=2120,i,13241068222075852022,1718950494124032018,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=2032,i,11473371370327430198,7085008301225761356,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,15235259341285427299,2014034070172722539,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7252 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4864 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7476 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7476 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2120,i,13241068222075852022,1718950494124032018,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=2108 --field-trial-handle=2120,i,13241068222075852022,1718950494124032018,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=2032,i,11473371370327430198,7085008301225761356,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005142DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005142DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00530A76 push ecx; ret

0_2_00530A89

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_514DE308F6F4B9B80A28CF3B7E19969F			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_514DE308F6F4B9B80A28CF3B7E19969F			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0052F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005A1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_005A1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96165

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6467

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 4.1 %

Source: C:\Users\user\Desktop\file.exe TID: 6828

Thread sleep time: -64670s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6467 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0057DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054C2A2 FindFirstFileExW,	0_2_0054C2A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005868EE FindFirstFileW,FindClose,	0_2_005868EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0058698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0057D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0057D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00589642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00589642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0058979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00589B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00589B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00585C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00585C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005142DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005142DE

Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.15.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.15.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.15.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.15.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Web Data.15.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.15.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Web Data.15.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.15.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Web Data.15.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.15.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.15.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.15.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.15.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.15.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.15.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Web Data.15.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.15.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-95763

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0058EAA2 BlockInput,

0_2_0058EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00542622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00542622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005142DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005142DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00534CE8 mov eax, dword ptr fs:[00000030h]

0_2_00534CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00570B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00570B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00542622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00542622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0053083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005309D5 SetUnhandledExceptionFilter,	0_2_005309D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00530C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00530C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00571201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00552BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00552BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0052F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_0052F98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005922DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_005922DA

Source: C:\Users\user\Desktop\file.exe

0_2_00570B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00571663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00571663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00530698 cpuid

0_2_00530698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00588195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00588195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0056D27A GetUserNameW,

0_2_0056D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0054B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_0054B952

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005142DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005142DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00591204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00591204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00591806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00591806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	22%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://myaccount.google.com/signinoptions/password	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	unknown
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.5.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.5.dr	false	URL Reputation: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.6.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.5.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.6.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.5.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.5.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.5.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.5.dr	false	URL Reputation: safe	unknown
https://myaccount.google.com/signinoptions/password	file.exe, 00000000.00000002.3412352804.0000000000E1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.40.238	unknown	United States	15169	GOOGLEUS	false
172.253.63.84	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.65.238	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.80.4	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502268
Start date and time:	2024-08-31 22:04:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal72.evad.winEXE@72/302@14/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 311
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 173.194.76.84, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.19.126.145, 2.19.126.152, 172.217.16.195, 142.250.186.35, 2.23.209.135, 2.23.209.187, 2.23.209.149, 2.23.209.189, 2.23.209.140, 2.23.209.133, 2.23.209.150, 2.23.209.130, 2.23.209.185, 20.199.58.43, 192.229.221.95, 93.184.221.240, 142.250.65.195, 142.251.35.163, 142.250.65.227, 142.250.80.67, 142.251.40.163, 23.44.133.38, 23.44.133.57
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, iris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.com, arc.msn.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, client.wns.windows.com, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, ctldl.windowsupdate.com, b-0005.b-msedge.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype.com, edgeassetservice.azureedge.net, azureedge-t-prod.trafficmanager.net, business.bing.com, dual-a-0036.a-msedge.net
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:05:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_514DE308F6F4B9B80A28CF3B7E19969F "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
22:05:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_514DE308F6F4B9B80A28CF3B7E19969F "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
162.159.61.3	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	file.exe	Get hash	malicious	Unknown	Browse
	http://sin1.contabostorage.com	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://emp.eduyield.com/el?aid=28gedda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/innhanhanhsang.com.vn/.dev/RgZNq3Jz/a2ltLmZvcmRAcmF2ZWlzLmNvbQ==$%C3%A3%E2%82%AC	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	Bee2Pay Executed Docs#273291(Revised).pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://nexgenodisha.in/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Launcher_x32_x64.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	l5u4ezxr.u51.exe	Get hash	malicious	LummaC	Browse	104.21.69.149
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Win64.MalwareX-gen.30136.14956.exe	Get hash	malicious	Unknown	Browse	172.65.154.135
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	162.159.134.233
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
CLOUDFLARENETUS	Launcher_x32_x64.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	l5u4ezxr.u51.exe	Get hash	malicious	LummaC	Browse	104.21.69.149
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Win64.MalwareX-gen.30136.14956.exe	Get hash	malicious	Unknown	Browse	172.65.154.135
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	162.159.134.233
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	Order enquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	aisuru.arm5.elf	Get hash	malicious	Unknown	Browse	51.120.241.156
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	13.107.21.239
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	http://telegramz.fit/0.9667823786305711	Get hash	malicious	Telegram Phisher	Browse	173.222.162.64
	https://telegrern.icu/?8a18ab92c44a9607e8cddc31d16d5729	Get hash	malicious	Telegram Phisher	Browse	173.222.162.64
	http://telegxrami.fit/0.9667823786305711	Get hash	malicious	Telegram Phisher	Browse	173.222.162.64
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	http://free-5437404.webadorsite.com/	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	http://find-phone.za.com/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://ipfs.io/ipfs/bafkreiefwh3zxxltcpmcssu4253x5djs5ybtnn74zwc2o3fxssxo3y2u3i	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://seoservicesiox.firebaseapp.com/&err=b0qmbz0rr7j7jwfxwuge?err=am30dbsswi0	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	http://cpsenrgy.com	Get hash	malicious	Unknown	Browse	173.222.162.64
	http://oc.onos.eslt.cp.sulaimonandco.com/ge	Get hash	malicious	Unknown	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
	http://sin1.contabostorage.com	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
	https://grand-pika-f642c4.netlify.app/#mthatha@africawsp.co.za	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	AdjustLoader.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	Launcher_x32_x64.exe	Get hash	malicious	LummaC	Browse	40.113.110.67 40.113.103.199
	https://reyymsnwhduf.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	http://www.kraftpaints.ro/eve/pdfonline-3d2-new-bg2/pdfonline-3d2-new.bg2/pdfonline-3d2-newbg2/index.html	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	https://adrianatg.com/	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	http://helpbussiness-policycenterpro.art/	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	http://chanf-trojan.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	https://seoservicesiox.firebaseapp.com/?err=tdn8ci80q...~311~...1bab28021k78dd4g97a557ek2c2e4	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	http://cpsenrgy.com	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24274
Entropy (8bit):	6.056005745038982
Encrypted:	false
SSDEEP:	384:UtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NlOYXCHuqdpVEz0ZoV1PdQYT3W4Ad4nm:kMGQ7FCYXGIgtDAWtJ4nHlH8z0ZoV11q
MD5:	CD8D9060807F3F1F636F6AEDA562DC35
SHA1:	C6B0A8819C53EE6AD2DCDE10359D3C5997338690
SHA-256:	AF9C09410511986CC170EF6C1D2AD6C77510913AC8EB8FDDD3A7C7CB73F84F17
SHA-512:	DC070F3DF6A187A241015C215421046AFB9B68EB10BF481CB228A0438C5A86F5986D50D946DB141D7D7A5B69289F8F0F2903923410CB919ECB8BCB5EB2800413
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369608307554701","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\09ce9a8f-749d-4880-88b8-2b2b3a7087c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.587720943184201
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afPD7RpFbBkjUvpAkHB+udrxWvBIYSWR7+OJkXUcAhN4wlRkE:Xq8NkC1fPD7LeURDBrcvTB73JkEcAbdx
MD5:	A8692EBCFBB3329964BB0B9EB1DD5E29
SHA1:	B8A2E8409C9DC5D740AA508A6485B2B80A8EE4B8
SHA-256:	FEFA099CE0F641DD8A5CC6B7F219BE185A6F51A97434FB4AAE304E52BB5B3DCB
SHA-512:	70FA1E60BEC1F7258533E5B2627BCA15A089809D4D857EC814535020AD39678F17F42F7C63498173B3470233CCEE05137DD4C4FDFD76DF50A4F8120F33F5627E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"policy":{"last_statistics_update":"13369608305231458"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\15596517-d84e-4e1c-8d08-3016344b1277.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20955
Entropy (8bit):	6.065119058483415
Encrypted:	false
SSDEEP:	384:UtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSOYXCdoE+V1PdQYT3W4Ad4nm:kMGQ7FCYXGIgtDAWtJ4nSldoE+V119Wd
MD5:	13A01FF84DBDF0584CECD6A67F5AEECC
SHA1:	3675BC76851DFF4AB4169287F8A75C9229347CD1
SHA-256:	5DFE898D7AF01777992FFD7B0EC47E7514A04B292AC7DF70F70EA39BE44B8626
SHA-512:	574D13799BC8E3110FE894F2E22A1E9141CFFB5BB9142B2B1AFBD1D478266ADBA3EC5A5032BA5160B0D813D1D5BDF75A03F4BC79BCD482C6FCCB90AAF8F9A559
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369608307554701","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\429af133-5d07-4235-bfb0-a4790ecb5912.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20955
Entropy (8bit):	6.065086348657421
Encrypted:	false
SSDEEP:	384:UtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSOiXCdoE+V1PdQYT3W4Ad4nm:kMGQ7FCYXGIgtDAWtJ4nSTdoE+V119Wd
MD5:	ACD2E12E93EBC4842831715C7327CF0B
SHA1:	384CC93A51BCAF0DC8135058910859A6017BCE82
SHA-256:	B50B4621A5BC6665191655D800291DEF960FDF723F55D7F65994735BD3B3B8EC
SHA-512:	BBE47356C68656F7B00E869206D199B768B6B151EA44F6ADFC7B362CF10148E963065E26A526B8AD549D76DE097246172D642D3386A75EAEE4F3ADB3544983DB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369608307554701","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6aed8b19-eb55-47bd-8c62-e3b284954e79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70407
Entropy (8bit):	6.074206063638544
Encrypted:	false
SSDEEP:	1536:kMGQ5XMBGegZNTXRpAnSqTe/o+aQ3gmzBSj+Kvah+z0ZD11bm:kMrJM83TuSyecQ3R0LIN11q
MD5:	7BA4000629243FC8B7230D6D9135B6AB
SHA1:	61FC2F379874783E4D48FFD4F24051780FAD882F
SHA-256:	1E39B479A414A0BF8E8A92DC9929B6133221DEB1BA9FCA5A638EF75BF5BF2886
SHA-512:	DCBCE8BB7EAE6DD2A699174254D9847F774A73040485DE77FB5C77E7681E40D3B1ECFFBC8C2318278B1D16B0660D5D3D09EDC1EB615FA163B365E9AAA2F9F5EF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369608307554701","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\71c16708-7c4e-45d2-a503-3807da81b561.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70368
Entropy (8bit):	6.07412578697848
Encrypted:	false
SSDEEP:	1536:kMGQ5XMBGHgZNTXRpAnSqTe/o+aQ3gmzBSj+Kvah+z0ZD11bm:kMrJM8kTuSyecQ3R0LIN11q
MD5:	14568DE6125B361377E112D71136C8C5
SHA1:	6A41D3918502D0111ECDDA41E91D5AC4B37301E5
SHA-256:	2C2E773C9685BC77F0FCD9C1912738E341CDEAC6BACB37E06736E9BF07D83162
SHA-512:	0A300934D8614C2D5CB7F73A6609CDA288111BFCACB142F8FBCD1126EB3889DCE500C318BAEB051D88E73C0F2F806D89E89BEBA43D95BBC004CF63F06E4A5874
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369608307554701","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\dee2992e-9977-4b4e-b2d2-6d30f964ed6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D37771-1468.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45200845733426676
Encrypted:	false
SSDEEP:	3072:bPLRipba2wIKTMfkmsh0f23itw1fpzNVi5/nh4g1HFwM96jAE/NUzCqqvLxFMfA4:7Sby3qnh4aHj2Q/PxeaH+XI6KU
MD5:	3BA322D093D17BD2455DA00AAF6425CD
SHA1:	0F2A5908739AB28A99AA9A84DC79E753F2606852
SHA-256:	9F5C2C2FF4B5C8765EA73C49FFA89D8D9A368C9F2B08D413129C915EA781CBA0
SHA-512:	05C3C80F62F2094371CB24DD063C13D60370491F25DE4504F12046CE21D56363874525B7B6546ABF65691BEAB6C688549ABFF2A49B583B289666C0E99245E557
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8)...(..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".eakivj20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D37771-D64.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04017904256636481
Encrypted:	false
SSDEEP:	192:s6UjLYiVWK+ggCNlvJZzK1d9XSY1Pg+znhC3inNE7hcRQ8NI4Nn8y08Tcm2RGOdB:VUjjlrcc8hJ8Qu4N08T2RGOD
MD5:	2DA839BC5DD4B18D4E83AA774F3AEB1A
SHA1:	B9053C46E56087DE427E56661C2AC584C0A68F5D
SHA-256:	5F7CA33A6107CD168B142582EA8FBBC858764B8D929D56A4819859CF94C0B899
SHA-512:	37184070FE163C2D3C150AAE48BBB7DEF031ADC96D199648B6EC9906152FDA0456F51D8AE248A67EA7512ED052E2DFA2126C3A4C2BC112333AAA3008CB8F3E72
Malicious:	false
Preview:	...@..@...@.....C.].....@................`..8P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".eakivj20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@................................1..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....+...>@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.135510720473431
Encrypted:	false
SSDEEP:	3:FiWWltlVuB3ViHSRqOFhJXI2EyBl+BVP/Sh/JzvoRG+i8bMGsXl:o1VuBliyRqsx+BVsJDoNbvE
MD5:	720C58685D6BA2C3CFB3EDD716644FBF
SHA1:	EB4EBD1A66AF3435795DE3ACE70E77C05DD8FE02
SHA-256:	172151FCB787E30057F5B424C9F16FB785781DB5205FB223C85DD403C9DC22E1
SHA-512:	5AC42843AD95BC47D48F63527BFA18C7160426E9222264AEB19342F665A496B758877DC933B7A0734DCFB770F1EE133F3E0378A4FB1B6B77FCDB9BB98BB32A71
Malicious:	false
Preview:	sdPC....................X......L.-..q8.."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7049b7f6-7f13-455e-8471-a94daa17a843............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\2abdf889-49cf-4a5a-8b00-4c09dbe79a8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566566027990381
Encrypted:	false
SSDEEP:	768:lV0mOhWi3W5wZ1f4WA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPBZIwNp7rwXrpGtus:lGphB3WaZ1fxAu1jawr7Qst/
MD5:	85F537403C1B5E345C6A00EC3897CBC0
SHA1:	AA923D450E99E5F1DDE6E8110C05A755ADC72B4A
SHA-256:	9A633321571234281E5EC3912EC6A548B50B4610B8E85128E9A968FAE0AC85E1
SHA-512:	F086152F2A3D25C3BD2D35366FC1AA56FDE48A7DE695CE2DCF1EF4E61B94F75587748F31AF7665F6105F911BF3272DF4436F5E0BE2C236BB660284E9C4BD9566
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369608305777919","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369608305777919","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\2d6d805d-f483-4ac7-a834-bab1b01cd13f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\403624e5-0169-46b9-8b2d-285da359ec36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6534
Entropy (8bit):	4.987259414837691
Encrypted:	false
SSDEEP:	96:styqfvis13b9U6DOq8znOs85eh6Cb7/x+6MhmuecmAeiYJQY2MB/EJ:stynsrqqkOs88bV+FiAqBPBMJ
MD5:	8C5E5ADC7E17CC542B2CD0028799D985
SHA1:	91C5791D1D59FCC9F13A9B54CE735E0DD05F57BF
SHA-256:	BB1FF8241531B574A0AF11C148B166433E4FAD7D344162D93E301D1CC80FC6E4
SHA-512:	5E0CF1B4A2514D8D0F5037114CC4275EA3BEB852CF76A6431BA7B8344F168856F5238445C2AE8E5BB755F91E213E20710B96388EE0A3D532EA75CABF3C3AB262
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369608306938797","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369608307481406"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_user":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_versio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\413ddbed-6b1a-44df-8605-a5a57788fcfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.5667759242487085
Encrypted:	false
SSDEEP:	768:lV0mOhWi3W5wZ1f49A8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPBZIwNp7rwX/pGtuu:lGphB3WaZ1fAAu1jawr7Qgtd
MD5:	9AEC9D8814A886C6F00FB83FEABE8469
SHA1:	C3FC6D9133BCE4F7CBE4FAADEEE249791CDF4751
SHA-256:	BD75C6C8F40A73D34732790281C2E87DBF0B7BAE9C84867D084FE839CF062C4C
SHA-512:	A9195EFFC5BB0ED0C28EB596D07D54D3D264526703FCABB662A287B171743C508E184ACFA0B615F7D2A8B7B9A661B6C921B7B7D7668CC5BF24E1377C9665FF5F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369608305777919","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369608305777919","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6ec4667b-52fa-4663-98d5-792365cfdba9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6432
Entropy (8bit):	4.98497951357099
Encrypted:	false
SSDEEP:	96:styqfvis13b9U6DOq8znOs85eh6Cb7/x+6MhmuecmAeiDYQY2MB/EJ:stynsrqqkOs88bV+FiAdOPBMJ
MD5:	2A18204BDD7BA6902DDF1BE7A5890ECA
SHA1:	B0F377CF7A34FFB4CC5F90FB4EAF295785CF4DF5
SHA-256:	039B3D895853922B4C88D9DFDF48EFC8C5E25E16C0F1E8A4F63CC1F3DC7EA208
SHA-512:	0009C35A5DB6B297097496D25CFC3073D274A0386325C4F0BC569A85B4C71B98D3D54B4BAEE1E988CE6837CF9AD6294CF9739990B25EC70C2D2B069297AB454D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369608306938797","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369608307481406"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_user":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_versio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.32128122252583
Encrypted:	false
SSDEEP:	192:1AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:uOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	CF194F84507D5F0F9A661D7DD51DF8EA
SHA1:	9224E0D7B4312504EAE0485B626F12537020B397
SHA-256:	5E9690873B1481FABA8DFC3509C4FE65C667B49EF442DE0430A9694DE3D4CE74
SHA-512:	50A3617FA9DDC39AE5524418AB9D25D9FAEAB043B560FF050F21DD3A7CBF55D03386AF4885126C98FC84BF38F4B8A0D0846B58C43E0F11F409E50FFB5D538C0A
Malicious:	false
Preview:	...m.................DB_VERSION.1x....................QUERY_TIMESTAMP:arbitration_priority_list4...13369608311396879.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.098394208489767
Encrypted:	false
SSDEEP:	6:jMdBdD1N723oH+TcwtOEh1ZB2KLlFnMM+q2PN723oH+TcwtOEh1tIFUv:QdvDaYebOEh1ZFLLN+vVaYebOEh16FUv
MD5:	E3825D1E02BE37ED93207EACFF1D3549
SHA1:	F56F965EB26337877936673D980D88FB68BCA989
SHA-256:	0DFBC8F28E69B823936F61D89841AE9B67D4346B208EB1C96761C457AB02183A
SHA-512:	425A5A86CF21449D9BD4016DB4FB783BC6DE6DDE1F558E47DF6CBF12B40BA67EAE8890EA437529797D18E702C57F538AFEB5897052453C07B60D98C4C9181468
Malicious:	false
Preview:	2024/08/31-16:05:10.584 20ac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/31-16:05:10.686 20ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04407155678177972
Encrypted:	false
SSDEEP:	6:/Fii2rOkM/lsGYHCMtXBts2K9/+kll8BKlI2KlC/le:dYEsGkCEX3pYL/jl1KlWe
MD5:	D07E72DD00EE9B72031F6F76784C87E7
SHA1:	ED73C1EA01CA8193BCC0B7995FB84271FB5A017B
SHA-256:	8624B1A20E6FBFEA2A8C369510B88A91B15DF7E39E7CD764D52FD89A4C992C13
SHA-512:	8E371F0B24EE5098BFD7BD4C59263B5768B51C21259A6D093CA81C0360C2EBB7A0BAEE5E46DB76EEF5708C0F8459BA4DDA93FD94AEB5D7B020E3E5ACB54275C1
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09559119540996693
Encrypted:	false
SSDEEP:	48:MV4A3es/CV4XesrAMo6NUeGQE8J3lWp4:MV4A33KV4X3rAl6NLGB8J3L
MD5:	3CF68B2F08E9CCFC4C4D40BB9F84FC9D
SHA1:	C3C8C0CE07ED3CF4208CA5197559FC6E4C6416F8
SHA-256:	AA781FCF29FAAD394019E4FB8FACC5332E24AC26FE19FAFAB14F9E3E7631E1C1
SHA-512:	89ADB7B53F3F8A8D4F86F87DB840D609552A45E5D02754AB7CBCC1FF5ACC134C6A9690A737A3626A007B5F4A9238AD6F2AE20DC7E738250F73B50913C39DB0E7
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.283108161697845
Encrypted:	false
SSDEEP:	384:p9qR/Jtn09qR/Jtne6q/JtXbq/JtXhmq1VJtP:pgJt0gJtqJtmJtfJt
MD5:	A19E7675A2200A622A78D0DCC005B512
SHA1:	7DFE64065DA47E0390A4B23FD7063DC13484A3BB
SHA-256:	E0CCB31CAA89FA73A402CD328244C63450427A6B2EA8C0688698003F57BD868B
SHA-512:	028F86CDB166CDCDC5024C37002BBC50D0F104CED62564A9BB4D6E19F5B134AD7E92B6050EF0D80239257922FB00EFF727C305702732EB953F0D23CC700FEF8A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:Lsul0m:LsNm
MD5:	176A673D205C8D21E160AB24E51FB0D9
SHA1:	EE171D8C9B847B55193A093F10C3B5E28331BDC2
SHA-256:	BB60D536561FE6C6D5F975D7D91F093147C8EE63499FD0433FC487D146C0A085
SHA-512:	676675D5987559AB09C60F9E2A35A2C89812C7104B831A2C4F08DE3F4C828BE7254712CBC9F73D05D061F46265756664759A4A31E75632015D43991FDFF87449
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:JLuXTEDRK+:GgD4+
MD5:	6CBD7CD555A560FF991F1EA35EEE8A8F
SHA1:	06E37C658D1F70D885429B11C57A28BC96047FDE
SHA-256:	2FCB42C6E5EB9E84F21CE44D8B2A6904112A4A52BE29664537678C09DC76AFFA
SHA-512:	FE167A156C8C69721D05020BB5183B8D45C05DE97B265F2C7DB1773A1DAF40B762B048F2F16D7BBFD3D66B1D256FE673CE26A081C39486C11ECAE48616A76D35
Malicious:	false
Preview:	(...T..oy retne.........................t.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:JLuXTEDRK+:GgD4+
MD5:	6CBD7CD555A560FF991F1EA35EEE8A8F
SHA1:	06E37C658D1F70D885429B11C57A28BC96047FDE
SHA-256:	2FCB42C6E5EB9E84F21CE44D8B2A6904112A4A52BE29664537678C09DC76AFFA
SHA-512:	FE167A156C8C69721D05020BB5183B8D45C05DE97B265F2C7DB1773A1DAF40B762B048F2F16D7BBFD3D66B1D256FE673CE26A081C39486C11ECAE48616A76D35
Malicious:	false
Preview:	(...T..oy retne.........................t.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:JLuXTEDRK+:GgD4+
MD5:	6CBD7CD555A560FF991F1EA35EEE8A8F
SHA1:	06E37C658D1F70D885429B11C57A28BC96047FDE
SHA-256:	2FCB42C6E5EB9E84F21CE44D8B2A6904112A4A52BE29664537678C09DC76AFFA
SHA-512:	FE167A156C8C69721D05020BB5183B8D45C05DE97B265F2C7DB1773A1DAF40B762B048F2F16D7BBFD3D66B1D256FE673CE26A081C39486C11ECAE48616A76D35
Malicious:	false
Preview:	(...T..oy retne.........................t.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9555576533947305
Encrypted:	false
SSDEEP:	3:JLuXTEDRK+:GgD4+
MD5:	6CBD7CD555A560FF991F1EA35EEE8A8F
SHA1:	06E37C658D1F70D885429B11C57A28BC96047FDE
SHA-256:	2FCB42C6E5EB9E84F21CE44D8B2A6904112A4A52BE29664537678C09DC76AFFA
SHA-512:	FE167A156C8C69721D05020BB5183B8D45C05DE97B265F2C7DB1773A1DAF40B762B048F2F16D7BBFD3D66B1D256FE673CE26A081C39486C11ECAE48616A76D35
Malicious:	false
Preview:	(...T..oy retne.........................t.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlJk:Ls3Jk
MD5:	EDA69390ACB568A83127EB9C6FC5B560
SHA1:	ED44AEB387A4E29D83EBBCD3898883BDF7D3C4A5
SHA-256:	2C1AAF3C9F0E8B8B6F646A765F643546087FC547CBCB730F2FCD740814B0A8A5
SHA-512:	01B48F9A7A1557D2EDDC0F1D55CB0B5B99130B640BDBA5FEA19FA1BAC4648A857D7B207190F8CD94BC9741D3CAEEF09427C207897DBE5C7DCC9163FE69DFBB31
Malicious:	false
Preview:	........................................i...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354095203838731
Encrypted:	false
SSDEEP:	6144:EA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:EFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	B0402B31690A741B13FEA928CD107D86
SHA1:	5D9E5347F03AEFFB155C062C7F6316CC4C029D7C
SHA-256:	1B4DC829066A35F8E9F6EC1C3DC45C58449D67E76A8DD59175E41D5310220A59
SHA-512:	341E454C8FC8D180E87CECD0EF54D0BED08E45A98B7BF8FA2B98EF1D3D0C0AA75A4EDF9AFAC58D3921E03C45512DE2DB4A6F2AC42193B15950E6CEA5BABB88F1
Malicious:	false
Preview:	...m.................DB_VERSION.1}.$q...............&QUERY_TIMESTAMP:domains_config_gz2...13369608311394047..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.173460900521196
Encrypted:	false
SSDEEP:	6:jnhq1N723oH+Tcwtj2WwnvB2KLlFOu+q2PN723oH+Tcwtj2WwnvIFUv:LMaYebjxwnvFLwvVaYebjxwnQFUv
MD5:	18301AF3D661AF866FD32E2AC0929116
SHA1:	E1825342F8F7E9E3DB2F607894BAE6392771B399
SHA-256:	A015EF370DD74AC32C99D4567A777E3A463C45B8DDAD0FCC9AEAF8524EA33A35
SHA-512:	3AC1BF80B80AEAFE116ADC836792FAE4FB0D8B3815123293C1F97B52AF287F078A1848B8C8E37D8B60841CAFDDD84779495C2F849887DD5DAD19C282D8262110
Malicious:	false
Preview:	2024/08/31-16:05:10.602 20c8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/31-16:05:10.713 20c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611957786582
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RL:C1gAg1zfvj
MD5:	1D97FAB4031917FD29F624F13A3E712C
SHA1:	24F0F509450E0E4DF25132CDC56087EAF36CACCD
SHA-256:	D3991A4F55AB42E68377180855787E0E51EFE784B46761028415A03289401EA3
SHA-512:	58F0CF0F9DECCB627DD9F04C8D690174BC107D4DE0059D4E03A17C973B731CE7F7E2DA234F1C8F06E51A07B07B66F85E9A29786B47AF383A1433756CAE71FBB7
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.171250832701795
Encrypted:	false
SSDEEP:	6:jnEe+B1N723oH+TcwttaVdg2KLlFI7MM+q2PN723oH+TcwttaPrqIFUv:bb+BaYebDLfM+vVaYeb83FUv
MD5:	33CE83AC82CCC9518E9869E9C2AB4A4C
SHA1:	2B188B97EDB46BEF1FDBB9016DF4D035B07EDB86
SHA-256:	0F9A61688AC8945052E8D5F2052375AD79BC4681F6649613C09375B992113AF1
SHA-512:	C4C0F2A00C06FCA1E23BB70B7444DBBF6E52F95D8CA25B78F121BFAF2FB17C1A08225FFA7935670E7D7C9C161EE4280D73354F30369C3B4273F27C10A765323B
Malicious:	false
Preview:	2024/08/31-16:05:05.818 14fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/31-16:05:06.864 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.180751117782433
Encrypted:	false
SSDEEP:	6:jIM+B1N723oH+Tcwtt6FB2KLlFg1MM+q2PN723oH+Tcwtt65IFUv:J+BaYeb8FFLRM+vVaYeb8WFUv
MD5:	AA998CBE50CDD4C88DFE884E5EF06EE6
SHA1:	B43D2820EF0B56FF01F7F0A43E91CBE1F6953A09
SHA-256:	0DDB125BC30B9FA23815463AFEB2114A96409062D4483F8628280DABC15EC91E
SHA-512:	083C495CCCC88ABFE44C15C3ED37E9CC6DB0CAC0F1B39BC37A43AA844D35FE036033B772605F6D8568ED19903627F91E3C4C72CBF4237F40F9458396F1D94BD5
Malicious:	false
Preview:	2024/08/31-16:05:06.868 14fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/31-16:05:06.974 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.190867594514828
Encrypted:	false
SSDEEP:	6:j8Hn4M1N723oH+TcwttYg2KLlFDSVq2PN723oH+TcwttNIFUv:gYsaYebJL3OvVaYeb0FUv
MD5:	A883BF989E1A163B55E14D73B514534B
SHA1:	C220BB8D90DACCD17F872F8218D3FF954F61F1C7
SHA-256:	931C999A515090D4F798D02F62894D93B44896A6B97BC2935201683476682391
SHA-512:	9CC114266E9205065C2B725E8B1A04E7F57CCB4CED13322939A80B6DE083A332CFF782FA11E7397C27076536686D8C47B3ABB90B2F032F854501CD54087648B3
Malicious:	false
Preview:	2024/08/31-16:05:07.676 b44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/31-16:05:07.691 b44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlFp:Ls3F
MD5:	F9A68594C046189C5F5F3AB4F344223E
SHA1:	697EECB55F87594C32CE1C8386B3DAD63A833A49
SHA-256:	C16BB450805DD17ED4F217867E6F9EEA5A6E6A2A4818425142E99ED02C963685
SHA-512:	9BC902C2D3B3EAD771F9D8813222649722FAF02E2E3BF378DDD71BE7D3DE628788820A9C0A4A5656C122BDB0699B97462CFF3BB5B34EF53C67A0A3B55C1FB231
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037045
Encrypted:	false
SSDEEP:	3:wt/7ntFlljq7A/mhWJFuQ3yy7IOWUKl4/dweytllrE9SFcTp4AGbNCV9RUIF:+/I75fOg4/d0Xi99pEYX
MD5:	8EEBEEFED1800E4B39E71E837607576B
SHA1:	0CF9F8F17585CC1572D9B10D36CCC280807F3066
SHA-256:	7289042072A0555BE59150A1AD2EB94FF38821F6654B915EB4F6DDD919D5F8B8
SHA-512:	4CC1B50BCC413D6E4DC7D246D332DD79081FB676E9FC3F719364CC15805A4E3F1A944F6C52E4BEB79AD1ADC88F4DDD02A7022568E9091E41F5D405C506066958
Malicious:	false
Preview:	............u......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.222023114470029
Encrypted:	false
SSDEEP:	6:jxFB1N723oH+TcwtRage8Y55HEZzXELIx2KLlFbt+q2PN723oH+TcwtRage8Y55U:FDaYebRrcHEZrEkVLQvVaYebRrcHEZr1
MD5:	4FB73D9909148654CBCADCF897971F66
SHA1:	845EBEFBC21AAF87788F7B4E9361689ACD96A7E3
SHA-256:	0D105DD1A913155A9BFBFA190F1523F0E28241419A2E3938BC0F251AE3A2F9C2
SHA-512:	546834DD0CF26074932BD452F29E7121F3DA35DB1B84BDFBD8A0C8EB21A294A25F674F1D05BD3769EEC583701A08D3DBC1257200BFB8D7B7A2839E66AB4C5630
Malicious:	false
Preview:	2024/08/31-16:05:08.628 3f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/31-16:05:08.640 3f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.203043042775841
Encrypted:	false
SSDEEP:	6:jPT3c81N723oH+TcwtRa2jM8B2KLlFaoL+q2PN723oH+TcwtRa2jMGIFUv:fc8aYebRjFLOoL+vVaYebREFUv
MD5:	DF1F00428A9365CAAA9BE23B784B27DC
SHA1:	2C87612D74B7EE27F86C7F267C4F69DFAE1FD6D1
SHA-256:	F180153E33AE2545D5CA50E8CC4D48F1025013ED0A0B0C46CF17C58D923772C9
SHA-512:	77B0B3DA2CCB29353745D87CC6681E673B4DDF847F4A84D5B64943378E7D72EC95780B162949C29494316B19F9C907FBB4946FF6E013F00476E44C18FB86489F
Malicious:	false
Preview:	2024/08/31-16:05:07.356 1c7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/31-16:05:07.385 1c7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745933985004888
Encrypted:	false
SSDEEP:	96:y8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:y8yLG7IwRWf4
MD5:	7A9BF0D6AB6967E057DB6BA4EE45243B
SHA1:	0C8775DE3A37242BA7CF2FAE40613E935970928F
SHA-256:	E3C8C78A681C3CB37BE10D4B3D9E97E05D438DCF71FBF9CE4F388A3F3218BE8F
SHA-512:	42BCF1D8588E89E9DE413A4AE5C973D5F149F09273CB293EDF53AB2EF94D493310F19F10CA06EBDF6893CB46AA234A5BAA1C4CD1D531F26C1B406B7AE459EEDA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\1f14767a-1599-40e0-8e23-6b013b46fcda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbTHJHcBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ub74MS7PMVKJTnMRK3VY
MD5:	4117E5247EF55EA8839672284FF0AB95
SHA1:	90F5CE007ABA44EB8E4C32B4A738055DEDA39474
SHA-256:	C1C38C8620401B15F569897943EB1B7989BD9C159320721AF21120E510BFA46E
SHA-512:	CD95D7385B1B0921B3E4797D541C7ECC43957E3B6C7D04156B6B6B939B35806C6C539264340127266CAC1B363F34A432DA9B94ADAEA1B47BEBDA9CB1BB2328D2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\22db580e-a664-4e3a-8fa5-05a0eb66f1ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\4118e5df-4d30-45a7-a80e-b0433f03a0c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\8db1f03e-8f82-445a-98c0-295a22f86586.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\91c17e03-fef0-4bbf-8695-81ed438e0b33.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF47e15.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7608474613099627
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkhY:uIEumQv8m1ccnvS6a6j
MD5:	0D5E1263B6A7F36CFF5EF3A39C2820E6
SHA1:	946D7A7A6BA0FF46A02AC91A9FF282B9EA3C5CE9
SHA-256:	D31BBD0F7B4D5D448C92FBA974807563B74A104DD247D216F2447D509BF24F8D
SHA-512:	CFFFC829835D87C1111933CDF629BB1E71F4CDD0AAE02BF7E648ACF0AE963FB8ECE90B792AEB84C6276B182B8AD15BA3DC70E1AB396432B8A7F58E54AC667DD3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF35c5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6298
Entropy (8bit):	4.977672750904079
Encrypted:	false
SSDEEP:	96:styqfvis13b9U6DOq8znOs85eh6Cb7/x+6MhmuecmAeiaA2MB/EJ:stynsrqqkOs88bV+FiAxPBMJ
MD5:	26874F9C0756A589ECD07389CB39D0C9
SHA1:	8DEC830A6CA3125E2BA0C55477905BD40EAA81CA
SHA-256:	4B9528A9FBC6A9E14F7F2159D2197B665E6C91DEF7180269CBB767939003C523
SHA-512:	8A1A864F7EB2F7B319E4E9AA72F8C79378CA5CBB3CF713316690F2728C90BF7639A67D24E206C86C178EA26B6D5A11EFFDD39848BCDC5F9FAE938C9C9052574F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369608306938797","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369608307481406"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_user":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_versio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3ec55.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6298
Entropy (8bit):	4.977672750904079
Encrypted:	false
SSDEEP:	96:styqfvis13b9U6DOq8znOs85eh6Cb7/x+6MhmuecmAeiaA2MB/EJ:stynsrqqkOs88bV+FiAxPBMJ
MD5:	26874F9C0756A589ECD07389CB39D0C9
SHA1:	8DEC830A6CA3125E2BA0C55477905BD40EAA81CA
SHA-256:	4B9528A9FBC6A9E14F7F2159D2197B665E6C91DEF7180269CBB767939003C523
SHA-512:	8A1A864F7EB2F7B319E4E9AA72F8C79378CA5CBB3CF713316690F2728C90BF7639A67D24E206C86C178EA26B6D5A11EFFDD39848BCDC5F9FAE938C9C9052574F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369608306938797","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369608307481406"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_user":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_versio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF46195.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6298
Entropy (8bit):	4.977672750904079
Encrypted:	false
SSDEEP:	96:styqfvis13b9U6DOq8znOs85eh6Cb7/x+6MhmuecmAeiaA2MB/EJ:stynsrqqkOs88bV+FiAxPBMJ
MD5:	26874F9C0756A589ECD07389CB39D0C9
SHA1:	8DEC830A6CA3125E2BA0C55477905BD40EAA81CA
SHA-256:	4B9528A9FBC6A9E14F7F2159D2197B665E6C91DEF7180269CBB767939003C523
SHA-512:	8A1A864F7EB2F7B319E4E9AA72F8C79378CA5CBB3CF713316690F2728C90BF7639A67D24E206C86C178EA26B6D5A11EFFDD39848BCDC5F9FAE938C9C9052574F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369608306938797","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369608307481406"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_user":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_versio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.5667759242487085
Encrypted:	false
SSDEEP:	768:lV0mOhWi3W5wZ1f49A8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPBZIwNp7rwX/pGtuu:lGphB3WaZ1fAAu1jawr7Qgtd
MD5:	9AEC9D8814A886C6F00FB83FEABE8469
SHA1:	C3FC6D9133BCE4F7CBE4FAADEEE249791CDF4751
SHA-256:	BD75C6C8F40A73D34732790281C2E87DBF0B7BAE9C84867D084FE839CF062C4C
SHA-512:	A9195EFFC5BB0ED0C28EB596D07D54D3D264526703FCABB662A287B171743C508E184ACFA0B615F7D2A8B7B9A661B6C921B7B7D7668CC5BF24E1377C9665FF5F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369608305777919","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369608305777919","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF3bc6b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.5667759242487085
Encrypted:	false
SSDEEP:	768:lV0mOhWi3W5wZ1f49A8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPBZIwNp7rwX/pGtuu:lGphB3WaZ1fAAu1jawr7Qgtd
MD5:	9AEC9D8814A886C6F00FB83FEABE8469
SHA1:	C3FC6D9133BCE4F7CBE4FAADEEE249791CDF4751
SHA-256:	BD75C6C8F40A73D34732790281C2E87DBF0B7BAE9C84867D084FE839CF062C4C
SHA-512:	A9195EFFC5BB0ED0C28EB596D07D54D3D264526703FCABB662A287B171743C508E184ACFA0B615F7D2A8B7B9A661B6C921B7B7D7668CC5BF24E1377C9665FF5F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369608305777919","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369608305777919","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.135485007632775
Encrypted:	false
SSDEEP:	6:jtr81N723oH+TcwtSQM72KLlFtzoL+q2PN723oH+TcwtSQMxIFUv:58aYeb0LdoL+vVaYebrFUv
MD5:	51C6182363FEF1BDC923C74B2BA53EF2
SHA1:	7BDEAE5F1A13AF8722AF2E26BB8A29BAB05160B4
SHA-256:	6F987CB6ACB89F7E163338B72D40131ADEABD72D3128DB2BAC8B743CE2884F85
SHA-512:	DD65D222408E2EA73129E7ACDF272E97FA00F84ADC2AC49B28A11507EBFECAB3FA3AC4ED0965AD55B4399FBBB88972BA0DE792404BC454631DBA64536ECD5E97
Malicious:	false
Preview:	2024/08/31-16:05:23.502 1c7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/31-16:05:23.524 1c7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.111416438690401
Encrypted:	false
SSDEEP:	6:jPnTV3Eq1N723oH+TcwtgUh2gr52KLlFniFdsVq2PN723oH+TcwtgUh2ghZIFUv:TTV3EaaYeb3hHJLziF+VvVaYeb3hHh2g
MD5:	755AFF932C2308757FCF0346DDDE1AB4
SHA1:	8698A0C9756AA62AF856C1898547DFF7435DD6AE
SHA-256:	11AF380DE30ABC3221AC2BCEA1191FA4C7CEFF2EECC332D3FDA2F32A90AD7CD9
SHA-512:	3D29C7B67C29F4B774532A12F6A56423F4F8B57B92989A033A601AAEE2BD88F842F5F1E23F34AFAD91DBF7293D3F5C2844FB9E62B4AF66CD20CEA4FF7D24EF2E
Malicious:	false
Preview:	2024/08/31-16:05:05.758 860 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/31-16:05:05.896 860 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:Lsulp9t:Lsut
MD5:	396D5B9CF8477099FB31623E394224FD
SHA1:	2D3F59570C45D3E1557E9C405976AC5CC04D1CF9
SHA-256:	9F998D7C5B1287A0A78C16CE2B91BF1847560549BC45F1FDFFD08EAF5949DE98
SHA-512:	18B53D1A901BE61F83382DAB43BF2C0FA06F0DF51D8B7636B4A4322E8AA27FE5EADFD7078587D42ADAA80130A3F9581C2FD0D52EC42150C1EEF74A528CB0B249
Malicious:	false
Preview:	........................................_/@.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:WEDKcFE0EakdkzT:W4K0wFkX
MD5:	C8160004BCA70CCC032EADDC4D5B1729
SHA1:	EA62ED146989E18BE096BD9B4D521D981CF97173
SHA-256:	20850C07126C243117E0595730B4283D02480A2740D0EC1DDE0530BE57E87340
SHA-512:	6FD7933F2728A8801A16455E85AFBBFD1F50567EFA864CD3672FA229D86A42000290A020FE20648EFACDAA01C354878278B381E604794D06116F9DBDA1DFC861
Malicious:	false
Preview:	(.....1.oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:WEDKcFE0EakdkzT:W4K0wFkX
MD5:	C8160004BCA70CCC032EADDC4D5B1729
SHA1:	EA62ED146989E18BE096BD9B4D521D981CF97173
SHA-256:	20850C07126C243117E0595730B4283D02480A2740D0EC1DDE0530BE57E87340
SHA-512:	6FD7933F2728A8801A16455E85AFBBFD1F50567EFA864CD3672FA229D86A42000290A020FE20648EFACDAA01C354878278B381E604794D06116F9DBDA1DFC861
Malicious:	false
Preview:	(.....1.oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:WEDKcFE0EakdkzT:W4K0wFkX
MD5:	C8160004BCA70CCC032EADDC4D5B1729
SHA1:	EA62ED146989E18BE096BD9B4D521D981CF97173
SHA-256:	20850C07126C243117E0595730B4283D02480A2740D0EC1DDE0530BE57E87340
SHA-512:	6FD7933F2728A8801A16455E85AFBBFD1F50567EFA864CD3672FA229D86A42000290A020FE20648EFACDAA01C354878278B381E604794D06116F9DBDA1DFC861
Malicious:	false
Preview:	(.....1.oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:WEDKcFE0EakdkzT:W4K0wFkX
MD5:	C8160004BCA70CCC032EADDC4D5B1729
SHA1:	EA62ED146989E18BE096BD9B4D521D981CF97173
SHA-256:	20850C07126C243117E0595730B4283D02480A2740D0EC1DDE0530BE57E87340
SHA-512:	6FD7933F2728A8801A16455E85AFBBFD1F50567EFA864CD3672FA229D86A42000290A020FE20648EFACDAA01C354878278B381E604794D06116F9DBDA1DFC861
Malicious:	false
Preview:	(.....1.oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQXl:Ls3ol
MD5:	5F951C507B4D13EA4534CFB9DD3228EB
SHA1:	33462419C311AECE52BE5D87AD1F672CDED5BBC4
SHA-256:	7ED735C962FC80078853E6151FAFBF00D5EF767B855349BA09DFE7998458AE25
SHA-512:	94EBC366D22473E70E45CCBDD900DC9794CC6EE0DD42A9A27848BA4CC0ABC2E828A63C1DF6696AC06485E407D7507E889F49D5C56FADA278779C05FE9EE301B1
Malicious:	false
Preview:	.........................................5..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlHWaK:Ls32aK
MD5:	921782A440B30A1AF3AE3905CFDA0F08
SHA1:	163B87DB42052D6796CF9F3F12BE7DEB1581439A
SHA-256:	659DBDB6D2480A9C61D06FDDC73EBC84279522D6470E9950CC568EF9C174A165
SHA-512:	77884FC1E616E3EE911209F0860519BB28D7334CBF1517DF6C81681FB893F90FFDBF3458CDF631E83D397388D7B9A551CC0557B839F12FC585A6DA87EA6AAE25
Malicious:	false
Preview:	............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.211499357964428
Encrypted:	false
SSDEEP:	6:j+8c81N723oH+Tcwt0jqEKj3K/2jM8B2KLlFdDL+q2PN723oH+Tcwt0jqEKj3K/M:bc8aYebqqBvFL5DL+vVaYebqqBQFUv
MD5:	1727A6A854B50622D60B58A63022E217
SHA1:	3BFCD8885396D227BFFEE429AACA213901B5A241
SHA-256:	5861B2114BD3D2C8BF8331AED17370C5E73962D293D3066CE61B6EA01ED40E07
SHA-512:	0974BCBBE6E15DFA8521801E9B0940AFC8ECD087443CCB12F8DBB177BAE887E40ABC18B571E00EDFB3344E277D40AC46A5D82C9895F6592D619FB6533B2C42DD
Malicious:	false
Preview:	2024/08/31-16:05:07.648 1c7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/31-16:05:07.732 1c7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\32a94457-151f-4312-82cb-390ca47b1784.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\468ed4e3-cd53-4fa0-a75f-4aaaf1742753.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7dd43ce8-f8c0-4d94-b2da-7bc071973f9e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF47e73.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a97409a1-c135-4ea9-ad72-3b5eab0a47b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	397
Entropy (8bit):	5.212976408731343
Encrypted:	false
SSDEEP:	6:jtDQkR1N723oH+Tcwt0jqEKj0QM72KLlFtTNjL+q2PN723oH+Tcwt0jqEKj0QMxh:CkxaYebqqB6LdNOvVaYebqqBZFUv
MD5:	AB5BB04F4FB84BBFDC9FF29A4ADE7184
SHA1:	0F978BBB65A8F4EACA242C3ED27FF25B3AE64C96
SHA-256:	015D974DA36A89186847D82B4DB47258E07BE62F9ABB2DBF7ACD88653B7D8BBD
SHA-512:	CC13B4C866A52A8960917AC8008C8D90CC002F641DEA276F12563F81C7EB1320A3E19EE4102F31C93BA00E083F9C0DB2C3BDDDAE5DCE5A74915EA20A59ECA41B
Malicious:	false
Preview:	2024/08/31-16:05:23.535 1c98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/31-16:05:23.627 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.245472852199977
Encrypted:	false
SSDEEP:	6:j034M1N723oH+Tcwtkx2KLlFEo0Vq2PN723oH+TcwtCIFUv:bsaYebkVLOvVaYebLFUv
MD5:	589C339D5AB19B985A163649FF981919
SHA1:	5219FB1C0FC4ED8655F96BE8202325B05815E15E
SHA-256:	E05E117951EDEB4F35C368AAD9711199A520DC6C4B79EBDA52BE60D90107AB98
SHA-512:	5F74CC3526A0180443C69020BD7FC917D891E0DD294BCFFAB2CD3FDEA5A4CFA294789EA1EEF6157EE8AB77A78984E6FF5D1B6B66A2B12CBCE99B2EC7CB2FBFD2
Malicious:	false
Preview:	2024/08/31-16:05:05.759 b44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/31-16:05:06.423 b44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVS/:IiVS
MD5:	C0B2B340C9B4C6B76D03913FD32D7CC6
SHA1:	BCFE3691D82F3FA31A9068726AA90373CCE96CE9
SHA-256:	8D6C2DE39EBAC5191E34F7C4D21D1ADDABCF37F1F7BF78909E3E35AF079C42F1
SHA-512:	A5FE8DAB89592D70A52A1B2BE0ED3B9E8C538D4AA004D83037CA6AF69055532A7F211F7CFB7F032A5EDA4A1E7C0F6539417CCFC90A9C07DA3F2E4ABD4E8BA2E8
Malicious:	false
Preview:	VLnk.....?........!...4.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0799648475053
Encrypted:	false
SSDEEP:	192:hrb2qAdB9TbTbuDDsnxCkOKSAzWn0lKOMq+JLVumYf6d7n66:h/2qOB1nxCkOKSACnqKOMq+pVum+Ip
MD5:	3A7F65E9BA1B79999AEFB06C73C11467
SHA1:	00AC948E5D277B39B1B74E5E6237DD99052E9250
SHA-256:	FD5BE061124F6B3FA5EEF370D1F9F29CDBC1F5DB077299533B3CFA215F7EC9E8
SHA-512:	C151D463FBD3CB6F61978EB166FF47BE30C4DE51D5C0F5DD27DA8AAC72D318193BA7EE80C99411D36926ADE6EAC492C17A453747E669B81B0146F33B7B847018
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\b7ea089a-e719-4579-b936-875d4aeba58a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\fdc56f35-8adc-4c3c-a8c7-e034f4d48c2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6298
Entropy (8bit):	4.977672750904079
Encrypted:	false
SSDEEP:	96:styqfvis13b9U6DOq8znOs85eh6Cb7/x+6MhmuecmAeiaA2MB/EJ:stynsrqqkOs88bV+FiAxPBMJ
MD5:	26874F9C0756A589ECD07389CB39D0C9
SHA1:	8DEC830A6CA3125E2BA0C55477905BD40EAA81CA
SHA-256:	4B9528A9FBC6A9E14F7F2159D2197B665E6C91DEF7180269CBB767939003C523
SHA-512:	8A1A864F7EB2F7B319E4E9AA72F8C79378CA5CBB3CF713316690F2728C90BF7639A67D24E206C86C178EA26B6D5A11EFFDD39848BCDC5F9FAE938C9C9052574F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369608306938797","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369608307481406"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_user":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_versio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28109187076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/mpl1lFll:7+/l/i
MD5:	84663D01A6E9DFC1D1D993B0945A77D6
SHA1:	75BCB07B6D34EE3C15C2052EAC9F06E30E2A6261
SHA-256:	33FF9429245FEAB283A038E9DF8BA9F16303CEE982531FF7AA7263A751169082
SHA-512:	D47B3446D9E8F925953672404A152DC58724B4B237F926CE0352C2C2AD81BB0260566D3EEEB3FB53249AFF501E59480FB88797A7FD46A807F9C4CDD374BBD980
Malicious:	false
Preview:	.... .c........J................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.049899871979391254
Encrypted:	false
SSDEEP:	6:GLW0ZjJWwW0ZjJWQL9X8hslotGLNl0ml/XoQDeX:aD7DrGEjVl/XoQ
MD5:	5A5B1A2D46F2C8A1E86DFBE2169185FB
SHA1:	76BB2C9E3C6469FAE919E8FB2C3DA9D7F8C36E2F
SHA-256:	66350AB4E1FF4366BF1602A0614684E30D47394CC8A20DB38D976CEC3F1110E7
SHA-512:	184B1AFEE8985685B09A8D60C5114F560ED8916C44AB41D50EC1202CFFF40EF35D8C833D08FA29B44F768A5687166649208A8044ED8A23827BABD654EAE8EC16
Malicious:	false
Preview:	..-..........................(zT..8A.T......~..-..........................(zT..8A.T......~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.998024433488138
Encrypted:	false
SSDEEP:	48:RzxRXlO+1cbX+Vn9VAKAFXX+i2VAKAFXX+mxOqVAKAFXX+gPTnUYVAKAFXX+B02c:lxxfWNsuNskO5NsgPSNsBE
MD5:	8C0FB3358AEB8B33192C7C73311DCCB8
SHA1:	E05638B75709CEA2F1BA54E9FB8F079C00DC768D
SHA-256:	509EDEDDD9675E984FF7D586EAB7E8707063E46709F0435F327CE369AE084F3D
SHA-512:	7C9C2AD265B22E707FA685C6749FE623704E2F07109C21F51406DB36319CF9C4746290711BF72F360E40BDF2AD0F0F35C6EB069F83C3B738B48F4C89EFFEF957
Malicious:	false
Preview:	7....-..........zT..8A...W...g.........zT..8A.jV.H..,rSQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.471911980252733
Encrypted:	false
SSDEEP:	48:e8SSBStVgQAPkuHRHXxtIYjIYzzVFqk2MYjMYjyMAlkfAlk43:J0t+QzkIYjIYzzjb2MYjMYFYcY93
MD5:	69BBABC1FABD9DF22D4A589AA298C350
SHA1:	E76CD49471F1ED3A2B4445634F003432A90FB58C
SHA-256:	3A88AD6D5EB3986BCEC02100D72EC59212166F5431D7EAFFFF015DD0FD8CFC61
SHA-512:	21AB4E5559886663E59D82E8D62399F41FA3E4923F99EEBDEE36F32400C78C04D94A4CBB322B39E99F84920DF30AF9164B5012AD8FBC09FE52988F73426971C4
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1Cc.T.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.23965403101798
Encrypted:	false
SSDEEP:	6:jTJQEq1N723oH+Tcwt0rl2KLlFgFzSVq2PN723oH+Tcwt0rK+IFUv:xQEaaYebeLszSVvVaYeb13FUv
MD5:	4448378AF6FD41EB45ECA6D820F33488
SHA1:	C53B17B763C5140A007E3E408FB8A593C1CACA57
SHA-256:	DF1E7700B644C474D3950F10768CB79EBFCBFDF3B0EC6637F5582E6EFEAB7A68
SHA-512:	73684B78D523232F92C8AF2B31DC8DE60654B34F71147629B91A21AE3006340CEC4BFDBC75A0439AA2E36AE31E5A8A3149ABDB7DBD187EBE3F3399476367FF36
Malicious:	false
Preview:	2024/08/31-16:05:06.985 860 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/31-16:05:06.996 860 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.958141412815535
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wui+it/4JbZfPStub/RG0lbANqa:G0nYUtypD3RXi6FZfc25m
MD5:	FBC524D02048C176A0A5D1B8B752932A
SHA1:	294C48557549A4C978326D9B7969E293A024F157
SHA-256:	F3FC95AE128DB918FC126F15CD9D96618482BA6ACCC622AAA19B10CE80B15EA0
SHA-512:	9B6434442E11610B8B5DDA43AA56656599925C9C8F0A364DDB69D15B37A912D223EE600012468E0DB723CAF3546FFBDF56F085A0159EA7968BBACE894AAFF856
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.2048697810558435
Encrypted:	false
SSDEEP:	6:jdfEq1N723oH+Tcwt0rzs52KLlFTXVq2PN723oH+Tcwt0rzAdIFUv:hfEaaYeb99L3VvVaYebyFUv
MD5:	A5225D0282B9CC71F58773781336FA13
SHA1:	ABBF7653F832C481AFA3139233CDE8400B3BAD6E
SHA-256:	B9225974C8EE7C4D2ACC064FA184D92F73EBA879C7B6BC8611C3642415F42477
SHA-512:	208438ABAAA8A4C0691C307CCDB2F1AEE610EE32D4B739C3E97D2C6BF19786733A9106A1C3B6E5AFAB2A650B1E724344499E6B4648103141D5023A2E9AA06122
Malicious:	false
Preview:	2024/08/31-16:05:06.964 860 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/31-16:05:06.983 860 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl/6:Ls3
MD5:	428146F776CD5CCDC16AC41F26877E26
SHA1:	0AE10D0985E078DD9A5E180E42325DA888152DE4
SHA-256:	A5C5D036B03903660ACCCB58330FE86F816A3FA7F2262FD30F8410A2FE2A7E4E
SHA-512:	9B1298B8BF10F027A087C79C575A5D5CC9F793AE8A4F78458A789B4C648AEF4B406F00F662EC9B643475B4FF234DEC91FE738ADBD14BCBFC82F014F207831F8B
Malicious:	false
Preview:	........................................2...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlXl:Ls31
MD5:	3EE7B465D87CAE2FDFCF1976D5D84297
SHA1:	CCC83E7D4CB2100AC0DCDCC30075E39F53180881
SHA-256:	11A0BFD3A0FAD0DF31775C6F62FE50945F6AA4D87C14F46EEA044675C84D7BB3
SHA-512:	19D309ACA1F362B0A4442EA98A76A6F00F08917FDE2C54D59F14846A857C522AB98C1C11A99C04E822A045F1899143EF6F2E53C640DBF2603232CCFAD084E8E7
Malicious:	false
Preview:	........................................4A..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF34ebd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF34eec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF35025.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF350ff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF37792.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3b73b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF43a46.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF46166.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF4c197.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlh6Bll:Ls3hk
MD5:	2122479355805B80945116C3FD2F52E4
SHA1:	EFC33BB370B462B1A71EB8CF216B0F84164923B2
SHA-256:	207CBC90661050232546D41FEBE96F30AC610D2411B105F955241298381CA1FF
SHA-512:	A2D9807770D26F1980E377BD78779560D6DACC6E3B92EA2252A62189BC5895CF5C4E9FD1C3A003820AF9FB412E986EB8E91ABA706EC13AE25EB7C094DD886DC9
Malicious:	false
Preview:	........................................MI.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c1b00a67-ac05-44f2-873b-f9ae1814181f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.603483457834934
Encrypted:	false
SSDEEP:	96:0q8NkC1fPD7LeURj2KBrcvTGKlJkEcAbRSDS4S4SDS/Ae4a:/8NbND7dfjKrkEXI
MD5:	A83A07857C4A54646E7D3C17F6A3E7DE
SHA1:	F70EF756D7111936D70F1EA5D29280170947F328
SHA-256:	0881BA0B03AF2AD5F1C96429520D5D3ACDD561BE4814A11049DF0DA40C7751BD
SHA-512:	F75CA82E61A6B05621911A547E92C15A702295FF92DBD541F16CF40825DEA270B96E4B1F78350686AB38B4FA43F2B61E16DDF16A671C1E7229397C710117B023
Malicious:	false
Preview:	{"dual_user":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c3551dcf-b904-4dab-a288-8fca07560bc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.491307929255804
Encrypted:	false
SSDEEP:	96:0q8NkGS1fPD7LeU58rh/cI9URoDotoruTzBrcvTGKlJkEcAbRSDS4S4SDS/Ae4a:/8NBSND70eoDUiQjKrkEXI
MD5:	D88A9353937B9F4EA4AF12164DBAEE26
SHA1:	DF7A1B6C41122409B56DF3F6C251395FB2E625E3
SHA-256:	6C21D808056089F85F2692D8D5477D0ABCF411D502B92AB5467C732B091CE861
SHA-512:	DDBE9DCE1FC26E5CF11B392F62261DA7684E8EFA330EC48081E6B9504929E50D0105D68E4A87CA6071C50FB3CDB73F09638E51F10141592B073F13BE0930B443
Malicious:	false
Preview:	{"dual_user":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqv

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\df7ba035-ed0e-4d6a-a5d0-cec0581c1218.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.52804070213425
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt1D7RTtFbBSPJNtyikwpoxJdXBuBuwBFmYaMNhoXXfQoTEtCYY:YuBqDPafPD7RpFbBkj5vpAgBzBIYFoXr
MD5:	3358ED95A00B7A80F4F8A1DDB8BD081C
SHA1:	85D14758F0A65F8DA792AD043940ADDE0BBD97C3
SHA-256:	5DEE6B8A0844B915E81F0B92F3D90BA11E0AF35FDF16078E93A238725B63AE24
SHA-512:	C83154DBFFBC3ECCA97E45048A4B9B6D23A0343F94CB528BAC580AE731B12B83C3678A9C275BF1398ED57EC0A4D711D0828ACB00BDB1E0C1C1F252FB026965BA
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369608305197621","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725134705"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f6db3188-62c2-4fad-aa26-e4cd1c1d3961.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.587720943184201
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afPD7RpFbBkjUvpAkHB+udrxWvBIYSWR7+OJkXUcAhN4wlRkE:Xq8NkC1fPD7LeURDBrcvTB73JkEcAbdx
MD5:	A8692EBCFBB3329964BB0B9EB1DD5E29
SHA1:	B8A2E8409C9DC5D740AA508A6485B2B80A8EE4B8
SHA-256:	FEFA099CE0F641DD8A5CC6B7F219BE185A6F51A97434FB4AAE304E52BB5B3DCB
SHA-512:	70FA1E60BEC1F7258533E5B2627BCA15A089809D4D857EC814535020AD39678F17F42F7C63498173B3470233CCEE05137DD4C4FDFD76DF50A4F8120F33F5627E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACOKMPUnOiURLaxsgTX68qGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABuy40wlQuwa+rVFVWSye4AMBU88ziMD8ylVOVBhaC0OAAAAAAOgAAAAAIAACAAAAC18qgobKrlL43Rf4B4Z0o4CsdTYvZXtpaLKyRvFpDJnzAAAAAf7JN7xveMTJlwp18HjktZdvcCcQq/IHiiukkHs2nw8owwqkX5tgsDl2j8vbGlA+1AAAAABkt8nKcdMKsj1LwtnZL1xx7U5LbGlbuhvU3rD2xSQ9NgMNsTdgO+Hw/GkE5NQtbuOfb90JRzLP9nWAcqvB65TQ=="},"policy":{"last_statistics_update":"13369608305231458"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6ea0db88-fc0d-4cec-8f88-768d097c35ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44962
Entropy (8bit):	6.096238924006079
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWMpi1zNtTFZJNhEDPFxf5ykKJDSgzMMd6qD47u3+CO:+/Ps+wsI7yOYFZJQKtSmd6qE7lFoC
MD5:	227A7F985FCFB55DD0D002D13F3EE3F2
SHA1:	892ACF518F079A20F8BEB3E344E252CF6F975B7E
SHA-256:	E7BA8FB3034F325156887E75E36A8B7ED90EE4B6412B97D21E8FB003F34D2835
SHA-512:	C1C2385A1F9D6A37EA7BA34F753A3A62F68CBDDD4E20E47CD11BFF245E2E690A5F136F951C45A2913A9505E61DE5D963BDEE4AC7BF23A291D7E4D7E27E89B865
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\70a14344-7b8e-4d2a-887a-d93aab7a2414.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978167290333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyekzItSmd6qE7lFoC
MD5:	C254A0753A39279C29328FD5B7522224
SHA1:	CF5A74E5A54F3403A7CAF00A57A28C18FBECF0B4
SHA-256:	FD55EEBC74788896D9CEEB975C013DF18155985D8A344775876596F546D70453
SHA-512:	D11AADB269EB7D25DB115859C399D23ACDCE3075B2D72B9B77C69B2B91FD96794EBD5A6B7D40DEB00B537CFA84C0DAAE114993D48DB63635C60D3A3E54469D83
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\739194ea-8f09-4a7e-b417-638be5342cda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44963
Entropy (8bit):	6.096080046121655
Encrypted:	false
SSDEEP:	768:yDXzgWPsj/qlGJqIY8GB4xWVpi1zNtTFZJ9ZEPFMQPr+uFkKJDSgzMMd6qD47u3S:y/Ps+wsI7yO5FZJ7KtSmd6qE7lFoC
MD5:	40480AB80E9A8601E72C4077A387B4D5
SHA1:	14DA4E19A2BEDFB59401FCE5987C969EB3A7329F
SHA-256:	3DC27B844C8A55D28BC10D2E4E058D07D1142D69A2589FCAF748ED6D9A4296DB
SHA-512:	C28BE87686973AA3FD7F2CF2EF154A9C6AD79258BCE8F6289662AC26FAB9849E80DEB00D1F6F86879322AA30D7EAA9FB4AEA822571F10810D838D03C3A59AABD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13369608323037169","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8bdd5c9a-e49f-4364-b1ed-2060e06b4cac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44963
Entropy (8bit):	6.096232737767981
Encrypted:	false
SSDEEP:	768:yDXzgWPsj/qlGJqIY8GB4xWVpi1zNtTFZJNoEDPFxf5ykKJDSgzMMd6qD47u3+CO:y/Ps+wsI7yO5FZJPKtSmd6qE7lFoC
MD5:	33A4E3D891C512A14DEBF48DE166BD5A
SHA1:	D75C549E8647F3A3B17465DF75353A95BACEA407
SHA-256:	BD7A3684BE166DDBDA294C7B8B97606889F85CDD7BBA3251F2BA7D806C44975F
SHA-512:	FCB7A00FFF0A2A50315262C1941484269AB061F695429DA18A85DAB096C81B137407066182A5681FC2C4F0E65B99C48E19EF6179C3E9B4B56D68063A4043A542
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13369608323037169","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9f5f00a3-cd86-4676-b94a-898f2ffd36bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44963
Entropy (8bit):	6.096232737767981
Encrypted:	false
SSDEEP:	768:yDXzgWPsj/qlGJqIY8GB4xWVpi1zNtTFZJNoEDPFxf5ykKJDSgzMMd6qD47u3+CO:y/Ps+wsI7yO5FZJPKtSmd6qE7lFoC
MD5:	33A4E3D891C512A14DEBF48DE166BD5A
SHA1:	D75C549E8647F3A3B17465DF75353A95BACEA407
SHA-256:	BD7A3684BE166DDBDA294C7B8B97606889F85CDD7BBA3251F2BA7D806C44975F
SHA-512:	FCB7A00FFF0A2A50315262C1941484269AB061F695429DA18A85DAB096C81B137407066182A5681FC2C4F0E65B99C48E19EF6179C3E9B4B56D68063A4043A542
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13369608323037169","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3778A-20E0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.12353191088270751
Encrypted:	false
SSDEEP:	768:96jt3UN7i4TUY20xd0Ab/Hjo6h8rRGOwjIkhj+RGO:96Z3Uxi4QYx8Ab/Do6URGv9hj+RG
MD5:	08A11155B41D1800108E3C59B938E05E
SHA1:	A420AFA40D6DF6749E687D7F6B134FB7242B2008
SHA-256:	4105AECB101E4AFE05A791C361E53E8BD8F25D7FFB6F12C93453B17D93605A0A
SHA-512:	CB76859105CB6B777D3F10DD0144D34BE79E2A99F5AC80E075B5EF46BB69879747F9C32562FD80B072DCCCD81EEF89E1F6D0A826302292D79116E02179C27990
Malicious:	false
Preview:	...@..@...@.....C.].....@...............p...(...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".eakivj20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U].0r........>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\17dc9e03-4b0a-4a15-a028-2818754d93cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	5.084896917442598
Encrypted:	false
SSDEEP:	96:stpqKos13bDcwfiwXnMwjTrEm8z0sY5eh6Cb7/x+6MhmuecmAeZdDUqCML/EJ:stpost6wFvrEmk0sY8bV+FiAYUqbLMJ
MD5:	1280802A2362D2984CB2966B742E5D90
SHA1:	E6011DF6D89F8BCD2F8834F77CFB432595A5BFB5
SHA-256:	F8D374DE2F817CA7E4F5C11CA9773DA28D68ADFB3C23D41A1F339208B7002184
SHA-512:	58670202F9B669D193E72A0C65FDB37D710F5A5009014594D7140D7A0B36FB669C69C0FCCD25D1D151127FE8F72ED760E00C882079A66EAC18AB61501B395A22
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369608322925257","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13369608322926230"},"dual_user":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\25616670-7744-4ca0-a854-b108d8c60d12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.229550444181697
Encrypted:	false
SSDEEP:	6:jBf+q2PN723oH+TcwtnG2tMsIFUt8SBfZmw+SBfVkwON723oH+TcwtnG2tMsLJ:MvVaYebn9GFUt8S/+e5OaYebn95J
MD5:	CE51CE0D30CF3D38802B6C5341819D84
SHA1:	1C883410428A076DF73D7594641C20B71B1F9019
SHA-256:	1490574380EFB7411CBE396557C657D2F921E8AC25907D8B5D8F643EFF7FD028
SHA-512:	6F76F4FE62F728CCAD7A3E0D9A4A4FEAE336295DF752D2E4F19749F4382D908210AC59B19D6CF105347A393A5D4B181D8BC84C819362A56039001C3E114393FE
Malicious:	false
Preview:	2024/08/31-16:05:22.767 23d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/08/31-16:05:22.767 23d8 Recovering log #3.2024/08/31-16:05:22.767 23d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.229550444181697
Encrypted:	false
SSDEEP:	6:jBf+q2PN723oH+TcwtnG2tMsIFUt8SBfZmw+SBfVkwON723oH+TcwtnG2tMsLJ:MvVaYebn9GFUt8S/+e5OaYebn95J
MD5:	CE51CE0D30CF3D38802B6C5341819D84
SHA1:	1C883410428A076DF73D7594641C20B71B1F9019
SHA-256:	1490574380EFB7411CBE396557C657D2F921E8AC25907D8B5D8F643EFF7FD028
SHA-512:	6F76F4FE62F728CCAD7A3E0D9A4A4FEAE336295DF752D2E4F19749F4382D908210AC59B19D6CF105347A393A5D4B181D8BC84C819362A56039001C3E114393FE
Malicious:	false
Preview:	2024/08/31-16:05:22.767 23d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/08/31-16:05:22.767 23d8 Recovering log #3.2024/08/31-16:05:22.767 23d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old~RF3b140.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.229550444181697
Encrypted:	false
SSDEEP:	6:jBf+q2PN723oH+TcwtnG2tMsIFUt8SBfZmw+SBfVkwON723oH+TcwtnG2tMsLJ:MvVaYebn9GFUt8S/+e5OaYebn95J
MD5:	CE51CE0D30CF3D38802B6C5341819D84
SHA1:	1C883410428A076DF73D7594641C20B71B1F9019
SHA-256:	1490574380EFB7411CBE396557C657D2F921E8AC25907D8B5D8F643EFF7FD028
SHA-512:	6F76F4FE62F728CCAD7A3E0D9A4A4FEAE336295DF752D2E4F19749F4382D908210AC59B19D6CF105347A393A5D4B181D8BC84C819362A56039001C3E114393FE
Malicious:	false
Preview:	2024/08/31-16:05:22.767 23d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/08/31-16:05:22.767 23d8 Recovering log #3.2024/08/31-16:05:22.767 23d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.149660701139435
Encrypted:	false
SSDEEP:	6:j2S+q2PN723oH+Tcwt8aPrqIFUt8S9XZmw+S93VkwON723oH+Tcwt8amLJ:yjvVaYebL3FUt8C/+u5OaYebQJ
MD5:	F870AA258CDBB7086E0A665D4A42C8B3
SHA1:	6614716BE89E8BFCFCA4BCF042F20E5DA357B9CF
SHA-256:	674AAA0A3522C32283AF689FF5F85B5E4CB9B4679FC18D94526816B99E9E6D62
SHA-512:	07D4602944BFA562E8D559BE9617D98E7327593CFAF5B784A9F732DD7FD27754BE0DE73961E8863ECB33FC92AC6B3536E0BC53E7632648360638AEEA30C44A23
Malicious:	false
Preview:	2024/08/31-16:05:22.811 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/08/31-16:05:22.815 2388 Recovering log #3.2024/08/31-16:05:22.815 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.149660701139435
Encrypted:	false
SSDEEP:	6:j2S+q2PN723oH+Tcwt8aPrqIFUt8S9XZmw+S93VkwON723oH+Tcwt8amLJ:yjvVaYebL3FUt8C/+u5OaYebQJ
MD5:	F870AA258CDBB7086E0A665D4A42C8B3
SHA1:	6614716BE89E8BFCFCA4BCF042F20E5DA357B9CF
SHA-256:	674AAA0A3522C32283AF689FF5F85B5E4CB9B4679FC18D94526816B99E9E6D62
SHA-512:	07D4602944BFA562E8D559BE9617D98E7327593CFAF5B784A9F732DD7FD27754BE0DE73961E8863ECB33FC92AC6B3536E0BC53E7632648360638AEEA30C44A23
Malicious:	false
Preview:	2024/08/31-16:05:22.811 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/08/31-16:05:22.815 2388 Recovering log #3.2024/08/31-16:05:22.815 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.15904707792414
Encrypted:	false
SSDEEP:	6:j7sN+q2PN723oH+Tcwt865IFUt8S5tWtZZmw+S3wVkwON723oH+Tcwt86+ULJ:kIvVaYeb/WFUt8ctWtZ/+x5OaYeb/+SJ
MD5:	42C443A0F0F4AD605FC9D38D4964F5CE
SHA1:	C2C3B274875805AE339F0B92A23D2363A21ECB7C
SHA-256:	6C08CE37FDAF41352C740E3A4753FD325CAAEF97AE2C4CD98B66BA689FE77F1A
SHA-512:	1E46DF29615651A53254E03633C6D7BACD9A83F163B5A7384F58C44D3209C22EDD291341DA0F4AC9B6C2E3D525977DD311FA39720F7420FBBF8477459784BB60
Malicious:	false
Preview:	2024/08/31-16:05:22.834 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/08/31-16:05:22.836 2388 Recovering log #3.2024/08/31-16:05:22.838 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.15904707792414
Encrypted:	false
SSDEEP:	6:j7sN+q2PN723oH+Tcwt865IFUt8S5tWtZZmw+S3wVkwON723oH+Tcwt86+ULJ:kIvVaYeb/WFUt8ctWtZ/+x5OaYeb/+SJ
MD5:	42C443A0F0F4AD605FC9D38D4964F5CE
SHA1:	C2C3B274875805AE339F0B92A23D2363A21ECB7C
SHA-256:	6C08CE37FDAF41352C740E3A4753FD325CAAEF97AE2C4CD98B66BA689FE77F1A
SHA-512:	1E46DF29615651A53254E03633C6D7BACD9A83F163B5A7384F58C44D3209C22EDD291341DA0F4AC9B6C2E3D525977DD311FA39720F7420FBBF8477459784BB60
Malicious:	false
Preview:	2024/08/31-16:05:22.834 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/08/31-16:05:22.836 2388 Recovering log #3.2024/08/31-16:05:22.838 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	914FD8DC5F9A741C6947E1AB12A9D113
SHA1:	6529EFE14E7B0BEA47D78B147243096408CDAAE4
SHA-256:	8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
SHA-512:	2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.190850703538519
Encrypted:	false
SSDEEP:	6:jc+q2PN723oH+Tcwt8NIFUt8SauIZmw+SbTkwON723oH+Tcwt8+eLJ:Q+vVaYebpFUt8aI/+25OaYebqJ
MD5:	45F7D798139C43562871A6B15743D3A4
SHA1:	0A071AE8283F8F7D48C87D8E9E73973CEBBAA6B9
SHA-256:	AC3F0B4117FC390B73B16972F2603D9C7F061C4BBEED25849C7625147B083D38
SHA-512:	5D5CB661DDB313935D122023C497992CB52DD25F30840DCA9468B2A65C1130593EC35851DC7806261419ABA33D5027F6C4EF00B73FC8C4E3DBAE9B7CA048C19D
Malicious:	false
Preview:	2024/08/31-16:05:30.942 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-16:05:30.944 1d70 Recovering log #3.2024/08/31-16:05:30.958 1d70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.190850703538519
Encrypted:	false
SSDEEP:	6:jc+q2PN723oH+Tcwt8NIFUt8SauIZmw+SbTkwON723oH+Tcwt8+eLJ:Q+vVaYebpFUt8aI/+25OaYebqJ
MD5:	45F7D798139C43562871A6B15743D3A4
SHA1:	0A071AE8283F8F7D48C87D8E9E73973CEBBAA6B9
SHA-256:	AC3F0B4117FC390B73B16972F2603D9C7F061C4BBEED25849C7625147B083D38
SHA-512:	5D5CB661DDB313935D122023C497992CB52DD25F30840DCA9468B2A65C1130593EC35851DC7806261419ABA33D5027F6C4EF00B73FC8C4E3DBAE9B7CA048C19D
Malicious:	false
Preview:	2024/08/31-16:05:30.942 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-16:05:30.944 1d70 Recovering log #3.2024/08/31-16:05:30.958 1d70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old~RF3b17e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.190850703538519
Encrypted:	false
SSDEEP:	6:jc+q2PN723oH+Tcwt8NIFUt8SauIZmw+SbTkwON723oH+Tcwt8+eLJ:Q+vVaYebpFUt8aI/+25OaYebqJ
MD5:	45F7D798139C43562871A6B15743D3A4
SHA1:	0A071AE8283F8F7D48C87D8E9E73973CEBBAA6B9
SHA-256:	AC3F0B4117FC390B73B16972F2603D9C7F061C4BBEED25849C7625147B083D38
SHA-512:	5D5CB661DDB313935D122023C497992CB52DD25F30840DCA9468B2A65C1130593EC35851DC7806261419ABA33D5027F6C4EF00B73FC8C4E3DBAE9B7CA048C19D
Malicious:	false
Preview:	2024/08/31-16:05:30.942 1d70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-16:05:30.944 1d70 Recovering log #3.2024/08/31-16:05:30.958 1d70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.154162523092152
Encrypted:	false
SSDEEP:	6:jtRZ0Vq2PN723oH+Tcwt8a2jMGIFUt8StRGug0gZmw+StR65IkwON723oH+Tcwtw:pMvVaYeb8EFUt819/+w5OaYeb8bJ
MD5:	EBCA932DF8C73ADCEDB4C67A0CF0534F
SHA1:	6CBBB98FDCA62CC89711F1425B6435722998CDE1
SHA-256:	624CB19A236D6AFFF3442E2C989ADF749272E866289DB26F80CFF234A38A578D
SHA-512:	1158ECD8AF01BD2D4D5619EBDDB923D0625F9AC16E66520D5A967B81A418497BA8B85BF56E73BE82043B60183F8D9CC938B80552EB39B02157C29AA19F125576
Malicious:	false
Preview:	2024/08/31-16:05:23.422 1d34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-16:05:23.423 1d34 Recovering log #3.2024/08/31-16:05:23.426 1d34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.154162523092152
Encrypted:	false
SSDEEP:	6:jtRZ0Vq2PN723oH+Tcwt8a2jMGIFUt8StRGug0gZmw+StR65IkwON723oH+Tcwtw:pMvVaYeb8EFUt819/+w5OaYeb8bJ
MD5:	EBCA932DF8C73ADCEDB4C67A0CF0534F
SHA1:	6CBBB98FDCA62CC89711F1425B6435722998CDE1
SHA-256:	624CB19A236D6AFFF3442E2C989ADF749272E866289DB26F80CFF234A38A578D
SHA-512:	1158ECD8AF01BD2D4D5619EBDDB923D0625F9AC16E66520D5A967B81A418497BA8B85BF56E73BE82043B60183F8D9CC938B80552EB39B02157C29AA19F125576
Malicious:	false
Preview:	2024/08/31-16:05:23.422 1d34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-16:05:23.423 1d34 Recovering log #3.2024/08/31-16:05:23.426 1d34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\807fc8f5-7901-4b82-ad82-eb86b7338b0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1ec4287-c0a4-4ea1-98ce-ee1ad8af3dcf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	5.084896917442598
Encrypted:	false
SSDEEP:	96:stpqKos13bDcwfiwXnMwjTrEm8z0sY5eh6Cb7/x+6MhmuecmAeZdDUqCML/EJ:stpost6wFvrEmk0sY8bV+FiAYUqbLMJ
MD5:	1280802A2362D2984CB2966B742E5D90
SHA1:	E6011DF6D89F8BCD2F8834F77CFB432595A5BFB5
SHA-256:	F8D374DE2F817CA7E4F5C11CA9773DA28D68ADFB3C23D41A1F339208B7002184
SHA-512:	58670202F9B669D193E72A0C65FDB37D710F5A5009014594D7140D7A0B36FB669C69C0FCCD25D1D151127FE8F72ED760E00C882079A66EAC18AB61501B395A22
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369608322925257","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13369608322926230"},"dual_user":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3b2c7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	5.084896917442598
Encrypted:	false
SSDEEP:	96:stpqKos13bDcwfiwXnMwjTrEm8z0sY5eh6Cb7/x+6MhmuecmAeZdDUqCML/EJ:stpost6wFvrEmk0sY8bV+FiAYUqbLMJ
MD5:	1280802A2362D2984CB2966B742E5D90
SHA1:	E6011DF6D89F8BCD2F8834F77CFB432595A5BFB5
SHA-256:	F8D374DE2F817CA7E4F5C11CA9773DA28D68ADFB3C23D41A1F339208B7002184
SHA-512:	58670202F9B669D193E72A0C65FDB37D710F5A5009014594D7140D7A0B36FB669C69C0FCCD25D1D151127FE8F72ED760E00C882079A66EAC18AB61501B395A22
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369608322925257","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13369608322926230"},"dual_user":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.568516254732926
Encrypted:	false
SSDEEP:	768:9VS4cXWa3W5wNgf44L8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPeuIYl1prwXU4pFtZ:9YFXN3WaNgfFLu1jazkTaFtZ
MD5:	99A3F6D1E6B37FA8D7FB468AC3B7A409
SHA1:	993BD71BCB791109DCFECFCB8426812C169012B8
SHA-256:	39B5B6401AFAD6B911C00773C4F51BDC929EF8E8657E26A60EB4B50BFEF6ACE8
SHA-512:	B35ED372D1C134FCB789B7539CF8D435E82BB930CAE42249C4380461677CEA443517F6DF055673E91E0DF3A66D1B8BAA99A6B8B992E2CD9355B86D394919209C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369608322770065","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369608322770065","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.119188345630578
Encrypted:	false
SSDEEP:	6:jtR+PSVq2PN723oH+TcwtrQMxIFUt8StR8qgZmw+StR6ug0IkwON723oH+Tcwtrb:9vVaYebCFUt8dP/+C45OaYebtJ
MD5:	BC6EF8CC3CEACE318040FCE63CBEA45E
SHA1:	E61136CC1C4587BE4E00AA1B9FFFB42D12D187E5
SHA-256:	15191C811ACC15EF04E20BC24D61E6E6940019EED5D777D44238F5609932FF3E
SHA-512:	9E07181DB7072825862DF81F937050495ABB0ED0A49B3BA0B5490CBBCB83144A66B5ABB90BA2F25443F00FB5F4B739861C2A73B48A70002B180540DCF032AC21
Malicious:	false
Preview:	2024/08/31-16:05:23.401 1d34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-16:05:23.403 1d34 Recovering log #3.2024/08/31-16:05:23.405 1d34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.119188345630578
Encrypted:	false
SSDEEP:	6:jtR+PSVq2PN723oH+TcwtrQMxIFUt8StR8qgZmw+StR6ug0IkwON723oH+Tcwtrb:9vVaYebCFUt8dP/+C45OaYebtJ
MD5:	BC6EF8CC3CEACE318040FCE63CBEA45E
SHA1:	E61136CC1C4587BE4E00AA1B9FFFB42D12D187E5
SHA-256:	15191C811ACC15EF04E20BC24D61E6E6940019EED5D777D44238F5609932FF3E
SHA-512:	9E07181DB7072825862DF81F937050495ABB0ED0A49B3BA0B5490CBBCB83144A66B5ABB90BA2F25443F00FB5F4B739861C2A73B48A70002B180540DCF032AC21
Malicious:	false
Preview:	2024/08/31-16:05:23.401 1d34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-16:05:23.403 1d34 Recovering log #3.2024/08/31-16:05:23.405 1d34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.155578431060995
Encrypted:	false
SSDEEP:	6:jv4q2PN723oH+Tcwt7Uh2ghZIFUt8SvJZmw+SvDkwON723oH+Tcwt7Uh2gnLJ:cvVaYebIhHh2FUt86/+G5OaYebIhHLJ
MD5:	628E6B685837E05720D686B2EB70AAB9
SHA1:	6A137592E6D31A5A495CD777DF2162CC4C246005
SHA-256:	BAB90E44386A2DB5D240FAC57E8975D061D862F2850ED72B85E0450C3D111B68
SHA-512:	CAE699AE49438811F247E1EE86F2302AB338B8833E57B9AAF111A8BEB335A3B44EA6CBA436AF2430373601B46E472D702976056777BFE8CE8DC2D871AE6AB43A
Malicious:	false
Preview:	2024/08/31-16:05:22.869 2390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-16:05:22.869 2390 Recovering log #3.2024/08/31-16:05:22.869 2390 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.155578431060995
Encrypted:	false
SSDEEP:	6:jv4q2PN723oH+Tcwt7Uh2ghZIFUt8SvJZmw+SvDkwON723oH+Tcwt7Uh2gnLJ:cvVaYebIhHh2FUt86/+G5OaYebIhHLJ
MD5:	628E6B685837E05720D686B2EB70AAB9
SHA1:	6A137592E6D31A5A495CD777DF2162CC4C246005
SHA-256:	BAB90E44386A2DB5D240FAC57E8975D061D862F2850ED72B85E0450C3D111B68
SHA-512:	CAE699AE49438811F247E1EE86F2302AB338B8833E57B9AAF111A8BEB335A3B44EA6CBA436AF2430373601B46E472D702976056777BFE8CE8DC2D871AE6AB43A
Malicious:	false
Preview:	2024/08/31-16:05:22.869 2390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-16:05:22.869 2390 Recovering log #3.2024/08/31-16:05:22.869 2390 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RF3b140.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.155578431060995
Encrypted:	false
SSDEEP:	6:jv4q2PN723oH+Tcwt7Uh2ghZIFUt8SvJZmw+SvDkwON723oH+Tcwt7Uh2gnLJ:cvVaYebIhHh2FUt86/+G5OaYebIhHLJ
MD5:	628E6B685837E05720D686B2EB70AAB9
SHA1:	6A137592E6D31A5A495CD777DF2162CC4C246005
SHA-256:	BAB90E44386A2DB5D240FAC57E8975D061D862F2850ED72B85E0450C3D111B68
SHA-512:	CAE699AE49438811F247E1EE86F2302AB338B8833E57B9AAF111A8BEB335A3B44EA6CBA436AF2430373601B46E472D702976056777BFE8CE8DC2D871AE6AB43A
Malicious:	false
Preview:	2024/08/31-16:05:22.869 2390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-16:05:22.869 2390 Recovering log #3.2024/08/31-16:05:22.869 2390 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	280
Entropy (8bit):	5.238812921818751
Encrypted:	false
SSDEEP:	6:jtRQ3ScSPRqN723oH+TcwtzjqEKj0QMxIFUfQV/EXTwbEu:g3SxEaYebvqBZFUIuDwB
MD5:	3791174F2916138939EB9A978E2E1471
SHA1:	CA590E9D35E054F6F55F4FF3B1F84F28C9A530A1
SHA-256:	3AB843B8505C89E3CE84792C4E746E76869EBB32C8040A280B8375E011A4BA81
SHA-512:	A7CBDA880ED25602B523BBD707BDB355799A76D533CC5259C8048C9C48C4FAF2E1954D3EB148557E258EB6C60FEB3BF85123E5D8EA8F0D7EFE495F6CD035E20B
Malicious:	false
Preview:	2024/08/31-16:05:23.487 2008 Reuse MANIFEST: IO error: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001: Unable to create appendable file (ChromeMethodBFE: 21::NewAppendableFile::16).

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	280
Entropy (8bit):	5.238812921818751
Encrypted:	false
SSDEEP:	6:jtRQ3ScSPRqN723oH+TcwtzjqEKj0QMxIFUfQV/EXTwbEu:g3SxEaYebvqBZFUIuDwB
MD5:	3791174F2916138939EB9A978E2E1471
SHA1:	CA590E9D35E054F6F55F4FF3B1F84F28C9A530A1
SHA-256:	3AB843B8505C89E3CE84792C4E746E76869EBB32C8040A280B8375E011A4BA81
SHA-512:	A7CBDA880ED25602B523BBD707BDB355799A76D533CC5259C8048C9C48C4FAF2E1954D3EB148557E258EB6C60FEB3BF85123E5D8EA8F0D7EFE495F6CD035E20B
Malicious:	false
Preview:	2024/08/31-16:05:23.487 2008 Reuse MANIFEST: IO error: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001: Unable to create appendable file (ChromeMethodBFE: 21::NewAppendableFile::16).

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.231492384272724
Encrypted:	false
SSDEEP:	6:jPjHN+q2PN723oH+TcwtpIFUt8SPjHZZmw+S6wVkwON723oH+Tcwta/WLJ:7jovVaYebmFUt84j5/+s5OaYebaUJ
MD5:	C7DBBB0CA8BEE6F1C4443FCAC2F58E80
SHA1:	BDB99A7CD6611CFB73EC8C7819CF7891C886F0CC
SHA-256:	DFBEB646C4873E7941BFA72591736450E854BAA58E066FA129366BB090E06CFF
SHA-512:	341846EB6A14E2547B291430759F5800A56E76C160E6CFB6636EA7EF5E814D1FBB8A3F69FE4D7EC45E7B21C67A39F1B3A1753F53E03EB04F0AFF9B4E25BAA775
Malicious:	false
Preview:	2024/08/31-16:05:22.789 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-16:05:22.789 2388 Recovering log #3.2024/08/31-16:05:22.790 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.231492384272724
Encrypted:	false
SSDEEP:	6:jPjHN+q2PN723oH+TcwtpIFUt8SPjHZZmw+S6wVkwON723oH+Tcwta/WLJ:7jovVaYebmFUt84j5/+s5OaYebaUJ
MD5:	C7DBBB0CA8BEE6F1C4443FCAC2F58E80
SHA1:	BDB99A7CD6611CFB73EC8C7819CF7891C886F0CC
SHA-256:	DFBEB646C4873E7941BFA72591736450E854BAA58E066FA129366BB090E06CFF
SHA-512:	341846EB6A14E2547B291430759F5800A56E76C160E6CFB6636EA7EF5E814D1FBB8A3F69FE4D7EC45E7B21C67A39F1B3A1753F53E03EB04F0AFF9B4E25BAA775
Malicious:	false
Preview:	2024/08/31-16:05:22.789 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-16:05:22.789 2388 Recovering log #3.2024/08/31-16:05:22.790 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old~RF3b075.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.231492384272724
Encrypted:	false
SSDEEP:	6:jPjHN+q2PN723oH+TcwtpIFUt8SPjHZZmw+S6wVkwON723oH+Tcwta/WLJ:7jovVaYebmFUt84j5/+s5OaYebaUJ
MD5:	C7DBBB0CA8BEE6F1C4443FCAC2F58E80
SHA1:	BDB99A7CD6611CFB73EC8C7819CF7891C886F0CC
SHA-256:	DFBEB646C4873E7941BFA72591736450E854BAA58E066FA129366BB090E06CFF
SHA-512:	341846EB6A14E2547B291430759F5800A56E76C160E6CFB6636EA7EF5E814D1FBB8A3F69FE4D7EC45E7B21C67A39F1B3A1753F53E03EB04F0AFF9B4E25BAA775
Malicious:	false
Preview:	2024/08/31-16:05:22.789 2388 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-16:05:22.789 2388 Recovering log #3.2024/08/31-16:05:22.790 2388 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1249281078451319
Encrypted:	false
SSDEEP:	384:A2qOB1nxCkfSA1LyKOMq+8iP5GDHP/0j:dq+n0E91LyKOMq+8iP5GLP/0
MD5:	53D687A985E48D85B4216D0DD556E8E7
SHA1:	DC9E6C88D090CBDB0A3A66A3AD17C4830468DDB0
SHA-256:	0B76CA8CF3D45CA362FD56E77DAE91266E7E227E4879A31451514903B230490E
SHA-512:	CE5E49EFB3E101592039AA8C37BAC54452C5ACC5A122E8B51C3FEAC24D49F60ECEA7D3FE4EA7DD9B53541FB43C94B9CE25332A5EFEAFE3181C68BB6F7AE9EBB0
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a14213da-f007-49cc-8edc-01e412cb51a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b3f6fe9e-915a-499f-97ee-f392a62cd479.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\de3ce702-2aea-4f25-8ee2-d145f77beb33.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.568516254732926
Encrypted:	false
SSDEEP:	768:9VS4cXWa3W5wNgf44L8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPeuIYl1prwXU4pFtZ:9YFXN3WaNgfFLu1jazkTaFtZ
MD5:	99A3F6D1E6B37FA8D7FB468AC3B7A409
SHA1:	993BD71BCB791109DCFECFCB8426812C169012B8
SHA-256:	39B5B6401AFAD6B911C00773C4F51BDC929EF8E8657E26A60EB4B50BFEF6ACE8
SHA-512:	B35ED372D1C134FCB789B7539CF8D435E82BB930CAE42249C4380461677CEA443517F6DF055673E91E0DF3A66D1B8BAA99A6B8B992E2CD9355B86D394919209C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369608322770065","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369608322770065","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 8, database pages 11, cookie 0x7, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.4108834313259155
Encrypted:	false
SSDEEP:	24:TSWUYP5/ZrK/AxH1Aj5sAFWZmasamfDsCBjy8e+ZcI5fc:TnUYVAKAFXX+CcEc
MD5:	8593795778EA3EC8221366AA2FBBA867
SHA1:	2F307D4925183EA13E7BE637CB93ECAF2BA9810A
SHA-256:	F3C17873660988454A5A403D047FCE88379D1FE8917A89C98E6EB940F8929C03
SHA-512:	CC86DD61ACEDA6F2927C4C23CBD6D426F2C8CD1DF65E342C76D07153ACBF801F9B297F8EF182097CBABBDE6A49C90AF0E7A38E49AB53DF3FD2EC2D5BC675099A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................?.P................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04980715022639089
Encrypted:	false
SSDEEP:	6:Gd0ddi8gd0ddi8myL9XCChslotGLNl0ml/XoQDeX:zddHgiddH7pEjVl/XoQ
MD5:	0DCF538A04A10139C2BEF0CD1B1FA9FB
SHA1:	C6AED1B5CA0A1ECE6E81CC70CD14AA046162B5D0
SHA-256:	752A0BD20BD96F5916028A5F87541F11C760FDC19DE38C8BCB16B4C14DF60647
SHA-512:	49DBC69DFFD0CCAEE055EB9D417412E90EEA4362B57585064E8F89B0911264BA86A06EC01B31B0450027E87AAB4BB2CB0754666F4C81604C152A06C5BE1FE287
Malicious:	false
Preview:	..-.......................FVN...$J...V..n.c..mv=..-.......................FVN...$J...V..n.c..mv=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2477838368371295
Encrypted:	false
SSDEEP:	6:jVWHDM+q2PN723oH+TcwtfrK+IFUt8SyAgZmw+SyADMVkwON723oH+TcwtfrUeLJ:pWHDM+vVaYeb23FUt8kg/+kDMV5OaYet
MD5:	91F1DC7C88BF312B1E3F787F97C56A7C
SHA1:	0AF6D196349CAD1E25C2D02C593200015427C5A9
SHA-256:	A1D1EE5808970F8E42E57C34BC171CA8E2D432898C280F6FFD31E6E88B72EE64
SHA-512:	023CBA289C7D44CF33547B3561D46B2BB0569A9C7CA13C69C5B28780779CCD6D36FBE2C2F340D66A50A2833F39692B6B360DD8894637F7095056A27C2D4D52EF
Malicious:	false
Preview:	2024/08/31-16:05:22.917 238c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/08/31-16:05:22.918 238c Recovering log #3.2024/08/31-16:05:22.918 238c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2477838368371295
Encrypted:	false
SSDEEP:	6:jVWHDM+q2PN723oH+TcwtfrK+IFUt8SyAgZmw+SyADMVkwON723oH+TcwtfrUeLJ:pWHDM+vVaYeb23FUt8kg/+kDMV5OaYet
MD5:	91F1DC7C88BF312B1E3F787F97C56A7C
SHA1:	0AF6D196349CAD1E25C2D02C593200015427C5A9
SHA-256:	A1D1EE5808970F8E42E57C34BC171CA8E2D432898C280F6FFD31E6E88B72EE64
SHA-512:	023CBA289C7D44CF33547B3561D46B2BB0569A9C7CA13C69C5B28780779CCD6D36FBE2C2F340D66A50A2833F39692B6B360DD8894637F7095056A27C2D4D52EF
Malicious:	false
Preview:	2024/08/31-16:05:22.917 238c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/08/31-16:05:22.918 238c Recovering log #3.2024/08/31-16:05:22.918 238c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.228227682462873
Encrypted:	false
SSDEEP:	6:jdDM+q2PN723oH+TcwtfrzAdIFUt8SdgZmw+SdDMVkwON723oH+TcwtfrzILJ:JDM+vVaYeb9FUt84g/+4DMV5OaYeb2J
MD5:	13B2D210422C0C8E7F44417EF1D80B26
SHA1:	551802C6BCFE705671E813C9CBF1CF46EA055490
SHA-256:	E3E80B82CAAA6AA0E214DD23B586F1779B79FF06390BD4FE0B247763F0675C7D
SHA-512:	A6BEB8945D717A4E5FF36970BC64BA80DC825D6130F3180B30AC45A3B9D9DA65D9E441E8F613D1BB9D92382DB239627AEF021E121A042A733940B307DFB1E41B
Malicious:	false
Preview:	2024/08/31-16:05:22.914 238c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/08/31-16:05:22.914 238c Recovering log #3.2024/08/31-16:05:22.914 238c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.228227682462873
Encrypted:	false
SSDEEP:	6:jdDM+q2PN723oH+TcwtfrzAdIFUt8SdgZmw+SdDMVkwON723oH+TcwtfrzILJ:JDM+vVaYeb9FUt84g/+4DMV5OaYeb2J
MD5:	13B2D210422C0C8E7F44417EF1D80B26
SHA1:	551802C6BCFE705671E813C9CBF1CF46EA055490
SHA-256:	E3E80B82CAAA6AA0E214DD23B586F1779B79FF06390BD4FE0B247763F0675C7D
SHA-512:	A6BEB8945D717A4E5FF36970BC64BA80DC825D6130F3180B30AC45A3B9D9DA65D9E441E8F613D1BB9D92382DB239627AEF021E121A042A733940B307DFB1E41B
Malicious:	false
Preview:	2024/08/31-16:05:22.914 238c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/08/31-16:05:22.914 238c Recovering log #3.2024/08/31-16:05:22.914 238c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978167290333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyekzItSmd6qE7lFoC
MD5:	C254A0753A39279C29328FD5B7522224
SHA1:	CF5A74E5A54F3403A7CAF00A57A28C18FBECF0B4
SHA-256:	FD55EEBC74788896D9CEEB975C013DF18155985D8A344775876596F546D70453
SHA-512:	D11AADB269EB7D25DB115859C399D23ACDCE3075B2D72B9B77C69B2B91FD96794EBD5A6B7D40DEB00B537CFA84C0DAAE114993D48DB63635C60D3A3E54469D83
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF392bb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978167290333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyekzItSmd6qE7lFoC
MD5:	C254A0753A39279C29328FD5B7522224
SHA1:	CF5A74E5A54F3403A7CAF00A57A28C18FBECF0B4
SHA-256:	FD55EEBC74788896D9CEEB975C013DF18155985D8A344775876596F546D70453
SHA-512:	D11AADB269EB7D25DB115859C399D23ACDCE3075B2D72B9B77C69B2B91FD96794EBD5A6B7D40DEB00B537CFA84C0DAAE114993D48DB63635C60D3A3E54469D83
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39404.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978167290333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyekzItSmd6qE7lFoC
MD5:	C254A0753A39279C29328FD5B7522224
SHA1:	CF5A74E5A54F3403A7CAF00A57A28C18FBECF0B4
SHA-256:	FD55EEBC74788896D9CEEB975C013DF18155985D8A344775876596F546D70453
SHA-512:	D11AADB269EB7D25DB115859C399D23ACDCE3075B2D72B9B77C69B2B91FD96794EBD5A6B7D40DEB00B537CFA84C0DAAE114993D48DB63635C60D3A3E54469D83
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF394bf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978167290333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyekzItSmd6qE7lFoC
MD5:	C254A0753A39279C29328FD5B7522224
SHA1:	CF5A74E5A54F3403A7CAF00A57A28C18FBECF0B4
SHA-256:	FD55EEBC74788896D9CEEB975C013DF18155985D8A344775876596F546D70453
SHA-512:	D11AADB269EB7D25DB115859C399D23ACDCE3075B2D72B9B77C69B2B91FD96794EBD5A6B7D40DEB00B537CFA84C0DAAE114993D48DB63635C60D3A3E54469D83
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b1ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978167290333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyekzItSmd6qE7lFoC
MD5:	C254A0753A39279C29328FD5B7522224
SHA1:	CF5A74E5A54F3403A7CAF00A57A28C18FBECF0B4
SHA-256:	FD55EEBC74788896D9CEEB975C013DF18155985D8A344775876596F546D70453
SHA-512:	D11AADB269EB7D25DB115859C399D23ACDCE3075B2D72B9B77C69B2B91FD96794EBD5A6B7D40DEB00B537CFA84C0DAAE114993D48DB63635C60D3A3E54469D83
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b278.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978167290333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyekzItSmd6qE7lFoC
MD5:	C254A0753A39279C29328FD5B7522224
SHA1:	CF5A74E5A54F3403A7CAF00A57A28C18FBECF0B4
SHA-256:	FD55EEBC74788896D9CEEB975C013DF18155985D8A344775876596F546D70453
SHA-512:	D11AADB269EB7D25DB115859C399D23ACDCE3075B2D72B9B77C69B2B91FD96794EBD5A6B7D40DEB00B537CFA84C0DAAE114993D48DB63635C60D3A3E54469D83
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b2c7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08978167290333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynyekzItSmd6qE7lFoC
MD5:	C254A0753A39279C29328FD5B7522224
SHA1:	CF5A74E5A54F3403A7CAF00A57A28C18FBECF0B4
SHA-256:	FD55EEBC74788896D9CEEB975C013DF18155985D8A344775876596F546D70453
SHA-512:	D11AADB269EB7D25DB115859C399D23ACDCE3075B2D72B9B77C69B2B91FD96794EBD5A6B7D40DEB00B537CFA84C0DAAE114993D48DB63635C60D3A3E54469D83
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018238520723782249
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEjrrXF:/M/xT02zaXF
MD5:	5193C55BE2D3F5497D7596B39377876D
SHA1:	0A25106CA005623F6E005DEF4567BDC870844F01
SHA-256:	415D4415888438A6C56F72A4C195BE3D1C61695CAC5B9416495A653A21FDC1A4
SHA-512:	3962E77786E0712C5DB741442FB24402479FE4AE5E6F63F1A9B0D9A764394E9570CF3338F95DF680E0ED1D289AAE7D7BD6FB67430E2116070E4211B532037E84
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f5f16104-5123-4643-a8aa-d55bd7de4610.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44963
Entropy (8bit):	6.096088324481052
Encrypted:	false
SSDEEP:	768:yDXzgWPsj/qlGJqIY8GB4xWVpi1zNtTFZJ9lEPFMQPr+uFkKJDSgzMMd6qD47u3S:y/Ps+wsI7yO5FZJbKtSmd6qE7lFoC
MD5:	27999965F12F77463867C37785422461
SHA1:	BAB2428114E1ECBB4359FA69A666F1AB1DB21389
SHA-256:	A98C08C1B629C464BD749EA27F6060360D5A34D3C0606343FA1E7D84C389CE82
SHA-512:	7F5B8771E4A32E7B4F7084D5FADF7B664E8DB086D0E6286D4120B8F83F762041C735818F19F906CE7226FB23ED4685E51A0AA9897814516E40A9218466DCC19B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13369608323037169","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8405554413959466
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxWSxl9Il8uM18s3TJZtvLFK5cZag7Cffd1rc:mV2Y66s3TJjhgcAgr
MD5:	7236DF892F0C542A6F45C5CE2E650AC6
SHA1:	8AC7681E37ABC6CE4215D5661EE0D1D19F7D8D66
SHA-256:	9FA2497355FC870CD26F30CFADEAEB15C12BED6D96D562CF4F33A83D75993426
SHA-512:	D775707BD0ABF987F37C244E9DC578138CD56FB4EDC47EF294210CE4C153D3628C51A4BF1285E3F588090C6D2BD06785C6390B3C6261512562C1F0EA07CACA6B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.q.c.d.e.n.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.i.j.D.1.J.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002280731787969
Encrypted:	false
SSDEEP:	96:mY6Dk05APRlNVrrC5zfhhMqNVDIVPBZECoS+MM:mnT5APpJrC5j3MqNkZZQd
MD5:	BA445DB6D53A14D5FCDCFF2E5FF3F32B
SHA1:	82F504EB7521FE62DF15CA02C0CF18005B97C154
SHA-256:	76E7CF375D00585756E31A1A0BF371C063AFCBD910419A3316D3DF2DB205F13D
SHA-512:	E185C8A30B2560D92EA6BF0413701D761490817B7992769DF435B9F356517A378993E312D0E9ADEF063AE2AE723374DAA314278DAA7279E237EA6C02D1DED0F2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.j.T./.W.+.H.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.j.i.j.D.1.J.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	5.3943982825133086
Encrypted:	false
SSDEEP:	24:YZGMfJVA/5BGMLfp5BGMz6jT07ncIF5InHI0MY5kUQnA0OpJ5xHRS4L0Mom2J5VJ:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A+
MD5:	A9D0D1B9BD0102472FE97C24D6FF5C79
SHA1:	4101FEBD38358E85DBBA647CBC04D9D137A38B60
SHA-256:	3B16597754F47A8A018D3B94BD4E3F3FCA2E0563F1FBFB3D5A88D8E9BDB6B3D7
SHA-512:	0D5707DB6A0DC7A229CE76B9DF3289AABFF59671D40BF3376A1F363359BA6C9FDE20D36D0E9D8A21146DB4070A68E7375F3978E65065745C204B8C7E15D1A39F
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1PZ0W9E23LUP31HVCP4L.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5217839733609697
Encrypted:	false
SSDEEP:	48:LOBldOKEEsiW9zBdLXuHxkDph4A1NdOK/EsiW9zngdLXuHxk+21:D3uRkDAOnIuRkz
MD5:	9E76E6FD95AAC889F7A81866F8FADAF8
SHA1:	EF60D9430486485A4E8CD5EFFD09048D9B947F4C
SHA-256:	24F2F75F94A32C7FABC27BC436BAF2DA5803F58F8DD14FD2BE8604A8FC53DA69
SHA-512:	D75474A48A31843AC4D92B67403F6EFBAD2689545AE778EB21E16E05F38F8C33375ABD617DB50D4BF450A95AE6BA83CF4CBE106281A48AB5310BE1EE668FA054
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....H.....".......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....EW.5..PROGRA~2.........O.IEW.5....................V.....!s..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....EW.5..MICROS~1..D......(Ux..Y............................Lp..M.i.c.r.o.s.o.f.t.....N.1.....EW/40.Edge..:.......S8.EW74..............................E.d.g.e.....`.1.....EW$40.APPLIC~1..H.......S8..Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.DW. .msedge.exe..F.......S8..Y.............................5.m.s.e.d.g.e...e.x.e.......k...............-.......j...........,b......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5217839733609697
Encrypted:	false
SSDEEP:	48:LOBldOKEEsiW9zBdLXuHxkDph4A1NdOK/EsiW9zngdLXuHxk+21:D3uRkDAOnIuRkz
MD5:	9E76E6FD95AAC889F7A81866F8FADAF8
SHA1:	EF60D9430486485A4E8CD5EFFD09048D9B947F4C
SHA-256:	24F2F75F94A32C7FABC27BC436BAF2DA5803F58F8DD14FD2BE8604A8FC53DA69
SHA-512:	D75474A48A31843AC4D92B67403F6EFBAD2689545AE778EB21E16E05F38F8C33375ABD617DB50D4BF450A95AE6BA83CF4CBE106281A48AB5310BE1EE668FA054
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....H.....".......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....EW.5..PROGRA~2.........O.IEW.5....................V.....!s..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....EW.5..MICROS~1..D......(Ux..Y............................Lp..M.i.c.r.o.s.o.f.t.....N.1.....EW/40.Edge..:.......S8.EW74..............................E.d.g.e.....`.1.....EW$40.APPLIC~1..H.......S8..Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.DW. .msedge.exe..F.......S8..Y.............................5.m.s.e.d.g.e...e.x.e.......k...............-.......j...........,b......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJTI755WXG007W07H4RO.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5191859586437433
Encrypted:	false
SSDEEP:	48:LO1NdOK/EsiW9zBdLXuHxkDph4A1NdOK/EsiW9zngdLXuHxk+21:Y3uRkDAOnIuRkz
MD5:	ED848EC9C2D41A8CCFA5F4A9AA7029B8
SHA1:	4237141F27719A63B62A0ACFD6A812BF73BAF676
SHA-256:	F748F2E2C06CF2DD8463C2A8F3EED543DD808A314F1789EFC8749D117D8FF087
SHA-512:	9D523DB359A4801C0EDD8825FBC7E936C2AF9EBF5F88B8626DECE276CE4AF4A1975A0BDBF0E66FD9DF0AF81B7273C0FFF59945F57086478931B49E46321E5465
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....H.....".......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~2.........O.I.Y......................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....EW.5..MICROS~1..D......(Ux..Y............................Lp..M.i.c.r.o.s.o.f.t.....N.1.....EW/40.Edge..:.......S8..Y................................E.d.g.e.....`.1.....EW$40.APPLIC~1..H.......S8..Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.DW. .msedge.exe..F.......S8..Y.............................5.m.s.e.d.g.e...e.x.e.......k...............-.......j...........,b......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5191859586437433
Encrypted:	false
SSDEEP:	48:LO1NdOK/EsiW9zBdLXuHxkDph4A1NdOK/EsiW9zngdLXuHxk+21:Y3uRkDAOnIuRkz
MD5:	ED848EC9C2D41A8CCFA5F4A9AA7029B8
SHA1:	4237141F27719A63B62A0ACFD6A812BF73BAF676
SHA-256:	F748F2E2C06CF2DD8463C2A8F3EED543DD808A314F1789EFC8749D117D8FF087
SHA-512:	9D523DB359A4801C0EDD8825FBC7E936C2AF9EBF5F88B8626DECE276CE4AF4A1975A0BDBF0E66FD9DF0AF81B7273C0FFF59945F57086478931B49E46321E5465
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....H.....".......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~2.........O.I.Y......................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....EW.5..MICROS~1..D......(Ux..Y............................Lp..M.i.c.r.o.s.o.f.t.....N.1.....EW/40.Edge..:.......S8..Y................................E.d.g.e.....`.1.....EW$40.APPLIC~1..H.......S8..Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.DW. .msedge.exe..F.......S8..Y.............................5.m.s.e.d.g.e...e.x.e.......k...............-.......j...........,b......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.57977142707605
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	4ea77c57cb0e4de372edd5e2d1ae4a82
SHA1:	0eb5ce10901508bd6617b8312cfbe41e1ebf7b23
SHA256:	accf43f97945d8b74f25174f9b69a8df69bd60386bd1a74ae53bc7c927495bfc
SHA512:	18ac99c993eda51b87a1d342ed735371b94f60195f0ef59ebcb7d0993bbf12602ed46b4612ae7fee4d01ca24dc957ea79ccea403ad998e7f54f829fdfed691dc
SSDEEP:	12288:KqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTM:KqDEvCTbMWu7rQYlBQcBiT6rprG8asM
TLSH:	07159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D374B0 [Sat Aug 31 19:53:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FD3E0DEB313h
jmp 00007FD3E0DEAC1Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD3E0DEADFDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD3E0DEADCAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FD3E0DED9BDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FD3E0DEDA08h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FD3E0DED9F1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	da18dafcfde703c70293ae2aa3426004	False	0.28692708333333333	data	5.165951190775798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 22:05:01.201381922 CEST	49674	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:01.201381922 CEST	49673	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:01.513876915 CEST	49672	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:04.881469965 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:04.881521940 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:04.881648064 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:04.882251024 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:04.882261038 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:05.708369017 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:05.708466053 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:05.713150978 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:05.713171005 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:05.713404894 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:05.716207981 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:05.716279984 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:05.716284990 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:05.716449022 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:05.760495901 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:05.890866041 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:05.891187906 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:05.891259909 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:05.891396046 CEST	49710	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:05.891421080 CEST	443	49710	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:10.819710970 CEST	49674	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:10.887341022 CEST	49673	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:11.200208902 CEST	49672	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:12.293030024 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:12.293052912 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:12.293142080 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:12.293468952 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:12.293482065 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:12.300335884 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:12.300362110 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:12.300441980 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:12.300688982 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:12.300704956 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:12.782439947 CEST	443	49705	173.222.162.64	192.168.2.6
Aug 31, 2024 22:05:12.782537937 CEST	49705	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:12.937814951 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:12.975450039 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:12.991322994 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:12.999387026 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:12.999396086 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.000463009 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.000474930 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.000528097 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.003443956 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.003456116 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.004671097 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.004740000 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.028755903 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.028871059 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.028886080 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.029081106 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.029457092 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.029476881 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.029531002 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.029541016 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.096800089 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.131045103 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.131097078 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.131118059 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.131128073 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.131172895 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.131172895 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.131469965 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.131524086 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.131809950 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.132361889 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.132384062 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.132390976 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.132412910 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.132425070 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.132436991 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.132436991 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.132448912 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.132509947 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.132509947 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.174263000 CEST	49729	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.174276114 CEST	443	49729	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.186855078 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:13.186880112 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:13.186958075 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:13.187613964 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:13.187628031 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:13.215286970 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.215295076 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.215323925 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.215336084 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.215353966 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.215359926 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.215396881 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.215425014 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.216886997 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.216903925 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.216969967 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.216974974 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.217015982 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.301589012 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.301611900 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.301662922 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.301673889 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.301681042 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.301738977 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.301743984 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.301754951 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.301804066 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.302592993 CEST	49728	443	192.168.2.6	13.107.246.42
Aug 31, 2024 22:05:13.302601099 CEST	443	49728	13.107.246.42	192.168.2.6
Aug 31, 2024 22:05:13.361772060 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.361813068 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.361901045 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.362097979 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.362112045 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.362963915 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.363017082 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.363224030 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.363224030 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.363260031 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.364984035 CEST	49735	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.364995003 CEST	443	49735	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.365124941 CEST	49735	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.365271091 CEST	49735	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.365282059 CEST	443	49735	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.366864920 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.366873980 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.366954088 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.367145061 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.367156029 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.425348043 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.425379038 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.425431967 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.426166058 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.426178932 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.821594954 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.821887970 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.821908951 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.822630882 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.822808027 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.822818995 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.823110104 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.823174000 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.823853016 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.823925018 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.824106932 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.824525118 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.824596882 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.825022936 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.825030088 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.825242043 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.825309992 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.825404882 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.825412989 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.825542927 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.825551033 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.826105118 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.826164007 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.826992035 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.827059031 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.827189922 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.827197075 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.843739033 CEST	443	49735	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.843971014 CEST	49735	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.843980074 CEST	443	49735	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.844986916 CEST	443	49735	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.845072985 CEST	49735	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.846033096 CEST	49735	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.846110106 CEST	443	49735	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.846194029 CEST	49735	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.846201897 CEST	443	49735	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.871575117 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.871736050 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.887304068 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.904520988 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.904774904 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.904793978 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.906255007 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.906311035 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.907609940 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.907677889 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.907783985 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.940161943 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.940252066 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.940334082 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.940529108 CEST	49736	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.940543890 CEST	443	49736	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.940550089 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.940625906 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.940746069 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.940913916 CEST	49733	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:05:13.940927982 CEST	443	49733	172.64.41.3	192.168.2.6
Aug 31, 2024 22:05:13.948503971 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.958641052 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.958703995 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.960963964 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.961023092 CEST	49734	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.961031914 CEST	443	49734	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.974697113 CEST	443	49735	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:13.974761009 CEST	49735	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.974953890 CEST	49735	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:13.974966049 CEST	443	49735	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:14.003194094 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:14.003277063 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:14.005462885 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:14.005474091 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:14.005753040 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:14.008313894 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:14.008384943 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:14.008390903 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:14.008510113 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:14.037151098 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:14.037178993 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:14.037720919 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:14.037864923 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:14.038053036 CEST	49738	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:14.038073063 CEST	443	49738	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:14.056507111 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:14.119844913 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:14.119873047 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:14.120083094 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:14.123333931 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:14.123347044 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:14.183568954 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:14.183741093 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:14.183801889 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:14.183933020 CEST	49732	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:14.183948994 CEST	443	49732	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:14.765703917 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:14.765780926 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:14.817950010 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:14.817965984 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:14.818392038 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:14.862986088 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:15.011758089 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.011796951 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.011857033 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.012237072 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.012278080 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.012331963 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.014262915 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.014275074 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.014506102 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.014518976 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.052392006 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:15.092505932 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:15.237262011 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:15.237369061 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:15.237477064 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:15.254563093 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:15.254563093 CEST	49741	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:15.254580975 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:15.254590988 CEST	443	49741	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:15.465965986 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.495193958 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.513226032 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.547605038 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.641038895 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.641051054 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.641375065 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.641400099 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.641469955 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.642060041 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.643450022 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.643583059 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.668354034 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.668477058 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.693550110 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.708904028 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.780853987 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:15.780878067 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:15.781011105 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:15.781043053 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:15.781084061 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:15.781094074 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:15.781265020 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:15.781277895 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:15.781392097 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:15.781409025 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:15.841048002 CEST	49746	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:15.841059923 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:15.841161966 CEST	49746	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:15.841563940 CEST	49746	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:15.841577053 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:16.254549980 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.254909039 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.254924059 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.255496025 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.255597115 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.256419897 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.256484985 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.257857084 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.257989883 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.258243084 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.258251905 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.258900881 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.259099007 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.259125948 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.259515047 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.259572029 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.260277987 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.260334969 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.260508060 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.260574102 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.260679007 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.260688066 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.311155081 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.311170101 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.321779013 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.321825027 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.321933985 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.322150946 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.322164059 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.365122080 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.365220070 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.365283966 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.365824938 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.365843058 CEST	443	49744	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.365861893 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.365935087 CEST	49744	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.372502089 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.372576952 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.372632027 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.373167038 CEST	49745	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.373183966 CEST	443	49745	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.479329109 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:16.479413033 CEST	49746	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:16.481502056 CEST	49746	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:16.481512070 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:16.481798887 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:16.483990908 CEST	49746	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:16.524503946 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:16.669975996 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.670008898 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.670084953 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.670340061 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.670356035 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.685200930 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.685235023 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.685555935 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.685833931 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.685858965 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.754544020 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:16.754597902 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:16.754749060 CEST	49746	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:16.755609989 CEST	49746	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:16.755609989 CEST	49746	443	192.168.2.6	184.28.90.27
Aug 31, 2024 22:05:16.755626917 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:16.755636930 CEST	443	49746	184.28.90.27	192.168.2.6
Aug 31, 2024 22:05:16.784943104 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.785239935 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.785259962 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.786283016 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.786349058 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.787733078 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.787798882 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.787920952 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.787931919 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.841490984 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.883239985 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.883317947 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.883348942 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.883378983 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.883373976 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.883399963 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.883424997 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.883486032 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:16.883544922 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.884689093 CEST	49747	443	192.168.2.6	142.250.80.4
Aug 31, 2024 22:05:16.884711981 CEST	443	49747	142.250.80.4	192.168.2.6
Aug 31, 2024 22:05:17.147073030 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.147378922 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.147398949 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.147810936 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.147886038 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.148566961 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.148622990 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.148947001 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.149018049 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.172996998 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.173322916 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.173336029 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.173716068 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.173777103 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.174434900 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.174488068 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.174711943 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.174773932 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.199331045 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.199341059 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.214943886 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.214953899 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:17.246176004 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.261807919 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:21.226710081 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:21.226735115 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:21.226813078 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:21.227916956 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:21.227931976 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:21.922451973 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:21.922522068 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:21.924058914 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:21.924068928 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:21.924314022 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:21.965902090 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:21.986747026 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:22.032507896 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211024046 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211052895 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211060047 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211070061 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211093903 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211121082 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:22.211136103 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211150885 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:22.211180925 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:22.211251020 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211302042 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:22.211308956 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211401939 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.211474895 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:22.223843098 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:22.223858118 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:22.223917007 CEST	49750	443	192.168.2.6	13.85.23.86
Aug 31, 2024 22:05:22.223926067 CEST	443	49750	13.85.23.86	192.168.2.6
Aug 31, 2024 22:05:25.377842903 CEST	49705	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:25.377939939 CEST	49705	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:25.378449917 CEST	49754	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:25.378510952 CEST	443	49754	173.222.162.64	192.168.2.6
Aug 31, 2024 22:05:25.378750086 CEST	49754	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:25.379151106 CEST	49754	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:25.379164934 CEST	443	49754	173.222.162.64	192.168.2.6
Aug 31, 2024 22:05:25.382931948 CEST	443	49705	173.222.162.64	192.168.2.6
Aug 31, 2024 22:05:25.383284092 CEST	443	49705	173.222.162.64	192.168.2.6
Aug 31, 2024 22:05:25.680835009 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:25.680880070 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:25.681046963 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:25.681750059 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:25.681766033 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:25.991861105 CEST	443	49754	173.222.162.64	192.168.2.6
Aug 31, 2024 22:05:25.991940022 CEST	49754	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:26.461930990 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:26.461990118 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:26.467914104 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:26.467926025 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:26.468127012 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:26.470216036 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:26.470294952 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:26.470299006 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:26.470701933 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:26.512501955 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:26.640506983 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:26.640594959 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:26.640644073 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:26.640774012 CEST	49755	443	192.168.2.6	40.113.110.67
Aug 31, 2024 22:05:26.640786886 CEST	443	49755	40.113.110.67	192.168.2.6
Aug 31, 2024 22:05:30.376842976 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:30.376952887 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:30.377002954 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:30.399975061 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:30.400053978 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:30.400099039 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:45.153799057 CEST	443	49754	173.222.162.64	192.168.2.6
Aug 31, 2024 22:05:45.153911114 CEST	49754	443	192.168.2.6	173.222.162.64
Aug 31, 2024 22:05:45.247262955 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:45.247318983 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:45.247394085 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:45.248086929 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:45.248106003 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:46.029726982 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:46.029849052 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:46.031611919 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:46.031625986 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:46.031858921 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:46.033356905 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:46.033421993 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:46.033430099 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:46.033552885 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:46.080518007 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:46.206162930 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:46.206671953 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:46.206779003 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:46.235788107 CEST	49756	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:05:46.235830069 CEST	443	49756	40.113.103.199	192.168.2.6
Aug 31, 2024 22:05:58.624489069 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:58.624509096 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:58.624581099 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:58.624964952 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:58.624977112 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.240148067 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.240246058 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.241801977 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.241811991 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.242109060 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.250103951 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.296508074 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.455480099 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.455504894 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.455517054 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.455730915 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.455748081 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.455868006 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.456423044 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.456459999 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.456523895 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.456528902 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.456568003 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.456619978 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.456686974 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.468390942 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.468406916 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:05:59.468429089 CEST	49757	443	192.168.2.6	20.12.23.50
Aug 31, 2024 22:05:59.468434095 CEST	443	49757	20.12.23.50	192.168.2.6
Aug 31, 2024 22:06:02.200648069 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:06:02.200690031 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:06:02.216303110 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:06:02.216317892 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:06:07.878926039 CEST	49758	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:07.878946066 CEST	443	49758	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:07.879038095 CEST	49758	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:07.879209995 CEST	49759	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:07.879241943 CEST	443	49759	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:07.879297018 CEST	49759	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:07.879481077 CEST	49758	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:07.879493952 CEST	443	49758	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:07.879627943 CEST	49759	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:07.879640102 CEST	443	49759	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.333837986 CEST	443	49759	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.334176064 CEST	49759	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.334202051 CEST	443	49759	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.334546089 CEST	443	49759	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.334861040 CEST	49759	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.334932089 CEST	443	49759	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.354368925 CEST	443	49758	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.354588985 CEST	49758	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.354608059 CEST	443	49758	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.354970932 CEST	443	49758	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.355271101 CEST	49758	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.355331898 CEST	443	49758	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.388192892 CEST	49759	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.403801918 CEST	49758	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:09.951430082 CEST	49761	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:09.951483011 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:09.951550961 CEST	49761	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:09.951739073 CEST	49762	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:09.951745987 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:09.951797962 CEST	49762	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:09.951937914 CEST	49761	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:09.951955080 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:09.952065945 CEST	49762	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:09.952076912 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.407776117 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.408358097 CEST	49762	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.408368111 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.408915997 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.409447908 CEST	49762	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.409538031 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.409832954 CEST	49762	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.413614035 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.413850069 CEST	49761	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.413858891 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.414199114 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.414632082 CEST	49761	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.414697886 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.414891958 CEST	49761	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.456502914 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.460503101 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.537339926 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.537412882 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.537482977 CEST	49761	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.537910938 CEST	49761	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.537933111 CEST	443	49761	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.545510054 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.545588017 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.545639992 CEST	49762	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.545754910 CEST	49762	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.545762062 CEST	443	49762	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:11.600677013 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:11.600724936 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:11.600792885 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:11.601587057 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:11.601603031 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:12.382356882 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:12.382527113 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:12.384300947 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:12.384315014 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:12.384574890 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:12.386477947 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:12.386543036 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:12.386550903 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:12.386682034 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:12.432502985 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:12.561758041 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:12.561880112 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:12.562000036 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:12.562315941 CEST	49764	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:12.562330961 CEST	443	49764	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:15.387008905 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:15.387047052 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:15.402616024 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:15.402643919 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:23.248234987 CEST	443	49759	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:23.248303890 CEST	443	49759	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:23.248450994 CEST	49759	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:23.260401011 CEST	443	49758	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:23.260471106 CEST	443	49758	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:23.260528088 CEST	49758	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:40.896461964 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:40.896529913 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:40.896610975 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:40.897193909 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:40.897209883 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:41.906127930 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:41.906238079 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:41.910749912 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:41.910763979 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:41.911017895 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:41.912898064 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:41.912962914 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:41.912966967 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:41.913089991 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:41.960493088 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:42.092324018 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:42.093044996 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:42.093127012 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:42.093415022 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:42.093436956 CEST	443	49766	40.113.103.199	192.168.2.6
Aug 31, 2024 22:06:42.093449116 CEST	49766	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:06:47.215631962 CEST	49748	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:06:47.215657949 CEST	443	49748	142.251.40.238	192.168.2.6
Aug 31, 2024 22:06:47.221609116 CEST	49749	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:06:47.221621990 CEST	443	49749	142.251.40.238	192.168.2.6
Aug 31, 2024 22:07:00.403129101 CEST	49743	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:07:00.403170109 CEST	443	49743	162.159.61.3	192.168.2.6
Aug 31, 2024 22:07:00.418731928 CEST	49742	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:07:00.418756962 CEST	443	49742	162.159.61.3	192.168.2.6
Aug 31, 2024 22:07:08.248682022 CEST	49759	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:07:08.248713017 CEST	443	49759	172.64.41.3	192.168.2.6
Aug 31, 2024 22:07:08.264456987 CEST	49758	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:07:08.264491081 CEST	443	49758	172.64.41.3	192.168.2.6
Aug 31, 2024 22:07:12.975863934 CEST	49767	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:07:12.975925922 CEST	443	49767	40.113.103.199	192.168.2.6
Aug 31, 2024 22:07:12.976005077 CEST	49767	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:07:12.976737022 CEST	49767	443	192.168.2.6	40.113.103.199
Aug 31, 2024 22:07:12.976756096 CEST	443	49767	40.113.103.199	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 22:05:09.012178898 CEST	53	63026	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:09.950236082 CEST	65291	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:09.950416088 CEST	64943	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:11.501440048 CEST	53	55247	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:11.505796909 CEST	53	51101	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.354222059 CEST	53998	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.354535103 CEST	52125	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.355182886 CEST	51190	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.355312109 CEST	53938	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.356575966 CEST	62561	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.356889009 CEST	58755	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.359323978 CEST	55639	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.359556913 CEST	50412	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.360976934 CEST	53	53998	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.361207962 CEST	53	52125	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.362260103 CEST	53	53938	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.362520933 CEST	53	51190	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.363781929 CEST	53	58755	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.364535093 CEST	53	62561	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.365973949 CEST	53	55639	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.366485119 CEST	53	50412	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.415457964 CEST	61334	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.415604115 CEST	54576	53	192.168.2.6	1.1.1.1
Aug 31, 2024 22:05:13.423568964 CEST	53	54576	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:13.424881935 CEST	53	61334	1.1.1.1	192.168.2.6
Aug 31, 2024 22:05:14.689512968 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.008953094 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.154555082 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.154576063 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.154583931 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.154589891 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.154598951 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.168102026 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.171776056 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.172904015 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.173046112 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.173362017 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.174053907 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.272469044 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.272505999 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.272965908 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.272970915 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.273448944 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.273974895 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.274699926 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.304410934 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.304594994 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.304749966 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.403489113 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.656547070 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.670121908 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.678262949 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.678385973 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:15.779015064 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.779575109 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.780016899 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:15.780281067 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:16.219172955 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:16.219754934 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:16.319974899 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:16.320694923 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:16.320832014 CEST	443	64142	162.159.61.3	192.168.2.6
Aug 31, 2024 22:05:16.321326017 CEST	64142	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:05:16.367456913 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.669636965 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.810828924 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.810843945 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.811376095 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.817363977 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.817375898 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.817387104 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.817399979 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.817617893 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.818308115 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.819297075 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.819439888 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.819868088 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.819907904 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.827079058 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.912897110 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.912909985 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.913261890 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.913537979 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.921061039 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.921272039 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.939161062 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.939409971 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.950622082 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.950788975 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:16.954499006 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:16.982995033 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:17.047805071 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:24.475377083 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:24.475446939 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:24.572182894 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:24.606148958 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:24.616374969 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:24.616985083 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:24.741954088 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:45.780656099 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:45.780704021 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:45.874562025 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:45.888664007 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:45.888737917 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:45.889060020 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:45.919312954 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:46.007837057 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:46.577392101 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:46.684519053 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:46.684540987 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:46.684925079 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:46.713855028 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:46.816178083 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:46.843816042 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:46.843853951 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:46.937757969 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:46.952497959 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:46.952598095 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:05:46.952770948 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:46.982139111 CEST	53169	443	192.168.2.6	142.251.40.238
Aug 31, 2024 22:05:47.070976019 CEST	443	53169	142.251.40.238	192.168.2.6
Aug 31, 2024 22:06:07.878647089 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.187335014 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.329096079 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.329111099 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.329123974 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.329142094 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.329158068 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.329833031 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.331854105 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.331981897 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.332289934 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.332415104 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.428092003 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.428109884 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.428118944 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.428127050 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.428533077 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.428601027 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.429393053 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.430413961 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.430489063 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.430665016 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.524092913 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.560249090 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:08.734355927 CEST	443	61841	172.64.41.3	192.168.2.6
Aug 31, 2024 22:06:08.763442993 CEST	61841	443	192.168.2.6	172.64.41.3
Aug 31, 2024 22:06:09.951179028 CEST	51873	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.343914986 CEST	51873	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.417851925 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.417866945 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.418004036 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.418016911 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.418283939 CEST	51873	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.420120955 CEST	51873	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.420232058 CEST	51873	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.438843012 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.515214920 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.515233040 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.515240908 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.515254021 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.515655041 CEST	51873	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.515723944 CEST	51873	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:10.609586000 CEST	443	51873	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:10.652796984 CEST	51873	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:16.923620939 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:16.923772097 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:16.924101114 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:16.924221992 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.382981062 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.393862009 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.431227922 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.488096952 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.488126993 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.488137960 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.488147974 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.488907099 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.489001989 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.490124941 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.490256071 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.583110094 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.583481073 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.584935904 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.585810900 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.585942984 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.586236000 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.586918116 CEST	53583	443	192.168.2.6	172.253.63.84
Aug 31, 2024 22:06:17.587042093 CEST	53583	443	192.168.2.6	172.253.63.84
Aug 31, 2024 22:06:17.678910017 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.679523945 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.679703951 CEST	443	56716	162.159.61.3	192.168.2.6
Aug 31, 2024 22:06:17.680241108 CEST	56716	443	192.168.2.6	162.159.61.3
Aug 31, 2024 22:06:17.682744026 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:17.683165073 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.050239086 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.051939964 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.052088022 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.052103996 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.052114964 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.052424908 CEST	53583	443	192.168.2.6	172.253.63.84
Aug 31, 2024 22:06:18.052587986 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.053179026 CEST	53583	443	192.168.2.6	172.253.63.84
Aug 31, 2024 22:06:18.053652048 CEST	53583	443	192.168.2.6	172.253.63.84
Aug 31, 2024 22:06:18.154217005 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.154479980 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.155081034 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.155678988 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.155689955 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.156297922 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.159956932 CEST	53583	443	192.168.2.6	172.253.63.84
Aug 31, 2024 22:06:18.160463095 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.160536051 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.160593033 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.160813093 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.160825014 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.160960913 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.160972118 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.185112000 CEST	53583	443	192.168.2.6	172.253.63.84
Aug 31, 2024 22:06:18.192653894 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.192939043 CEST	53583	443	192.168.2.6	172.253.63.84
Aug 31, 2024 22:06:18.193607092 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.193615913 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.194048882 CEST	53583	443	192.168.2.6	172.253.63.84
Aug 31, 2024 22:06:18.260143995 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.260454893 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.260639906 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.260823965 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.260910988 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.260920048 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.261064053 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.261106968 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.274748087 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.274759054 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.274766922 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.274775028 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:18.275177002 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.275249958 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.275315046 CEST	58457	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:18.316529989 CEST	443	53583	172.253.63.84	192.168.2.6
Aug 31, 2024 22:06:18.376306057 CEST	443	58457	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.073414087 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.073602915 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.529512882 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.529573917 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.538757086 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.538757086 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.539108992 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.539124012 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.539252043 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.539273024 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.547779083 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.632900000 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.633416891 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.633524895 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.633601904 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.633846998 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.647484064 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.647583008 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.647594929 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.647780895 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.647903919 CEST	443	59733	142.250.65.238	192.168.2.6
Aug 31, 2024 22:06:48.647953033 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.684603930 CEST	59733	443	192.168.2.6	142.250.65.238
Aug 31, 2024 22:06:48.742140055 CEST	443	59733	142.250.65.238	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 22:05:09.950236082 CEST	192.168.2.6	1.1.1.1	0x6f2c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:09.950416088 CEST	192.168.2.6	1.1.1.1	0x3a1a	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Aug 31, 2024 22:05:13.354222059 CEST	192.168.2.6	1.1.1.1	0x4d74	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.354535103 CEST	192.168.2.6	1.1.1.1	0x206b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 22:05:13.355182886 CEST	192.168.2.6	1.1.1.1	0xce67	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.355312109 CEST	192.168.2.6	1.1.1.1	0xcf91	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 22:05:13.356575966 CEST	192.168.2.6	1.1.1.1	0xc94f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.356889009 CEST	192.168.2.6	1.1.1.1	0xd1ec	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 22:05:13.359323978 CEST	192.168.2.6	1.1.1.1	0x143	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.359556913 CEST	192.168.2.6	1.1.1.1	0xc39f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Aug 31, 2024 22:05:13.415457964 CEST	192.168.2.6	1.1.1.1	0x4dd9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.415604115 CEST	192.168.2.6	1.1.1.1	0xc474	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
2024-08-31 20:06:10 UTC	192.168.2.6	162.159.61.3	0x0	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	true
2024-08-31 20:06:10 UTC	192.168.2.6	162.159.61.3	0x0	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	true

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 22:05:09.959372997 CEST	1.1.1.1	192.168.2.6	0x6f2c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 22:05:09.960189104 CEST	1.1.1.1	192.168.2.6	0x3a1a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 22:05:12.292205095 CEST	1.1.1.1	192.168.2.6	0xf7c4	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 22:05:12.292205095 CEST	1.1.1.1	192.168.2.6	0xf7c4	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.360976934 CEST	1.1.1.1	192.168.2.6	0x4d74	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.360976934 CEST	1.1.1.1	192.168.2.6	0x4d74	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.361207962 CEST	1.1.1.1	192.168.2.6	0x206b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 22:05:13.362260103 CEST	1.1.1.1	192.168.2.6	0xcf91	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 22:05:13.362520933 CEST	1.1.1.1	192.168.2.6	0xce67	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.362520933 CEST	1.1.1.1	192.168.2.6	0xce67	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.363781929 CEST	1.1.1.1	192.168.2.6	0xd1ec	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 22:05:13.364535093 CEST	1.1.1.1	192.168.2.6	0xc94f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.364535093 CEST	1.1.1.1	192.168.2.6	0xc94f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.365973949 CEST	1.1.1.1	192.168.2.6	0x143	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.365973949 CEST	1.1.1.1	192.168.2.6	0x143	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.366485119 CEST	1.1.1.1	192.168.2.6	0xc39f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 22:05:13.423568964 CEST	1.1.1.1	192.168.2.6	0xc474	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Aug 31, 2024 22:05:13.424881935 CEST	1.1.1.1	192.168.2.6	0x4dd9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 22:05:13.424881935 CEST	1.1.1.1	192.168.2.6	0x4dd9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
2024-08-31 20:06:10 UTC	162.159.61.3	192.168.2.6	0x0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	true
2024-08-31 20:06:10 UTC	162.159.61.3	192.168.2.6	0x0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	true

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49710	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:05 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 6d 49 47 63 76 55 31 4c 30 75 50 58 45 32 39 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 34 35 66 62 39 31 63 33 30 61 31 30 36 37 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8mIGcvU1L0uPXE29.1Context: f45fb91c30a1067f
2024-08-31 20:05:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-31 20:05:05 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 6d 49 47 63 76 55 31 4c 30 75 50 58 45 32 39 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 34 35 66 62 39 31 63 33 30 61 31 30 36 37 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 62 71 6f 36 57 46 76 50 42 67 63 54 47 35 49 61 54 32 50 72 30 64 64 57 79 43 56 4e 32 2f 79 53 35 48 54 74 62 70 66 37 34 4e 62 42 69 32 31 56 33 34 71 44 79 64 45 63 31 36 51 39 56 62 4a 5a 64 6d 51 79 43 39 2b 58 35 30 57 4b 7a 43 52 41 42 73 6f 43 44 35 4b 67 65 6d 6c 41 64 6b 45 37 36 32 5a 33 38 6b 50 59 59 36 73 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8mIGcvU1L0uPXE29.2Context: f45fb91c30a1067f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdbqo6WFvPBgcTG5IaT2Pr0ddWyCVN2/yS5HTtbpf74NbBi21V34qDydEc16Q9VbJZdmQyC9+X50WKzCRABsoCD5KgemlAdkE762Z38kPYY6s+
2024-08-31 20:05:05 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 6d 49 47 63 76 55 31 4c 30 75 50 58 45 32 39 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 34 35 66 62 39 31 63 33 30 61 31 30 36 37 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8mIGcvU1L0uPXE29.3Context: f45fb91c30a1067f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-31 20:05:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-31 20:05:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 6f 48 73 61 30 54 68 6a 45 71 33 66 30 2b 62 2f 63 41 55 6a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /oHsa0ThjEq3f0+b/cAUjQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49729	13.107.246.42	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:13 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 20:05:13 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:13 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T200513Z-16579567576pg4fvvmc18u0v4g00000005a000000000ru92 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-31 20:05:13 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49728	13.107.246.42	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:13 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 20:05:13 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 20:05:13 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T200512Z-16579567576phhfj0h0z9mnmag000000058g000000006r5m Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-31 20:05:13 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-31 20:05:13 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-31 20:05:13 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-31 20:05:13 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-31 20:05:13 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49736	172.64.41.3	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 20:05:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 20:05:13 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 20:05:13 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbfa259d9de440c-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 20:05:13 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c1 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49733	172.64.41.3	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 20:05:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 20:05:13 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 20:05:13 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbfa259dcfbc32d-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 20:05:13 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fa 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49734	162.159.61.3	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 20:05:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 20:05:13 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 20:05:13 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbfa259faef7286-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 20:05:13 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d6 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49735	162.159.61.3	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 20:05:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 20:05:13 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 20:05:13 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbfa25a09ed1895-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 20:05:13 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ab 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49738	162.159.61.3	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:13 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 20:05:13 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 20:05:14 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 20:05:13 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbfa25a7cfc41fb-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 20:05:14 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49732	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 5a 4b 39 35 70 33 32 4a 54 6b 4f 39 46 61 77 55 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 35 33 31 33 62 32 33 30 63 65 35 30 33 62 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ZK95p32JTkO9FawU.1Context: 55313b230ce503b3
2024-08-31 20:05:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-31 20:05:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 5a 4b 39 35 70 33 32 4a 54 6b 4f 39 46 61 77 55 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 35 33 31 33 62 32 33 30 63 65 35 30 33 62 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 62 71 6f 36 57 46 76 50 42 67 63 54 47 35 49 61 54 32 50 72 30 64 64 57 79 43 56 4e 32 2f 79 53 35 48 54 74 62 70 66 37 34 4e 62 42 69 32 31 56 33 34 71 44 79 64 45 63 31 36 51 39 56 62 4a 5a 64 6d 51 79 43 39 2b 58 35 30 57 4b 7a 43 52 41 42 73 6f 43 44 35 4b 67 65 6d 6c 41 64 6b 45 37 36 32 5a 33 38 6b 50 59 59 36 73 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ZK95p32JTkO9FawU.2Context: 55313b230ce503b3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdbqo6WFvPBgcTG5IaT2Pr0ddWyCVN2/yS5HTtbpf74NbBi21V34qDydEc16Q9VbJZdmQyC9+X50WKzCRABsoCD5KgemlAdkE762Z38kPYY6s+
2024-08-31 20:05:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 5a 4b 39 35 70 33 32 4a 54 6b 4f 39 46 61 77 55 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 35 33 31 33 62 32 33 30 63 65 35 30 33 62 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ZK95p32JTkO9FawU.3Context: 55313b230ce503b3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-31 20:05:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-31 20:05:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 51 37 59 41 46 51 65 37 45 61 57 47 41 78 38 6d 43 5a 6b 73 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: LQ7YAFQe7EaWGAx8mCZksA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49741	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:15 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 20:05:15 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=247225 Date: Sat, 31 Aug 2024 20:05:15 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49744	142.251.40.238	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:16 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 20:05:16 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 20:05:16 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49745	142.251.40.238	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:16 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 20:05:16 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 20:05:16 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49746	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 20:05:16 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=247224 Date: Sat, 31 Aug 2024 20:05:16 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-31 20:05:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49747	142.250.80.4	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:16 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.55" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.55", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 20:05:16 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 31 Aug 2024 18:49:34 GMT Expires: Sun, 08 Sep 2024 18:49:34 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 4542 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 20:05:16 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-31 20:05:16 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-31 20:05:16 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-31 20:05:16 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-31 20:05:16 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49750	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hFOnaDtDOSe559r&MD=bZDha1yM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 20:05:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f7185fe7-0a57-40db-bcc9-0f03c69a8e65 MS-RequestId: 499d4f68-d268-4f6e-81b7-bb2f98ee008b MS-CV: R5Z5yRVYzEGCT+Qk.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 20:05:21 GMT Connection: close Content-Length: 24490
2024-08-31 20:05:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-31 20:05:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49755	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 33 78 45 41 79 31 64 45 6f 30 71 2f 35 64 49 44 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 33 37 30 63 34 64 37 64 64 35 62 62 62 63 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 3xEAy1dEo0q/5dID.1Context: b370c4d7dd5bbbcf
2024-08-31 20:05:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-31 20:05:26 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 33 78 45 41 79 31 64 45 6f 30 71 2f 35 64 49 44 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 33 37 30 63 34 64 37 64 64 35 62 62 62 63 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 62 71 6f 36 57 46 76 50 42 67 63 54 47 35 49 61 54 32 50 72 30 64 64 57 79 43 56 4e 32 2f 79 53 35 48 54 74 62 70 66 37 34 4e 62 42 69 32 31 56 33 34 71 44 79 64 45 63 31 36 51 39 56 62 4a 5a 64 6d 51 79 43 39 2b 58 35 30 57 4b 7a 43 52 41 42 73 6f 43 44 35 4b 67 65 6d 6c 41 64 6b 45 37 36 32 5a 33 38 6b 50 59 59 36 73 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 3xEAy1dEo0q/5dID.2Context: b370c4d7dd5bbbcf<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdbqo6WFvPBgcTG5IaT2Pr0ddWyCVN2/yS5HTtbpf74NbBi21V34qDydEc16Q9VbJZdmQyC9+X50WKzCRABsoCD5KgemlAdkE762Z38kPYY6s+
2024-08-31 20:05:26 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 33 78 45 41 79 31 64 45 6f 30 71 2f 35 64 49 44 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 33 37 30 63 34 64 37 64 64 35 62 62 62 63 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 3xEAy1dEo0q/5dID.3Context: b370c4d7dd5bbbcf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-31 20:05:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-31 20:05:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 76 4f 2f 69 32 44 44 4b 70 6b 43 64 47 2b 67 46 74 44 46 42 6f 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: vO/i2DDKpkCdG+gFtDFBog.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49756	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:46 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 5a 51 56 34 57 44 6d 71 30 79 63 6b 49 6c 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 35 66 61 66 61 66 64 34 30 61 31 64 38 62 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8ZQV4WDmq0yckIlm.1Context: f5fafafd40a1d8bc
2024-08-31 20:05:46 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-31 20:05:46 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 5a 51 56 34 57 44 6d 71 30 79 63 6b 49 6c 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 35 66 61 66 61 66 64 34 30 61 31 64 38 62 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 62 71 6f 36 57 46 76 50 42 67 63 54 47 35 49 61 54 32 50 72 30 64 64 57 79 43 56 4e 32 2f 79 53 35 48 54 74 62 70 66 37 34 4e 62 42 69 32 31 56 33 34 71 44 79 64 45 63 31 36 51 39 56 62 4a 5a 64 6d 51 79 43 39 2b 58 35 30 57 4b 7a 43 52 41 42 73 6f 43 44 35 4b 67 65 6d 6c 41 64 6b 45 37 36 32 5a 33 38 6b 50 59 59 36 73 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8ZQV4WDmq0yckIlm.2Context: f5fafafd40a1d8bc<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdbqo6WFvPBgcTG5IaT2Pr0ddWyCVN2/yS5HTtbpf74NbBi21V34qDydEc16Q9VbJZdmQyC9+X50WKzCRABsoCD5KgemlAdkE762Z38kPYY6s+
2024-08-31 20:05:46 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 5a 51 56 34 57 44 6d 71 30 79 63 6b 49 6c 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 35 66 61 66 61 66 64 34 30 61 31 64 38 62 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8ZQV4WDmq0yckIlm.3Context: f5fafafd40a1d8bc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-31 20:05:46 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-31 20:05:46 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 58 71 52 39 5a 73 52 66 6b 79 78 6f 72 70 47 76 4d 56 50 72 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: hXqR9ZsRfkyxorpGvMVPrQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49757	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:05:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hFOnaDtDOSe559r&MD=bZDha1yM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 20:05:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 43c1c3d4-c8e8-44d2-8413-cd6969e167c8 MS-RequestId: 2f3bbae1-08c6-465c-8a57-f8c54cbe6929 MS-CV: cVuIUY5NL0GHsQsu.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 20:05:58 GMT Connection: close Content-Length: 30005
2024-08-31 20:05:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-31 20:05:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49762	162.159.61.3	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:06:10 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 20:06:10 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 50 00 0c 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: bzibnelreportsnet)PL
2024-08-31 20:06:10 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 20:06:10 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbfa3bbab2c7295-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 20:06:10 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d 74 00 20 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 09 61 6b 61 6d 61 69 7a 65 64 c0 1c c0 31 00 05 00 01 00 00 53 c4 00 13 04 61 34 31 36 04 64 73 63 64 06 61 6b 61 6d 61 69 c0 1c c0 5d 00 01 00 01 00 00 00 0b 00 04 17 2c 85 26 c0 5d 00 01 00 01 00 00 00 0b 00 04 17 2c 85 39 00 00 29 04 d0 00 00 00 00 01 39 00 0c 01 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: bzibnelreportsnett bzibnelreportsnetakamaized1Sa416dscdakamai],&],9)95

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49761	162.159.61.3	443	2528	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:06:10 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 20:06:10 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 50 00 0c 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: bzibnelreportsnetA)PL
2024-08-31 20:06:10 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 20:06:10 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bbfa3bb9a5541e0-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 20:06:10 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0c 0b 00 20 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 09 61 6b 61 6d 61 69 7a 65 64 c0 1c c0 31 00 05 00 01 00 00 52 5b 00 13 04 61 34 31 36 04 64 73 63 64 06 61 6b 61 6d 61 69 c0 1c c0 62 00 06 00 01 00 00 01 e3 00 34 06 6e 30 64 73 63 64 c0 67 0a 68 6f 73 74 6d 61 73 74 65 72 06 61 6b 61 6d 61 69 03 63 6f 6d 00 66 d3 75 a1 00 00 03 e8 00 00 03 e8 00 00 03 e8 00 00 07 08 00 00 29 04 d0 00 00 00 00 01 19 00 0c 01 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: bzibnelreportsnetA bzibnelreportsnetakamaized1R[a416dscdakamaib4n0dscdghostmasterakamaicomfu)

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49764	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:06:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 71 78 42 34 77 4a 66 2f 66 55 65 6e 35 68 55 67 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 32 32 30 35 36 33 62 39 31 65 34 38 39 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: qxB4wJf/fUen5hUg.1Context: 87220563b91e4891
2024-08-31 20:06:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-31 20:06:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 71 78 42 34 77 4a 66 2f 66 55 65 6e 35 68 55 67 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 32 32 30 35 36 33 62 39 31 65 34 38 39 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 62 71 6f 36 57 46 76 50 42 67 63 54 47 35 49 61 54 32 50 72 30 64 64 57 79 43 56 4e 32 2f 79 53 35 48 54 74 62 70 66 37 34 4e 62 42 69 32 31 56 33 34 71 44 79 64 45 63 31 36 51 39 56 62 4a 5a 64 6d 51 79 43 39 2b 58 35 30 57 4b 7a 43 52 41 42 73 6f 43 44 35 4b 67 65 6d 6c 41 64 6b 45 37 36 32 5a 33 38 6b 50 59 59 36 73 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: qxB4wJf/fUen5hUg.2Context: 87220563b91e4891<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdbqo6WFvPBgcTG5IaT2Pr0ddWyCVN2/yS5HTtbpf74NbBi21V34qDydEc16Q9VbJZdmQyC9+X50WKzCRABsoCD5KgemlAdkE762Z38kPYY6s+
2024-08-31 20:06:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 71 78 42 34 77 4a 66 2f 66 55 65 6e 35 68 55 67 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 37 32 32 30 35 36 33 62 39 31 65 34 38 39 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: qxB4wJf/fUen5hUg.3Context: 87220563b91e4891<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-31 20:06:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-31 20:06:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 49 76 41 48 59 6c 66 4d 30 47 58 67 4d 47 52 54 68 4a 7a 49 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0IvAHYlfM0GXgMGRThJzIA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49766	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:06:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 35 47 6a 72 75 36 70 2f 45 32 77 69 6c 31 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 32 32 39 32 34 34 39 35 32 30 61 30 32 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 05Gjru6p/E2wil1a.1Context: 7c2292449520a027
2024-08-31 20:06:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-31 20:06:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 35 47 6a 72 75 36 70 2f 45 32 77 69 6c 31 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 32 32 39 32 34 34 39 35 32 30 61 30 32 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 62 71 6f 36 57 46 76 50 42 67 63 54 47 35 49 61 54 32 50 72 30 64 64 57 79 43 56 4e 32 2f 79 53 35 48 54 74 62 70 66 37 34 4e 62 42 69 32 31 56 33 34 71 44 79 64 45 63 31 36 51 39 56 62 4a 5a 64 6d 51 79 43 39 2b 58 35 30 57 4b 7a 43 52 41 42 73 6f 43 44 35 4b 67 65 6d 6c 41 64 6b 45 37 36 32 5a 33 38 6b 50 59 59 36 73 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 05Gjru6p/E2wil1a.2Context: 7c2292449520a027<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdbqo6WFvPBgcTG5IaT2Pr0ddWyCVN2/yS5HTtbpf74NbBi21V34qDydEc16Q9VbJZdmQyC9+X50WKzCRABsoCD5KgemlAdkE762Z38kPYY6s+
2024-08-31 20:06:41 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 30 35 47 6a 72 75 36 70 2f 45 32 77 69 6c 31 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 63 32 32 39 32 34 34 39 35 32 30 61 30 32 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 05Gjru6p/E2wil1a.3Context: 7c2292449520a027<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-31 20:06:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-31 20:06:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6c 57 61 6c 51 32 35 37 57 45 32 59 79 55 39 66 4e 42 51 70 51 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: lWalQ257WE2YyU9fNBQpQA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49767	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 20:07:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 57 52 61 36 6c 67 6c 58 34 6b 2b 42 38 64 55 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 61 33 33 65 39 30 65 38 34 38 32 64 34 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: WRa6lglX4k+B8dUk.1Context: 70a33e90e8482d44
2024-08-31 20:07:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-08-31 20:07:13 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 57 52 61 36 6c 67 6c 58 34 6b 2b 42 38 64 55 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 61 33 33 65 39 30 65 38 34 38 32 64 34 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 62 71 6f 36 57 46 76 50 42 67 63 54 47 35 49 61 54 32 50 72 30 64 64 57 79 43 56 4e 32 2f 79 53 35 48 54 74 62 70 66 37 34 4e 62 42 69 32 31 56 33 34 71 44 79 64 45 63 31 36 51 39 56 62 4a 5a 64 6d 51 79 43 39 2b 58 35 30 57 4b 7a 43 52 41 42 73 6f 43 44 35 4b 67 65 6d 6c 41 64 6b 45 37 36 32 5a 33 38 6b 50 59 59 36 73 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: WRa6lglX4k+B8dUk.2Context: 70a33e90e8482d44<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAdbqo6WFvPBgcTG5IaT2Pr0ddWyCVN2/yS5HTtbpf74NbBi21V34qDydEc16Q9VbJZdmQyC9+X50WKzCRABsoCD5KgemlAdkE762Z38kPYY6s+
2024-08-31 20:07:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 57 52 61 36 6c 67 6c 58 34 6b 2b 42 38 64 55 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 61 33 33 65 39 30 65 38 34 38 32 64 34 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: WRa6lglX4k+B8dUk.3Context: 70a33e90e8482d44<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-08-31 20:07:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-08-31 20:07:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 63 6b 55 34 45 7a 61 33 6b 53 31 4d 54 34 48 48 74 36 62 50 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: CckU4Eza3kS1MT4HHt6bPg.0Payload parsing failed.

Target ID:	0
Start time:	16:05:04
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x510000
File size:	917'504 bytes
MD5 hash:	4EA77C57CB0E4DE372EDD5E2D1AE4A82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	16:05:04
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:05:05
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1752,i,15235259341285427299,2014034070172722539,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:05:05
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:05:05
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:05:10
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7252 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:05:10
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4864 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:05:11
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7476 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:05:11
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7476 --field-trial-handle=2092,i,12710772375645608400,8140970409719923703,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:05:22
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:05:23
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2120,i,13241068222075852022,1718950494124032018,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:05:23
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=2108 --field-trial-handle=2120,i,13241068222075852022,1718950494124032018,262144 /prefetch:8
Imagebase:	0x7ff7934f0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:05:30
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:05:30
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=2032,i,11473371370327430198,7085008301225761356,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	1370
Total number of Limit Nodes:	38

Executed Functions

Function 0052F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0052F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0056F474
IsIconic.USER32(00000000), ref: 0056F47D
ShowWindow.USER32(00000000,00000009), ref: 0056F48A
SetForegroundWindow.USER32(00000000), ref: 0056F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0056F4AA
GetCurrentThreadId.KERNEL32 ref: 0056F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0056F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0056F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0056F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0056F4DE
SetForegroundWindow.USER32(00000000), ref: 0056F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0056F4F6
keybd_event.USER32(00000012,00000000), ref: 0056F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0056F50B
keybd_event.USER32(00000012,00000000), ref: 0056F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0056F519
keybd_event.USER32(00000012,00000000), ref: 0056F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0056F528
keybd_event.USER32(00000012,00000000), ref: 0056F52D
SetForegroundWindow.USER32(00000000), ref: 0056F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0056F557

Strings

Shell_TrayWnd, xrefs: 0056F46F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 99dcc326617ac6edcfe96143e748ccaf05a2417d214f9cd84eeb4c75766db03b
Instruction ID: 278717d20a80338e72325e7e96d7edf358076d615b21dfaf1c2bde6e3d2b49e1
Opcode Fuzzy Hash: 99dcc326617ac6edcfe96143e748ccaf05a2417d214f9cd84eeb4c75766db03b
Instruction Fuzzy Hash: 30311D71E40218BBEB216BB55C4AFBF7E6CEB59B50F100466FA01E71D1CAB15D00ABA0

Function 005142DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0051430D

Part of subcall function 00516B57: _wcslen.LIBCMT ref: 00516B6A

GetCurrentProcess.KERNEL32(?,005ACB64,00000000,?,?), ref: 00514422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00514429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00514454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00514466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00514474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0051447B
GetSystemInfo.KERNEL32(?,?,?), ref: 005144A0

Strings

GetNativeSystemInfo, xrefs: 00514460
|O, xrefs: 005536F8
kernel32.dll, xrefs: 0051444F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 9c8305d5dcf685a4b0f12ecb36f2286912806a6685b9f5acf30200da6524060d
Instruction ID: ac8a0bbb934b3f79df29d2195ded40d43c13280d5240523b76426081269d0183
Opcode Fuzzy Hash: 9c8305d5dcf685a4b0f12ecb36f2286912806a6685b9f5acf30200da6524060d
Instruction Fuzzy Hash: 7FA1E47190AAC0CFDB19C7697CC01D97FA57B3E780B285C99D4C59BA22D2704A4CEB39

Function 005142A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,005150AA,?,?,00000000,00000000), ref: 005142B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,005150AA,?,?,00000000,00000000), ref: 005142C9
LoadResource.KERNEL32(?,00000000,?,?,005150AA,?,?,00000000,00000000,?,?,?,?,?,?,00514F20), ref: 005535BE
SizeofResource.KERNEL32(?,00000000,?,?,005150AA,?,?,00000000,00000000,?,?,?,?,?,?,00514F20), ref: 005535D3
LockResource.KERNEL32(005150AA,?,?,005150AA,?,?,00000000,00000000,?,?,?,?,?,?,00514F20,?), ref: 005535E6

Strings

SCRIPT, xrefs: 005142BF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 48154616b0d3bdbeceac9f668d8d361e85e1801ac70b02415dabd46cd6e3cbc2
Instruction ID: e5e0dc8853f89fc7c25ddc1ad19a9260f9aa9c733a047f7e9c79c4dffda4c798
Opcode Fuzzy Hash: 48154616b0d3bdbeceac9f668d8d361e85e1801ac70b02415dabd46cd6e3cbc2
Instruction Fuzzy Hash: B6117C78200701BFE7218B65DC48F677FBAFFD6B51F108169B41296250DB71D8449A20

Function 00552BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00512B6B

Part of subcall function 00513A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,005E1418,?,00512E7F,?,?,?,00000000), ref: 00513A78

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,005D2224), ref: 00552C10
ShellExecuteW.SHELL32(00000000,?,?,005D2224), ref: 00552C17

Strings

runas, xrefs: 00552C0B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: a7a6bbf97c9f883128da4ef1db6b68087e7d0e9cff7c086aea0376407939952a
Instruction ID: f702cb7e64c365209b1356b3a388479cdc678667a0ed7ac8af206a66260bd42c
Opcode Fuzzy Hash: a7a6bbf97c9f883128da4ef1db6b68087e7d0e9cff7c086aea0376407939952a
Instruction Fuzzy Hash: C411E7311083426AEB14FF20D8699FD7FA4BFE1351F04082EF182421A2CF318AC9D712

Function 0057DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00555222), ref: 0057DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0057DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0057DBEE
FindClose.KERNEL32(00000000), ref: 0057DBFA

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: d667dd7003aae2d823655a1aedfb75caaccad058711674bbbda24ed44d2af4e7
Instruction ID: f0e16c42470e8858e4035df2d2e7cfdca5165d8050b9322c8c5084dd2548bc3d
Opcode Fuzzy Hash: d667dd7003aae2d823655a1aedfb75caaccad058711674bbbda24ed44d2af4e7
Instruction Fuzzy Hash: 36F0A0308109105783216B78AC0D8AA3FBCAF42334B108702F87AC20E0EBB05D58EAA5

Function 0059AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0059B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0059B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0059B1D4
_wcslen.LIBCMT ref: 0059B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0059B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0059B236
_wcslen.LIBCMT ref: 0059B332

Part of subcall function 005805A7: GetStdHandle.KERNEL32(000000F6), ref: 005805C6

_wcslen.LIBCMT ref: 0059B34B
_wcslen.LIBCMT ref: 0059B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0059B3B6
GetLastError.KERNEL32(00000000), ref: 0059B407
CloseHandle.KERNEL32(?), ref: 0059B439
CloseHandle.KERNEL32(00000000), ref: 0059B44A
CloseHandle.KERNEL32(00000000), ref: 0059B45C
CloseHandle.KERNEL32(00000000), ref: 0059B46E
CloseHandle.KERNEL32(?), ref: 0059B4E3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 0b706b2a19a7e54609a7850193680910caea8f92db3ea7e1b13ba4e475b714b5
Instruction ID: 22fa9e0d10ca38dedbe654ad8102f7799fe74ffb57dea26696b9a8f2fa066a33
Opcode Fuzzy Hash: 0b706b2a19a7e54609a7850193680910caea8f92db3ea7e1b13ba4e475b714b5
Instruction Fuzzy Hash: 20F189316043019FEB14EF24D999B6ABFE5BF85310F14895DF8899B2A2DB31EC44CB52

Function 0051D730 Relevance: 21.6, APIs: 14, Instructions: 627windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0051D807
timeGetTime.WINMM ref: 0051DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0051DB28
TranslateMessage.USER32(?), ref: 0051DB7B
DispatchMessageW.USER32(?), ref: 0051DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0051DB9F
Sleep.KERNELBASE(0000000A), ref: 0051DBB1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 9f28fe30e513bec3571f3d1ad1c23480c0071295b05c2927421c6377ac437359
Instruction ID: fd57dc7d5e94747b1b16466e0e835fa13b7976316c91f25d005dd059956decd9
Opcode Fuzzy Hash: 9f28fe30e513bec3571f3d1ad1c23480c0071295b05c2927421c6377ac437359
Instruction Fuzzy Hash: EE42C5706087429FE728CF24C888BAABFF4BF95304F14495DE4958B291D774E884DFA2

Function 0051344D Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00513A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,005E1418,?,00512E7F,?,?,?,00000000), ref: 00513A78

Part of subcall function 00513357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00513379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0051356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0055318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 005531CE
RegCloseKey.ADVAPI32(?), ref: 00553210
_wcslen.LIBCMT ref: 00553277
_wcslen.LIBCMT ref: 00553286

Strings

\, xrefs: 0055328C
J, xrefs: 0051349D
\Include\, xrefs: 00513527
Include, xrefs: 00553184, 005531C5
Software\AutoIt v3\AutoIt, xrefs: 00513560

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\$J
API String ID: 98802146-1748902923
Opcode ID: 59ba445b5f2aeb59a8a8ecd0324b3528bd4cf2b228c2e376edbf35032a3dc23b
Instruction ID: 92f4a2eb1b32ecace75e30f4bbb629a098089ed271d80905e5beff44e7be68d5
Opcode Fuzzy Hash: 59ba445b5f2aeb59a8a8ecd0324b3528bd4cf2b228c2e376edbf35032a3dc23b
Instruction Fuzzy Hash: 23716D714043419ED318DF65DC969ABBFE8BF99740F40082EF585871A4EB709A88DF61

Function 00512CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00512D07
RegisterClassExW.USER32(00000030), ref: 00512D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00512D42
InitCommonControlsEx.COMCTL32(?), ref: 00512D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00512D6F
LoadIconW.USER32(000000A9), ref: 00512D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00512D94

Strings

+, xrefs: 00512CF0
TaskbarCreated, xrefs: 00512D37
0, xrefs: 00512CE9
AutoIt v3 GUI, xrefs: 00512D23

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 05a03a51e42841c1cd0665a3e8ae9cb0c71c7fa4468e5983488920ca7cf30ad6
Instruction ID: f143d0c6b0c80f3b561a8e98a00846a8f3dcc9a9066f4841c4aa78f998568ed5
Opcode Fuzzy Hash: 05a03a51e42841c1cd0665a3e8ae9cb0c71c7fa4468e5983488920ca7cf30ad6
Instruction Fuzzy Hash: F021E3B5901258AFDB00DFA4E889BDDBFB4FB19700F00811AF551EA2A0D7B50548EFA4

Function 0051B710 Relevance: 18.1, APIs: 1, Strings: 9, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0051BB4E

Strings

p#^, xrefs: 00560263
p%^, xrefs: 0051B8DC
p#^, xrefs: 0051BA72
8q, xrefs: 0056030A
p#^, xrefs: 0056024F
x#^, xrefs: 00560168
p#^, xrefs: 0051BB6B
x#^, xrefs: 00560207
p%^, xrefs: 0051BB32

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 8q$p#^$p#^$p#^$p#^$p%^$p%^$x#^$x#^
API String ID: 1385522511-2824963780
Opcode ID: 0d79e2d2f5f29b04040343e2daef808b574376865201223269054e068c301ac5
Instruction ID: ab7c176d0d6d1d13ccf653b3427978b31cdfbadf63a6a3eff6b17e545728e503
Opcode Fuzzy Hash: 0d79e2d2f5f29b04040343e2daef808b574376865201223269054e068c301ac5
Instruction Fuzzy Hash: 6732BE35A00209EFEB14CF54C898ABEBFB9FF49314F148459E945AB391C774AD82CB91

Function 0055065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0055039A: CreateFileW.KERNELBASE(00000000,00000000,?,00550704,?,?,00000000,?,00550704,00000000,0000000C), ref: 005503B7

GetLastError.KERNEL32 ref: 0055076F
__dosmaperr.LIBCMT ref: 00550776
GetFileType.KERNELBASE(00000000), ref: 00550782
GetLastError.KERNEL32 ref: 0055078C
__dosmaperr.LIBCMT ref: 00550795
CloseHandle.KERNEL32(00000000), ref: 005507B5
CloseHandle.KERNEL32(?), ref: 005508FF
GetLastError.KERNEL32 ref: 00550931
__dosmaperr.LIBCMT ref: 00550938

Strings

H, xrefs: 005508BD

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d391549f42ad372cd4da605374c614e6c34598012bd20f1ceba67b5255ef5fab
Instruction ID: 86c9dab704b1307408f9815d7b70e31a8ce6c6967f8c5cd898817c4fe478aa28
Opcode Fuzzy Hash: d391549f42ad372cd4da605374c614e6c34598012bd20f1ceba67b5255ef5fab
Instruction Fuzzy Hash: 7DA14636A101058FDF19AF68DCA5BAE3FA0FB46321F14115AFC119F2D1DB31981ADB91

Function 00512B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00512B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00512B9D
LoadIconW.USER32(00000063), ref: 00512BB3
LoadIconW.USER32(000000A4), ref: 00512BC5
LoadIconW.USER32(000000A2), ref: 00512BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00512BEF
RegisterClassExW.USER32(?), ref: 00512C40

Part of subcall function 00512CD4: GetSysColorBrush.USER32(0000000F), ref: 00512D07
Part of subcall function 00512CD4: RegisterClassExW.USER32(00000030), ref: 00512D31
Part of subcall function 00512CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00512D42
Part of subcall function 00512CD4: InitCommonControlsEx.COMCTL32(?), ref: 00512D5F
Part of subcall function 00512CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00512D6F
Part of subcall function 00512CD4: LoadIconW.USER32(000000A9), ref: 00512D85
Part of subcall function 00512CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00512D94

Strings

AutoIt v3, xrefs: 00512C2F
0, xrefs: 00512C0F
#, xrefs: 00512C16

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: c8c7ba3d9ffbf7dad13689c7b0c4d9a9b61d5d69ee38b5dec210e6b8c6c1a51e
Instruction ID: ab420cb404ae0d20ee839d5fdab40278d11b92ac88542dcbe3edf1425b223d21
Opcode Fuzzy Hash: c8c7ba3d9ffbf7dad13689c7b0c4d9a9b61d5d69ee38b5dec210e6b8c6c1a51e
Instruction Fuzzy Hash: 90216A70E00358AFDB149FA5EC89AAD7FF4FB1CB50F00041AE580AA7A0D3B10548EF88

Function 00513170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0051316A,?,?), ref: 005131D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0051316A,?,?), ref: 00513204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00513227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0051316A,?,?), ref: 00513232
CreatePopupMenu.USER32 ref: 00513246
PostQuitMessage.USER32(00000000), ref: 00513267

Strings

TaskbarCreated, xrefs: 0051322D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 1e4f2c516c0a5113d87074a3038e763419e0f9377f5e5955fbf77d5990e95207
Instruction ID: 2ab847bb1c256f8f2e4315ca530101497210aa3205ea15995f18b23dfea5c71b
Opcode Fuzzy Hash: 1e4f2c516c0a5113d87074a3038e763419e0f9377f5e5955fbf77d5990e95207
Instruction Fuzzy Hash: E7414939240644B7FB186B78DC7DBFD3E59F756340F04052AF9528A1A1CB708AC8E7A5

Function 00512C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00512C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00512CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00511CAD,?), ref: 00512CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00511CAD,?), ref: 00512CCF

Strings

AutoIt v3, xrefs: 00512C89, 00512C8E, 00512C8F
edit, xrefs: 00512CAC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 89165a7c98567d1cc41c631086db311e900b2983ca30c5ee3e8e3083fefe8e11
Instruction ID: b78191da6a19a4070b5bd1660b6506e9f4f27e897899a2873503c4c8845f81f5
Opcode Fuzzy Hash: 89165a7c98567d1cc41c631086db311e900b2983ca30c5ee3e8e3083fefe8e11
Instruction Fuzzy Hash: 1FF03A755402D07EEB300713AC88E773EBDE7EBF50B00045EF940AA5A0C6711848EAB8

Function 005110F3 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 153
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00511BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00511BF4
Part of subcall function 00511BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00511BFC
Part of subcall function 00511BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00511C07
Part of subcall function 00511BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00511C12
Part of subcall function 00511BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00511C1A
Part of subcall function 00511BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00511C22

Part of subcall function 00511B4A: RegisterWindowMessageW.USER32(00000004,?,005112C4), ref: 00511BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0051136A
OleInitialize.OLE32 ref: 00511388
CloseHandle.KERNEL32(00000000,00000000), ref: 005524AB

Strings

x8, xrefs: 0051116A
l, xrefs: 00511115

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: x8$l
API String ID: 1986988660-23166137
Opcode ID: d9f1934d5bc0c945d4157bae68404e77a2955491e444033d96acdde581ce522f
Instruction ID: a2c1be7d9bad3e72d67d319451dd2cef8a1051d32bf9687fd9b9a2537118ac49
Opcode Fuzzy Hash: d9f1934d5bc0c945d4157bae68404e77a2955491e444033d96acdde581ce522f
Instruction Fuzzy Hash: 8F71C1B5905B818ED78CDF79A9C56993EE0FBA9340744416BD08ACF3A1EB304488EF4D

Function 0057E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0057E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0057E9A5
Sleep.KERNEL32(00000000), ref: 0057E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0057E9B7
Sleep.KERNELBASE ref: 0057E9F3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 3293825c91df3bfa04182e8f917a2a17ab8bd7763472831cac6621a360356396
Instruction ID: 1a027cc55a0d5889e96598723f7ee57a72e8a5a2f720b357d7223f34b26a0757
Opcode Fuzzy Hash: 3293825c91df3bfa04182e8f917a2a17ab8bd7763472831cac6621a360356396
Instruction Fuzzy Hash: 71015B72D01629DBCF009BE4E85AADDBF78BF1E301F004586E606B2241CB309559EB61

Function 00513B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00513B0F,SwapMouseButtons,00000004,?), ref: 00513B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00513B0F,SwapMouseButtons,00000004,?), ref: 00513B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00513B0F,SwapMouseButtons,00000004,?), ref: 00513B83

Strings

Control Panel\Mouse, xrefs: 00513B3E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 319631d09ed959d626de6772052e70475460ae4af12e77f925a05db88f3ffe56
Instruction ID: 09d53879e9682ef28836425b54e2f20288d6eab53c977c5ae174cfe8191ab0fe
Opcode Fuzzy Hash: 319631d09ed959d626de6772052e70475460ae4af12e77f925a05db88f3ffe56
Instruction Fuzzy Hash: 35112AB5514208FFEB208FA5DC58AEFBBB8FF05744B104859A805D7110E2319E84A760

Function 00513923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 005533A2

Part of subcall function 00516B57: _wcslen.LIBCMT ref: 00516B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00513A04

Strings

Line: , xrefs: 005533EB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 47bd41e12cc419c588fbe870e997675488a2467051a2eb6f987f2f57f525150a
Instruction ID: 37012539bff7429e0e1a0e8109a5fc8a43f79459d6da61c8ef5df5daa4e78fbd
Opcode Fuzzy Hash: 47bd41e12cc419c588fbe870e997675488a2467051a2eb6f987f2f57f525150a
Instruction Fuzzy Hash: 2431E271408301AAE325EB20DC59BEBBFD8BF94710F100D2AF59993091EB709688C7C6

Function 00512DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00552C8C

Part of subcall function 00513AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00513A97,?,?,00512E7F,?,?,?,00000000), ref: 00513AC2

Part of subcall function 00512DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00512DC4

Strings

X, xrefs: 00552C5A
`e], xrefs: 00552C85

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`e]
API String ID: 779396738-2761306869
Opcode ID: 233d51a63626955e37975bd671959e772abcd52637bf02909dccb5e526c68677
Instruction ID: 6c7f1b1fc690e06ec670124cc7bb6c773e2ca169bf0c90e93474dc7d2e786c83
Opcode Fuzzy Hash: 233d51a63626955e37975bd671959e772abcd52637bf02909dccb5e526c68677
Instruction Fuzzy Hash: 64218171A002589BDB41DF98D849BEE7FF8BF89305F00405AE405A7241DBB45A898F61

Function 0052FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00530668

Part of subcall function 005332A4: RaiseException.KERNEL32(?,?,?,0053068A,?,005E1444,?,?,?,?,?,?,0053068A,00511129,005D8738,00511129), ref: 00533304

__CxxThrowException@8.LIBVCRUNTIME ref: 00530685

Strings

Unknown exception, xrefs: 00530692

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: c71999923d2a1515696546d23750eedc3b54cedce785c4248cf2589d742347fa
Instruction ID: 330f89fbd2b33b6d71b1ab31fef8c90d072caeb2ce816210f737f1f86866d3d9
Opcode Fuzzy Hash: c71999923d2a1515696546d23750eedc3b54cedce785c4248cf2589d742347fa
Instruction Fuzzy Hash: DEF0C23490030E77CF00B6A8E85AC9E7F7CBE81310F604532B824D65D5EF71EA65CA80

Function 0057C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00513923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00513A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0057C259
KillTimer.USER32(?,00000001,?,?), ref: 0057C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0057C270

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 323a4ba2c2e87e9a23c0464eedba2a5f51c5e4639491052d88761e9aaa3b46a0
Instruction ID: 8268c38520dea522e2ad6d0c6ea99744c00fa1bb3e7c6e7c4814fcfdb04259e6
Opcode Fuzzy Hash: 323a4ba2c2e87e9a23c0464eedba2a5f51c5e4639491052d88761e9aaa3b46a0
Instruction Fuzzy Hash: 9C31C574904744AFEB22CF64A895BEBBFECAB17304F00449DD2DE97242C7745A88DB51

Function 005486AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,005485CC,?,005D8CC8,0000000C), ref: 00548704
GetLastError.KERNEL32(?,005485CC,?,005D8CC8,0000000C), ref: 0054870E
__dosmaperr.LIBCMT ref: 00548739

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 13746a9286d7fc3804120b1d10a8ee9d0988eada42a7bdc636fafadc96d8caf8
Instruction ID: ca96c30c1691fcba0cd7422c8e6215f49d8d2d32e340fa7d64285d3245ada209
Opcode Fuzzy Hash: 13746a9286d7fc3804120b1d10a8ee9d0988eada42a7bdc636fafadc96d8caf8
Instruction Fuzzy Hash: E0018E33A0426027D6A56B346889BFE2F59BBE277CF3A0519F8148B1D3EEB1CC819150

Function 0051DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0051DB7B
DispatchMessageW.USER32(?), ref: 0051DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0051DB9F
Sleep.KERNELBASE(0000000A), ref: 0051DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00561CC9

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 63e18fd78ce78f31ea2fdcd4028c3206ac68d47b68e7d8c617a6442931273816
Instruction ID: b04c57b5133ee7231b73540fc7dc41ed18e125d81c195027c2f3adf0a976cd47
Opcode Fuzzy Hash: 63e18fd78ce78f31ea2fdcd4028c3206ac68d47b68e7d8c617a6442931273816
Instruction Fuzzy Hash: DBF05E306483809BFB34CB608C89FEA7BBCFB95310F104918E64A830C0DB30A488DB29

Function 00521310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005217F6

Strings

CALL, xrefs: 005217C6

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 8ae96b176c50ee422b429432fb29972d9c907ed17970a4e95498c4624e750f0c
Instruction ID: 6634c6f1f2c92b9a7d328588e81a4e2057efe7602474ce4a2ff8a8cee2b1219c
Opcode Fuzzy Hash: 8ae96b176c50ee422b429432fb29972d9c907ed17970a4e95498c4624e750f0c
Instruction Fuzzy Hash: 9422AB706086529FC714DF14E484A2BBFF1BFA6314F18896DF4868B3A2D731E845CB86

Function 00513837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00513908

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 2fa2236729e56bc63a6f0304f59a78e8b151c63e885a47045cda91c9e5147d7d
Instruction ID: a3104f05ad26b2e79550cb6a0e322f9f8e9617fb0eba3216efbd6ecfaa37af3a
Opcode Fuzzy Hash: 2fa2236729e56bc63a6f0304f59a78e8b151c63e885a47045cda91c9e5147d7d
Instruction Fuzzy Hash: 3D319C705057019FE720DF24D8947DBBFE8FB59708F00092EF99997240E771AA88DB56

Function 0052F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0052F661

Part of subcall function 0051D730: GetInputState.USER32 ref: 0051D807

Sleep.KERNEL32(00000000), ref: 0056F2DE

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 52b1f535c6f53984c26d015a803dafbdb30a92d5601f2f1b9d4fbfe96dee01af
Instruction ID: f6e850105bc36d4462306ecb572e2ca58b7f35d57296f5311e41e76973719d37
Opcode Fuzzy Hash: 52b1f535c6f53984c26d015a803dafbdb30a92d5601f2f1b9d4fbfe96dee01af
Instruction Fuzzy Hash: 0CF082312402169FE310EF65E449B9ABFF5FF96760F000029E859C72A0EB70A840CF90

Function 005A2598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 005A2649

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 02d29a25169184568fa4fcf563ea8e9bd23f8d27da58181e293897203d67ac68
Instruction ID: 8f345046e79277d5b3f966e903baa1fc5efdaabe42941eb009b7d92abd58074a
Opcode Fuzzy Hash: 02d29a25169184568fa4fcf563ea8e9bd23f8d27da58181e293897203d67ac68
Instruction Fuzzy Hash: F221C574200616AFE720DF18C8D197ABF99FB4A368F14845CE9578B392CB71ED41CB90

Function 005A13B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 005A1420

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 6bf0b70107d06f8e58ea8b874064f575f2da8dc4b4e7ecd6e043059cbb340798
Instruction ID: 37400ee52f2a761914c0aa2c7b8ab4e0f5266c1c9ae9eeda80fda8aa0a7e6834
Opcode Fuzzy Hash: 6bf0b70107d06f8e58ea8b874064f575f2da8dc4b4e7ecd6e043059cbb340798
Instruction Fuzzy Hash: 41318231604613AFDB14DF29C495B69BFA1FF8A324F048568E8154B392DB75EC41CBD4

Function 00514ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00514E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00514EDD,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514E9C
Part of subcall function 00514E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00514EAE
Part of subcall function 00514E90: FreeLibrary.KERNEL32(00000000,?,?,00514EDD,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514EFD

Part of subcall function 00514E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00553CDE,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514E62
Part of subcall function 00514E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00514E74
Part of subcall function 00514E59: FreeLibrary.KERNEL32(00000000,?,?,00553CDE,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514E87

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 7194d4866a79915ef8ec09aabf73dce4a15e9113ac754805e5119d69ab1afc96
Instruction ID: 48b0312ac32c550c80d4d31d0f05ca6639ee46fab9d83a75a2a14cdf16941df8
Opcode Fuzzy Hash: 7194d4866a79915ef8ec09aabf73dce4a15e9113ac754805e5119d69ab1afc96
Instruction Fuzzy Hash: 7111C431600206AAEF15AB60D81AFED7FA5BFC0711F10442AF542AA2D1EE719E85DB50

Function 00548402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00548440

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 9d59626c12810cbc246622456b8a193d956298b931b56eeeb23c261f8471b7f1
Instruction ID: 618b61f8fe42da43e59964d0c08dde0c02aa4591aef5de213732375e3dde6d57
Opcode Fuzzy Hash: 9d59626c12810cbc246622456b8a193d956298b931b56eeeb23c261f8471b7f1
Instruction Fuzzy Hash: 5311257590410AAFCF09DF58E9449EE7BF8FF48308F144059F808AB352DA30DA118BA4

Function 00545000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00544C7D: RtlAllocateHeap.NTDLL(00000008,00511129,00000000,?,00542E29,00000001,00000364,?,?,?,0053F2DE,00543863,005E1444,?,0052FDF5,?), ref: 00544CBE

_free.LIBCMT ref: 0054506C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: faf7293bcd45e29fdd4cd395ffc8697be0ccd866822b4e37b3ecc14e7bffd585
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 090126762047056BE3218E659889ADAFFE9FB89374F65051DE18883281EA30A805C6B4

Function 005A29BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,005A14B5,?), ref: 005A2A01

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: f6ee818a910192c7ed7151af044dbe26caf8009139f4cebfe57ed17c0b28442c
Instruction ID: 80f1b8c78d190417e7746779bc07080e49821e239e195575109de4b58f6a9b45
Opcode Fuzzy Hash: f6ee818a910192c7ed7151af044dbe26caf8009139f4cebfe57ed17c0b28442c
Instruction Fuzzy Hash: 0B01D836304A429FD324CA2DC456B2A3F92FBC6314F698468C0478B251D772FC82C790

Function 0053E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 6c5e10eb16971aa7c5077b82ff950d0662c1c295916054eef83bed6e1020f663
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 57F02D32510A1597D7313A65AC0FB9B3FE8BFD2339F100719F424931D1CB70D80186A5

Function 005A149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 005A14EB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 9b55f648b18854c40a6bdc3880193ef6e7a51e9123e16c624d2241f8b2673e5a
Instruction ID: a46374970859f691bcfe2d35aa9c49ba2a03a381fd947d738fe21d78d372dfc2
Opcode Fuzzy Hash: 9b55f648b18854c40a6bdc3880193ef6e7a51e9123e16c624d2241f8b2673e5a
Instruction Fuzzy Hash: 1001D435304A419FDB20CF6DC44082ABF95FF8A364B54809DE84ACB742D672DD82C784

Function 00544C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00511129,00000000,?,00542E29,00000001,00000364,?,?,?,0053F2DE,00543863,005E1444,?,0052FDF5,?), ref: 00544CBE

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b9e1522ed38326f20b62199e8f248f0d4790d6e57c2baea3e7d318970a886a16
Instruction ID: 4659401197991350d627ea968523f16c841bb239aadb1ac43c86834c658446de
Opcode Fuzzy Hash: b9e1522ed38326f20b62199e8f248f0d4790d6e57c2baea3e7d318970a886a16
Instruction Fuzzy Hash: 52F0E93168222567DB215F72AC8DBDB3F98BF917A9F1C4121BC15AA281CA30DC009EE0

Function 00543820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,005E1444,?,0052FDF5,?,?,0051A976,00000010,005E1440,005113FC,?,005113C6,?,00511129), ref: 00543852

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1fc77640f5bb0d2085960ab3dbfc0d280e7bce6a13504e8330d23459534c25dc
Instruction ID: 2f5f05b9be6bcdeb8d9d0c5cea27efbf4dca003c3cd192af6aa530af4a067f40
Opcode Fuzzy Hash: 1fc77640f5bb0d2085960ab3dbfc0d280e7bce6a13504e8330d23459534c25dc
Instruction Fuzzy Hash: F9E02B3110322596D7312A779C04BDBBF49BF927B8F050030BC14965B0DB21ED019AE1

Function 00514F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514F6D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 481e248888786dab5058cd4ea2bf296aa52614f0619bda266c4ebcc99ac3f866
Instruction ID: 2c9151721821c03295ce8f418c1f18d359c46c982612447c3d2c6a9ce3916412
Opcode Fuzzy Hash: 481e248888786dab5058cd4ea2bf296aa52614f0619bda266c4ebcc99ac3f866
Instruction Fuzzy Hash: B4F01571105792CFEB349F64E4948A2BFE4BF15329324997EE1EA86721C7319889DF10

Function 005A2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 005A2A66

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: f5a5ce2487b24e0711a4b4f9e999c03bd242d5e58d26657475bc8d3cb6fd7a9e
Instruction ID: 3b6dae236ee1baa2f905901f1685248ec44deaee45dc9ab563c0c579abfe236a
Opcode Fuzzy Hash: f5a5ce2487b24e0711a4b4f9e999c03bd242d5e58d26657475bc8d3cb6fd7a9e
Instruction Fuzzy Hash: 9CE0DF32340116AEC710EA34EC859FE7F4CFB91390B004836AC2AD2100DB308985A6B0

Function 00512DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00512DC4

Part of subcall function 00516B57: _wcslen.LIBCMT ref: 00516B6A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 1caff749c3c295e75cceea02674f4a6ab957183f92078c586c7744f08f545cca
Instruction ID: af6bb60d88b20b4a14c9e3f61be18ee2463dd605261ee7774c41c0eb110563f5
Opcode Fuzzy Hash: 1caff749c3c295e75cceea02674f4a6ab957183f92078c586c7744f08f545cca
Instruction Fuzzy Hash: B9E0CD766041245BC71092589C09FEA7BDDEFC8790F050071FD09D7248DA60AD848550

Function 00512B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00513837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00513908

Part of subcall function 0051D730: GetInputState.USER32 ref: 0051D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00512B6B

Part of subcall function 005130F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0051314E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: bf490840f3255539c48973fb2467ebce723502b630d478dbf92d07395533e174
Instruction ID: 9e774b8ef3a567c51a5a47a9b086c4ec7cdf331ecb298829a5f51daef80eac61
Opcode Fuzzy Hash: bf490840f3255539c48973fb2467ebce723502b630d478dbf92d07395533e174
Instruction Fuzzy Hash: D3E0863130424617EB08BB75A86A5EDBF99BBE5351F40153EF182472A2CF658AC98352

Function 00573D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00573D18

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 0dea8b621158a93ea66bb80a78db055985ce3a0740752b01dc4355d8339aedc6
Instruction ID: 7f654832399cfa572b8c0b92d4ff186ee630e33c222c514c4391c88a95e1e2d6
Opcode Fuzzy Hash: 0dea8b621158a93ea66bb80a78db055985ce3a0740752b01dc4355d8339aedc6
Instruction Fuzzy Hash: 1AD012E06A03087EFB0087718C0BEBB369CC326A81F004BA47A02D64C1D9A0DE080130

Function 0055039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00550704,?,?,00000000,?,00550704,00000000,0000000C), ref: 005503B7

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 54f1aac22010cd729c72b798458b2d50dd5650f05d8a71586cfef900dec2cc58
Instruction ID: e3fdca1bd9b971a046894b3aa3ac286079517264a556a7e70bb7ea0c106ed27b
Opcode Fuzzy Hash: 54f1aac22010cd729c72b798458b2d50dd5650f05d8a71586cfef900dec2cc58
Instruction Fuzzy Hash: 8AD06C3214010DBBDF028F84DD06EDA3FAAFB48714F014000BE1856020C736E821EB90

Function 00511CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00511CBC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 47ad4b8e05770eede9ba130daf9b36dba2778459329f13e8e9734d64e9f979a1
Instruction ID: c4d423dec8d936809a059062ce4fa6cb68b61af6229407aa99593c5eb325b763
Opcode Fuzzy Hash: 47ad4b8e05770eede9ba130daf9b36dba2778459329f13e8e9734d64e9f979a1
Instruction Fuzzy Hash: 96C09B352803449FF3184780BD8AF107754A36CB01F444401F6895D5E3C7B11814FA54

Non-executed Functions

Function 005A9576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00529BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00529BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 005A961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 005A965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 005A969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005A96C9
SendMessageW.USER32 ref: 005A96F2
GetKeyState.USER32(00000011), ref: 005A978B
GetKeyState.USER32(00000009), ref: 005A9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 005A97AE
GetKeyState.USER32(00000010), ref: 005A97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005A97E9
SendMessageW.USER32 ref: 005A9810
SendMessageW.USER32(?,00001030,?,005A7E95), ref: 005A9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 005A992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 005A9941
SetCapture.USER32(?), ref: 005A994A
ClientToScreen.USER32(?,?), ref: 005A99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 005A99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 005A99D6
ReleaseCapture.USER32 ref: 005A99E1
GetCursorPos.USER32(?), ref: 005A9A19
ScreenToClient.USER32(?,?), ref: 005A9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 005A9A80
SendMessageW.USER32 ref: 005A9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 005A9AEB
SendMessageW.USER32 ref: 005A9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 005A9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 005A9B4A
GetCursorPos.USER32(?), ref: 005A9B68
ScreenToClient.USER32(?,?), ref: 005A9B75
GetParent.USER32(?), ref: 005A9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 005A9BFA
SendMessageW.USER32 ref: 005A9C2B
ClientToScreen.USER32(?,?), ref: 005A9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 005A9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 005A9CDE
SendMessageW.USER32 ref: 005A9D01
ClientToScreen.USER32(?,?), ref: 005A9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 005A9D82

Part of subcall function 00529944: GetWindowLongW.USER32(?,000000EB), ref: 00529952

GetWindowLongW.USER32(?,000000F0), ref: 005A9E05

Strings

p#^, xrefs: 005A9990
@GUI_DRAGID, xrefs: 005A997D
F, xrefs: 005A9D07

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#^
API String ID: 3429851547-1742403966
Opcode ID: 508a200880fb2dcc4a96c1f3b3d0f8ba6faf4fc5b40d4db587102515b123718b
Instruction ID: 8b808e43fcf4666124bd06d5fd4d09a42a9fe7d8a9a0dbda268f7e4305b14c51
Opcode Fuzzy Hash: 508a200880fb2dcc4a96c1f3b3d0f8ba6faf4fc5b40d4db587102515b123718b
Instruction Fuzzy Hash: 8E427E34604251AFDB25CF28CC84AAEBFE5FF9A310F140A19F6998B2A1D731E854DF51

Function 005A4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 005A48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 005A4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 005A4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 005A494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 005A495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 005A497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 005A49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 005A49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 005A4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 005A4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 005A4A7E
IsMenu.USER32(?), ref: 005A4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005A4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005A4B20
GetWindowLongW.USER32(?,000000F0), ref: 005A4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 005A4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 005A4C82
wsprintfW.USER32 ref: 005A4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 005A4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 005A4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 005A4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 005A4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 005A4D5A

Strings

%d/%02d/%02d, xrefs: 005A4CA8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: ab5bb06dd890db35b6e2fb74b5729845433c4d161124ea0b2c6ad7967ee7c973
Instruction ID: ff3a53fc80c8389ccc4f5d2e9e7ab0a3bb3ed87342e9b58df4dc6d93e7d984d5
Opcode Fuzzy Hash: ab5bb06dd890db35b6e2fb74b5729845433c4d161124ea0b2c6ad7967ee7c973
Instruction Fuzzy Hash: 9312CC71600255ABEB258FA8DC49BAE7FF8BF86310F104529F516EB2E1DBB49940CF50

Function 00571201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 005716C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0057170D
Part of subcall function 005716C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0057173A
Part of subcall function 005716C3: GetLastError.KERNEL32 ref: 0057174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00571286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 005712A8
CloseHandle.KERNEL32(?), ref: 005712B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 005712D1
GetProcessWindowStation.USER32 ref: 005712EA
SetProcessWindowStation.USER32(00000000), ref: 005712F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00571310

Part of subcall function 005710BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005711FC), ref: 005710D4
Part of subcall function 005710BF: CloseHandle.KERNEL32(?,?,005711FC), ref: 005710E9

Strings

default, xrefs: 0057130B
winsta0, xrefs: 005712CC
, xrefs: 0057125A
Z], xrefs: 00571392

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Z]
API String ID: 22674027-3859823317
Opcode ID: cd2d9275c718d7bd478246cdea08d36558a52b91fcd7898f05bad04266eb718b
Instruction ID: fcdd763ae2acfa499678418ae0f127607029247847ce67abfbfdbfc937ca58c6
Opcode Fuzzy Hash: cd2d9275c718d7bd478246cdea08d36558a52b91fcd7898f05bad04266eb718b
Instruction Fuzzy Hash: 4881AF71900609AFDF219FA8EC49FEE7FBAFF05700F148129F918A61A0D7318944EB64

Function 00570B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005710F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00571114
Part of subcall function 005710F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00570B9B,?,?,?), ref: 00571120
Part of subcall function 005710F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00570B9B,?,?,?), ref: 0057112F
Part of subcall function 005710F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00570B9B,?,?,?), ref: 00571136
Part of subcall function 005710F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0057114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00570BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00570C00
GetLengthSid.ADVAPI32(?), ref: 00570C17
GetAce.ADVAPI32(?,00000000,?), ref: 00570C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00570C6D
GetLengthSid.ADVAPI32(?), ref: 00570C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00570C8C
HeapAlloc.KERNEL32(00000000), ref: 00570C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00570CB4
CopySid.ADVAPI32(00000000), ref: 00570CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00570CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00570D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00570D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00570D45
HeapFree.KERNEL32(00000000), ref: 00570D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00570D55
HeapFree.KERNEL32(00000000), ref: 00570D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00570D65
HeapFree.KERNEL32(00000000), ref: 00570D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00570D78
HeapFree.KERNEL32(00000000), ref: 00570D7F

Part of subcall function 00571193: GetProcessHeap.KERNEL32(00000008,00570BB1,?,00000000,?,00570BB1,?), ref: 005711A1
Part of subcall function 00571193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00570BB1,?), ref: 005711A8
Part of subcall function 00571193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00570BB1,?), ref: 005711B7

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 77b9a56704e2ddca1891660ce72c81f3d1bf958924dd6dd603c3fa942a30b92a
Instruction ID: beedb129fadc94d7be722a950c97dc8b2c039ac6c1c8008448bc0a75d78e36c9
Opcode Fuzzy Hash: 77b9a56704e2ddca1891660ce72c81f3d1bf958924dd6dd603c3fa942a30b92a
Instruction Fuzzy Hash: F4713C71A0020AEBDF10DFA5EC48FAEBFB8BF15310F148515E919A7291D771A905EB60

Function 0058EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(005ACC08), ref: 0058EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0058EB37
GetClipboardData.USER32(0000000D), ref: 0058EB43
CloseClipboard.USER32 ref: 0058EB4F
GlobalLock.KERNEL32(00000000), ref: 0058EB87
CloseClipboard.USER32 ref: 0058EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0058EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0058EBC9
GetClipboardData.USER32(00000001), ref: 0058EBD1
GlobalLock.KERNEL32(00000000), ref: 0058EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0058EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0058EC38
GetClipboardData.USER32(0000000F), ref: 0058EC44
GlobalLock.KERNEL32(00000000), ref: 0058EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0058EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0058EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0058ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0058ECF3
CountClipboardFormats.USER32 ref: 0058ED14
CloseClipboard.USER32 ref: 0058ED59

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 9f0b9efbb33bc0988138c330b50c787ea237afe7d4e7eb8efb686105dd8d5992
Instruction ID: 0a8b4eff1b4c06f5b63da2787e81935f4f73e1d3a40baabb761e3da65b3ec795
Opcode Fuzzy Hash: 9f0b9efbb33bc0988138c330b50c787ea237afe7d4e7eb8efb686105dd8d5992
Instruction Fuzzy Hash: 5661BF34204202AFD300EF24D89AF6ABFB4BF95714F14451DF896A72A2DB31DD49DB62

Function 0058698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005869BE
FindClose.KERNEL32(00000000), ref: 00586A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00586A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00586A75

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00586AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00586ADF

Strings

%03d, xrefs: 00586DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00586B32
%02d, xrefs: 00586C00, 00586C0A, 00586C5A, 00586CAA, 00586CFA, 00586D4A
%4d, xrefs: 00586BB1
%4d%02d%02d%02d%02d%02d, xrefs: 00586B6A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 941213a7484778ab32e6477e783abb961878883097c990a1b8d03eaa8b0e5402
Instruction ID: 6f7dfe815ac6d371e7caf7b60cfe1a6e556da292a00cf721f621d7a26a54f650
Opcode Fuzzy Hash: 941213a7484778ab32e6477e783abb961878883097c990a1b8d03eaa8b0e5402
Instruction Fuzzy Hash: ECD15F72508301AED314EBA4D895EAFBBECBF88704F04491DF985D7291EB34DA44CB62

Function 00589642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00589663
GetFileAttributesW.KERNEL32(?), ref: 005896A1
SetFileAttributesW.KERNEL32(?,?), ref: 005896BB
FindNextFileW.KERNEL32(00000000,?), ref: 005896D3
FindClose.KERNEL32(00000000), ref: 005896DE
FindFirstFileW.KERNEL32(*.*,?), ref: 005896FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0058974A
SetCurrentDirectoryW.KERNEL32(005D6B7C), ref: 00589768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00589772
FindClose.KERNEL32(00000000), ref: 0058977F
FindClose.KERNEL32(00000000), ref: 0058978F

Strings

*.*, xrefs: 005896F5

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 3e2b08dc0ec6f1249e52e93c13f7404d6bfc605f81c451f1b10f59454175141a
Instruction ID: e06b54ad8eba499b6b8a4fe478946e26cd636b6fb4b98312bde7f07f89520740
Opcode Fuzzy Hash: 3e2b08dc0ec6f1249e52e93c13f7404d6bfc605f81c451f1b10f59454175141a
Instruction Fuzzy Hash: C531A03654021A6ADF24AFB5DC49AEE7FACFF4A320F184156F915F21A0EB30DE448B54

Function 0058979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 005897BE
FindNextFileW.KERNEL32(00000000,?), ref: 00589819
FindClose.KERNEL32(00000000), ref: 00589824
FindFirstFileW.KERNEL32(*.*,?), ref: 00589840
SetCurrentDirectoryW.KERNEL32(?), ref: 00589890
SetCurrentDirectoryW.KERNEL32(005D6B7C), ref: 005898AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 005898B8
FindClose.KERNEL32(00000000), ref: 005898C5
FindClose.KERNEL32(00000000), ref: 005898D5

Part of subcall function 0057DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0057DB00

Strings

*.*, xrefs: 0058983B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: af2324613f000af4f34e0b339afbc49c4d921261e59c532d40635e96c8dd665d
Instruction ID: bd9c7d75efeca15d4609e96e3d13370477dbf0bc7207b4d0043f2a5b7b236691
Opcode Fuzzy Hash: af2324613f000af4f34e0b339afbc49c4d921261e59c532d40635e96c8dd665d
Instruction Fuzzy Hash: 5431B23150021A6AEF20BFA4EC48AEE7FACBF46324F184156E954B2190DB30DE498F60

Function 0059BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0059C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0059B6AE,?,?), ref: 0059C9B5
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059C9F1
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059CA68
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0059BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0059BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0059BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0059C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0059C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0059C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0059C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0059C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0059C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0059C382
RegCloseKey.ADVAPI32(00000000), ref: 0059C38F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 12f6cb8e06b946a676f3e2c1aaa92d7764e4db79714c3a30b36b3be1adf104b6
Instruction ID: 2c5b2b5bcfe71e4df36ba936dd4ff594d412014c7c1d8cc7b451444b97c19a2f
Opcode Fuzzy Hash: 12f6cb8e06b946a676f3e2c1aaa92d7764e4db79714c3a30b36b3be1adf104b6
Instruction Fuzzy Hash: EC024C716042019FDB14DF28C895E2ABFE5BF89314F18889DF84ADB2A2D731ED45CB51

Function 00588195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00588257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00588267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00588273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00588310
SetCurrentDirectoryW.KERNEL32(?), ref: 00588324
SetCurrentDirectoryW.KERNEL32(?), ref: 00588356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0058838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00588395

Strings

*.*, xrefs: 0058839B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: d6cc8b3e27ef4d0c61ede0a983e01e97532d2a048b51cb7c252edefd544a757f
Instruction ID: 7c475f708cf66aeafc0f9aa510feada81e8ccd3ae88b66f64402f6417c7d0f99
Opcode Fuzzy Hash: d6cc8b3e27ef4d0c61ede0a983e01e97532d2a048b51cb7c252edefd544a757f
Instruction Fuzzy Hash: 47619E755043069FD710EF64C8459AEBBE9FF89310F448C1EF98993251EB31E945CB92

Function 0057D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00513AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00513A97,?,?,00512E7F,?,?,?,00000000), ref: 00513AC2

Part of subcall function 0057E199: GetFileAttributesW.KERNEL32(?,0057CF95), ref: 0057E19A

FindFirstFileW.KERNEL32(?,?), ref: 0057D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0057D1DD
MoveFileW.KERNEL32(?,?), ref: 0057D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0057D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0057D237

Part of subcall function 0057D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0057D21C,?,?), ref: 0057D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0057D253
FindClose.KERNEL32(00000000), ref: 0057D264

Strings

\*.*, xrefs: 0057D0CD, 0057D0D6, 0057D0EB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 981ac46e5a791924acc255902c2526183e3029e099f4aaf21512f0d6a05bafef
Instruction ID: abb67afadee84401edae6accc36a28799cbe7b2ee976bf676f5319ac9f69929a
Opcode Fuzzy Hash: 981ac46e5a791924acc255902c2526183e3029e099f4aaf21512f0d6a05bafef
Instruction Fuzzy Hash: B1617F3180110EAADF05EBE0D9569EDBFB5BF95300F648065E40677192EB316F49EB60

Function 0058ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0058ED91
EmptyClipboard.USER32 ref: 0058ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0058EDAC
CloseClipboard.USER32 ref: 0058EEA3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 40d53d5340cc6b32305873e304a09ba6f718dcd2d885cd50c9533605a6c0aa24
Instruction ID: 2679c957e10afe80cde0d3453917f6397d87073afe060390bf164002e43e7b78
Opcode Fuzzy Hash: 40d53d5340cc6b32305873e304a09ba6f718dcd2d885cd50c9533605a6c0aa24
Instruction Fuzzy Hash: 8941CD35204611AFE320EF19D88AB19BFF5FF55318F14C499E8559B6A2C731EC46CB90

Function 0057E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 005716C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0057170D
Part of subcall function 005716C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0057173A
Part of subcall function 005716C3: GetLastError.KERNEL32 ref: 0057174A

ExitWindowsEx.USER32(?,00000000), ref: 0057E932

Strings

SeShutdownPrivilege, xrefs: 0057E902
@, xrefs: 0057E925
, xrefs: 0057E920
, xrefs: 0057E95C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: a99771954b857ff24358e4ebec0add295ba28f475951914c1b531091c3dc5599
Instruction ID: 3d8285020655f0a4da70bace973e2ded67ee0411d300582781ff7b42d04a9a9f
Opcode Fuzzy Hash: a99771954b857ff24358e4ebec0add295ba28f475951914c1b531091c3dc5599
Instruction Fuzzy Hash: 86012B33610311ABEB642678BC8BFBF7E5CB719740F148862FE07E21D1D6605C44A294

Function 00591204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00591276
WSAGetLastError.WSOCK32 ref: 00591283
bind.WSOCK32(00000000,?,00000010), ref: 005912BA
WSAGetLastError.WSOCK32 ref: 005912C5
closesocket.WSOCK32(00000000), ref: 005912F4
listen.WSOCK32(00000000,00000005), ref: 00591303
WSAGetLastError.WSOCK32 ref: 0059130D
closesocket.WSOCK32(00000000), ref: 0059133C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 93cef969da796da19ceebe48d052bfd0765d33f128b678d9899cb982a21ae9fa
Instruction ID: 56d52344c05c3da122d081dace615ef2e542fafc9548844fce2655244f72d4ef
Opcode Fuzzy Hash: 93cef969da796da19ceebe48d052bfd0765d33f128b678d9899cb982a21ae9fa
Instruction Fuzzy Hash: F34190356005129FDB10EF24C488B69BFE6BF86318F188588E8568F2D2C775EC85CBE1

Function 0054B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0054B9D4
_free.LIBCMT ref: 0054B9F8
_free.LIBCMT ref: 0054BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,005B3700), ref: 0054BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,005E121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0054BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,005E1270,000000FF,?,0000003F,00000000,?), ref: 0054BC36
_free.LIBCMT ref: 0054BD4B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 87c5870180fdbc500c10aca4dc230557b95ed7eda79566e1e5f61138330b3f44
Instruction ID: 2d4d12c22c48b61d3cb1cb8e2e5b4d89f06f4ee6a5dea2ad1f8547dd8ab00426
Opcode Fuzzy Hash: 87c5870180fdbc500c10aca4dc230557b95ed7eda79566e1e5f61138330b3f44
Instruction Fuzzy Hash: 84C13471A04246ABEB249F3A8C85BEE7FB8FF91318F14459AE590DB251E730CE41D750

Function 0057D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00513AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00513A97,?,?,00512E7F,?,?,?,00000000), ref: 00513AC2

Part of subcall function 0057E199: GetFileAttributesW.KERNEL32(?,0057CF95), ref: 0057E19A

FindFirstFileW.KERNEL32(?,?), ref: 0057D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0057D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0057D481
FindClose.KERNEL32(00000000), ref: 0057D498
FindClose.KERNEL32(00000000), ref: 0057D4A1

Strings

\*.*, xrefs: 0057D3F2

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: f34b22bfdf773d1acf36d8306eb9f5f24247ba4289ec5df2495814359a51ab57
Instruction ID: 4492faea13b5ff97c31ade59f6912fc78f2ee5c62d5d3948ae735cf9f7e6cddb
Opcode Fuzzy Hash: f34b22bfdf773d1acf36d8306eb9f5f24247ba4289ec5df2495814359a51ab57
Instruction Fuzzy Hash: 2D315E710083429BD701EF64D8599EFBFF8BEE2310F448E1DF4D552191EB60AA49E762

Function 0054E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0054E645

Strings

1#IND, xrefs: 0054F83D
1#SNAN, xrefs: 0054F844
1#INF, xrefs: 0054F852
1#QNAN, xrefs: 0054F84B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 2639705a19b7efbfbdc79290edc89de81fa9247dd7d632e2f70ab8793298c6b6
Instruction ID: d7c299d255602201832638ca2b45f1e9c501374821133afc9694ce96cd203bf3
Opcode Fuzzy Hash: 2639705a19b7efbfbdc79290edc89de81fa9247dd7d632e2f70ab8793298c6b6
Instruction Fuzzy Hash: 58C25A72E046298FDB25CE28DD457EABBB5FB84308F1445EAD44EE7241E774AE818F40

Function 0058648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005864DC
CoInitialize.OLE32(00000000), ref: 00586639
CoCreateInstance.OLE32(005AFCF8,00000000,00000001,005AFB68,?), ref: 00586650
CoUninitialize.OLE32 ref: 005868D4

Strings

.lnk, xrefs: 005864BA, 00586524, 005865E0

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: bbe80efea17fbf0fbc6bb42756f05901a670b9b3a31076152137757bb55c23c2
Instruction ID: 5766b7b8f55e185325d770d0756ba79b2c9bba50ec100200c57fc73ef7d1915b
Opcode Fuzzy Hash: bbe80efea17fbf0fbc6bb42756f05901a670b9b3a31076152137757bb55c23c2
Instruction Fuzzy Hash: C2D15871508202AFD314EF24C8959ABBBE8FFD8304F40496DF5959B291EB31ED46CB92

Function 005922DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 005922E8

Part of subcall function 0058E4EC: GetWindowRect.USER32(?,?), ref: 0058E504

GetDesktopWindow.USER32 ref: 00592312
GetWindowRect.USER32(00000000), ref: 00592319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00592355
GetCursorPos.USER32(?), ref: 00592381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 005923DF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 1be20fed7c0bdee79e1fea859061459ba3f0832f6923eb7ad6181d010fac4c0d
Instruction ID: ab8ac46f56834affceed31e8a00d84c1667fcb0944549a94fd558a1e514ce4f2
Opcode Fuzzy Hash: 1be20fed7c0bdee79e1fea859061459ba3f0832f6923eb7ad6181d010fac4c0d
Instruction Fuzzy Hash: A231DE72505316AFCB20DF14D849B5BBBE9FF89310F000919F98997191DB34EA08CB92

Function 00589B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00589B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00589C8B

Part of subcall function 00583874: GetInputState.USER32 ref: 005838CB
Part of subcall function 00583874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00583966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00589BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00589C75

Strings

*.*, xrefs: 00589B5D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: cd9f255d80474b86fe1570301180a13b01a275f20cd8a6e1a37f75b96a972c19
Instruction ID: 07fbb771b0ffd4c3c3a9af82df8d12deabb020f8fa5dcd6892961e74eb99cc67
Opcode Fuzzy Hash: cd9f255d80474b86fe1570301180a13b01a275f20cd8a6e1a37f75b96a972c19
Instruction Fuzzy Hash: 9341827190420AAFDF15EFA4C899AEEBFB4FF45310F244456E815B2191EB319E84CF60

Function 0052997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00529BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00529BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00529A4E
GetSysColor.USER32(0000000F), ref: 00529B23
SetBkColor.GDI32(?,00000000), ref: 00529B36

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: cfc1820b6075d2964fb69c04e2e07312443c4ce03a80680f2c5169791115175b
Instruction ID: ac4656bfb01e6cd28b69ffb343ad604e2269c08c0de2d28f6bac8cdb54a34805
Opcode Fuzzy Hash: cfc1820b6075d2964fb69c04e2e07312443c4ce03a80680f2c5169791115175b
Instruction Fuzzy Hash: 5AA1F770108668AEE728AA2CAC9CE7F2E9DFF8B354F140609F502D77D1CB259D41D276

Function 00591806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0059304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0059307A
Part of subcall function 0059304E: _wcslen.LIBCMT ref: 0059309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0059185D
WSAGetLastError.WSOCK32 ref: 00591884
bind.WSOCK32(00000000,?,00000010), ref: 005918DB
WSAGetLastError.WSOCK32 ref: 005918E6
closesocket.WSOCK32(00000000), ref: 00591915

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: d168676fb91f24ff3471d8d8bbbccabc734be448441b8c89ff6f3f23ac591d02
Instruction ID: 05880092055b06d605d49a7d571dcc5d2f2ce00b9ed365500872198dffedfaf6
Opcode Fuzzy Hash: d168676fb91f24ff3471d8d8bbbccabc734be448441b8c89ff6f3f23ac591d02
Instruction Fuzzy Hash: 9451B275A002119FEB10AF24C88AF6A7FE5BF85718F048458F9165F3C3D771AD418BA1

Function 005A1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 005A1CC0
IsWindowEnabled.USER32 ref: 005A1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 005A1CDB
IsIconic.USER32 ref: 005A1CE9
IsZoomed.USER32 ref: 005A1CF7

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 79de7d53e4de465790a302ad347067bbccc40672e9330843d69e1addf80eb959
Instruction ID: f34e508edbbdb1eaaefda7c8993fd17b0bf63b156bacadfb7320719a1a8a5ba5
Opcode Fuzzy Hash: 79de7d53e4de465790a302ad347067bbccc40672e9330843d69e1addf80eb959
Instruction Fuzzy Hash: 1C218331740A115FE7208F2AC854B6E7FE5FF96325F198068E8468B351CB71DC46CB98

Function 00518060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 005183FA
ERCP, xrefs: 0051813C
VUUU, xrefs: 00555DF0
VUUU, xrefs: 005183E8
VUUU, xrefs: 0051843C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 3d285605b9d2a835d8779eebecf449feb85882a3e5919315a1bb755c2c2b8fea
Instruction ID: 8874fc9844aae64ebedaa98193ed84187a1ffb264a53b44f0b5359c1225db84e
Opcode Fuzzy Hash: 3d285605b9d2a835d8779eebecf449feb85882a3e5919315a1bb755c2c2b8fea
Instruction Fuzzy Hash: F8A26A74A0061ACBEF348F58C8A47FDBBB1BB54311F6485AAD815A7281EB709D85CB90

Function 00578298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 005782AA

Strings

(, xrefs: 005782F0
tb], xrefs: 005784F4
|, xrefs: 005782DA

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tb]$|
API String ID: 1659193697-2890004336
Opcode ID: 46376787a8d577e13fa83f45828fde20f25ac97ab9f081cd557fe36c99ac45da
Instruction ID: 5acc7c38a10b7b2a8190d46f6875fdd5a946307441f06f886ed1275ad3df5567
Opcode Fuzzy Hash: 46376787a8d577e13fa83f45828fde20f25ac97ab9f081cd557fe36c99ac45da
Instruction Fuzzy Hash: B2323574A006059FCB28CF59D485A6ABBF0FF48710B15C96EE49ADB7A1EB70E941CB40

Function 0059A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0059A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0059A6BA

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Process32NextW.KERNEL32(00000000,?), ref: 0059A79C
CloseHandle.KERNEL32(00000000), ref: 0059A7AB

Part of subcall function 0052CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00553303,?), ref: 0052CE8A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 8d242395d2a56be87e52751e2e6e6f82af076cf84bb89c48c452d67cbdaab91b
Instruction ID: 0f7578123f3f8661b9f3d33fd859809fff861ad850c5157a9e63722a22c109ae
Opcode Fuzzy Hash: 8d242395d2a56be87e52751e2e6e6f82af076cf84bb89c48c452d67cbdaab91b
Instruction Fuzzy Hash: 8E512B71508311AFD710EF24D88AAABBBE8FFC9754F00491DF59597291EB30E944CBA2

Function 0057AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0057AAAC
SetKeyboardState.USER32(00000080), ref: 0057AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0057AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0057AB88

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: a7b9e625ec7f833e5aca24eb455cca2744b0684910cfdf10f673c823141e59c6
Instruction ID: 203444b62a6dd7f5777a18ed7777f30a5a573b2bb8ea35d84a609d72279fbf84
Opcode Fuzzy Hash: a7b9e625ec7f833e5aca24eb455cca2744b0684910cfdf10f673c823141e59c6
Instruction Fuzzy Hash: A8311530A40208AEFB25CA64E805BFE7FAABBC5310F04C21AF58D561D0D7748985E7A2

Function 0058CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0058CE89
GetLastError.KERNEL32(?,00000000), ref: 0058CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0058CEFE

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 1af3c0899514d57734c9cb63f95676ed35028d830c355d1843ef6a41a15f8789
Instruction ID: 717ba3dc2f06fa270d90f1c0f6ecd6b7908c38c7464b4538ed53b1bc01d854b1
Opcode Fuzzy Hash: 1af3c0899514d57734c9cb63f95676ed35028d830c355d1843ef6a41a15f8789
Instruction Fuzzy Hash: 7521B0715003059BE731EF65D949BA67FFCFB51314F10481EEA46E2151E774ED089B60

Function 00585C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00585CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00585D17
FindClose.KERNEL32(?), ref: 00585D5F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 79b0d09b92e178131098571a6b97c929de154670db76545494c35672081107c8
Instruction ID: 134cebc8f3110ba2196c20fb66a251dfaa7e2fd0af79521c5f21ed227a080329
Opcode Fuzzy Hash: 79b0d09b92e178131098571a6b97c929de154670db76545494c35672081107c8
Instruction Fuzzy Hash: 8351CC346046029FC714DF28C488E9ABBE4FF49314F14855EE99A8B3A2EB30ED44CF91

Function 00542622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0054271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00542724
UnhandledExceptionFilter.KERNEL32(?), ref: 00542731

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: afa0bad793a59e7ef57cef759c7177a981d01b9904b6c01d6fc933f25c2b7c4e
Instruction ID: a7e356534833ece82dee2b925e8f95037e498253b70cb1e6148de0dc3a26d460
Opcode Fuzzy Hash: afa0bad793a59e7ef57cef759c7177a981d01b9904b6c01d6fc933f25c2b7c4e
Instruction Fuzzy Hash: EA31C27490122DABCB21DF68DD887DCBBB8BF18310F5041EAE80CA6260E7309F859F44

Function 005851CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005851DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00585238
SetErrorMode.KERNEL32(00000000), ref: 005852A1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 302896f6692914c909f31026dc2ae98f794663d7dc9fff567ab0d280a3bf993f
Instruction ID: ccff98b3a51e8eda4305d98c6f91e0c6c59991862f3bc10c31d27e16c8ec55a6
Opcode Fuzzy Hash: 302896f6692914c909f31026dc2ae98f794663d7dc9fff567ab0d280a3bf993f
Instruction Fuzzy Hash: EC312C75A00619DFDB00EF54D888EADBFB5FF49314F048099E805AB362DB31E85ACB90

Function 005716C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0052FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00530668
Part of subcall function 0052FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00530685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0057170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0057173A
GetLastError.KERNEL32 ref: 0057174A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 268f155e4c234fe2b6824220a25d3d7e0924c6bc417fc0e4814b7664d9f40f59
Instruction ID: de28525dfd52e3a4012d6f38bbe328d96869c7069b90e1cfbbb5f54c633fd75f
Opcode Fuzzy Hash: 268f155e4c234fe2b6824220a25d3d7e0924c6bc417fc0e4814b7664d9f40f59
Instruction Fuzzy Hash: 5911CEB2400305AFD718AF58EC8AD6ABBBDFF45714B20C52EE05A57281EB70BC419B24

Function 0057D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0057D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0057D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0057D650

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: c8c7cfe43975fe371337c872d3ecfa002b006c502362fbed1bf106f54566f85b
Instruction ID: 97260a61659f020e052c7f1a407080e120ad8ae6da29ee8d527df9d05606bc67
Opcode Fuzzy Hash: c8c7cfe43975fe371337c872d3ecfa002b006c502362fbed1bf106f54566f85b
Instruction Fuzzy Hash: C2115E75E05228BFDB108F95EC45FAFBFBCEB45B50F108156F908E7290D6704A059BA1

Function 00571663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0057168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 005716A1
FreeSid.ADVAPI32(?), ref: 005716B1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 94809f7e001e4ed01662eaaf9c3d4e79071f6493883b96a9ddbf9ebd256bffaa
Instruction ID: 176b2a6727dfe6d7a91da12daf738ecc5d2fe21a0fde1488a30f27f53cf86fe0
Opcode Fuzzy Hash: 94809f7e001e4ed01662eaaf9c3d4e79071f6493883b96a9ddbf9ebd256bffaa
Instruction Fuzzy Hash: 89F0F47195030DFBDB00DFE49D89AAEBBBCFB08604F508565E501E2181E774AA489A54

Function 00534CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(005428E9,?,00534CBE,005428E9,005D88B8,0000000C,00534E15,005428E9,00000002,00000000,?,005428E9), ref: 00534D09
TerminateProcess.KERNEL32(00000000,?,00534CBE,005428E9,005D88B8,0000000C,00534E15,005428E9,00000002,00000000,?,005428E9), ref: 00534D10
ExitProcess.KERNEL32 ref: 00534D22

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 82bd4bc6b819be00dd79d5582f8343fdd539c6cf3c8a409646c44832efbf5928
Instruction ID: ecd0645cbbe328e136bc984cf64a200a30c7cdb28f7f02806e61409061b09998
Opcode Fuzzy Hash: 82bd4bc6b819be00dd79d5582f8343fdd539c6cf3c8a409646c44832efbf5928
Instruction Fuzzy Hash: 2FE0B631000149ABCF11AF54DD09A593F69FB92785F104814FC059A132CB35ED46DE80

Function 0054C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0054C36C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 9fb364bc48fa507a1570f00e0967a39e6cdf612500d40f85a340487188a7fcc7
Instruction ID: fb6652b98a3781b2f5a12221a0e427bcc911ea91ff4d2165c1d4f8dfa6b6fc82
Opcode Fuzzy Hash: 9fb364bc48fa507a1570f00e0967a39e6cdf612500d40f85a340487188a7fcc7
Instruction Fuzzy Hash: 7E410376901219ABCB209EB9CC89EFB7FB8FBC4318F504669F905D7180E6709D818B50

Function 0056D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0056D28C

Strings

X64, xrefs: 0056D2A8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 2f228e23243c86e7b0a3d14bb8becef993a5380fd53c8a845864ef320cfb6577
Instruction ID: 34cacf5799088c056a9b5001acc38c10fcd8f24555b7ad87b395c2364a787781
Opcode Fuzzy Hash: 2f228e23243c86e7b0a3d14bb8becef993a5380fd53c8a845864ef320cfb6577
Instruction Fuzzy Hash: 84D0CAB880116DEACB94CBA0EC8CDDEBBBCBB15305F100A92F506A2040EB3496489F20

Function 0053CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: fcaf572f7ff181801ed2caa820e665f338e686476372e5d8e27cefae35fad23e
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: E8020B72E002199BDF14CFA9C8906ADBFF5FF88314F25816AD819FB285D731AD418B94

Function 0051CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

p#^, xrefs: 0051CF7F
Variable is not of type 'Object'., xrefs: 00560C40

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#^
API String ID: 0-3707816926
Opcode ID: b9aded25edf831126c995f309dafb8649fcc1b014e34be8ca7f157ed4b2655de
Instruction ID: 2807d7fc1836201bd9873582010fc7f00350088419aac3f565dcc528cbf25a3d
Opcode Fuzzy Hash: b9aded25edf831126c995f309dafb8649fcc1b014e34be8ca7f157ed4b2655de
Instruction Fuzzy Hash: 1C32C030940219DFEF14DF90D885AEEBFB9FF45304F108459E806AB292D736AD86CB60

Function 005868EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00586918
FindClose.KERNEL32(00000000), ref: 00586961

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: e6c2e0ca8263addc36a6ca751e9337bcb197e074e1814221ff7d3751d7a85301
Instruction ID: 92dfe15808c49cd0ccfba3780411d71d20029e8ed3f7a5579bcaf8d9de36e887
Opcode Fuzzy Hash: e6c2e0ca8263addc36a6ca751e9337bcb197e074e1814221ff7d3751d7a85301
Instruction Fuzzy Hash: D71190356042019FD710DF29D489A16BFE5FF89328F14C699E8699F7A2CB30EC45CB91

Function 005837B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00594891,?,?,00000035,?), ref: 005837E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00594891,?,?,00000035,?), ref: 005837F4

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5d17485d37c43069677baa574a1c4a16a3a15347ea22a6834d119a8776dc343d
Instruction ID: a6f8d38a89109b4b3722f9ac3bc4949022bce98d14447c11d8e8f71cdf397620
Opcode Fuzzy Hash: 5d17485d37c43069677baa574a1c4a16a3a15347ea22a6834d119a8776dc343d
Instruction Fuzzy Hash: 7DF0EC706042152AE71067654C4DFDB3F9DFFC5B61F000175F905E2281D9609D48C7B0

Function 005710BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005711FC), ref: 005710D4
CloseHandle.KERNEL32(?,?,005711FC), ref: 005710E9

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: adf179083da7eeff2f1bf6227ec6ab508c122a2012d43d70ab697419a8251e67
Instruction ID: a9e1315f29f48ef04729aaa2af4eb85710bee989828662f9d1c3b48f999a4b77
Opcode Fuzzy Hash: adf179083da7eeff2f1bf6227ec6ab508c122a2012d43d70ab697419a8251e67
Instruction Fuzzy Hash: 52E04F32004611AFE7252B11FC09E777FA9FF05310B10882EF4A6804B1DB626C90EB14

Function 0051BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#^, xrefs: 005607CE

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#^
API String ID: 3964851224-2580200144
Opcode ID: d9cf3dd4be6a47c2bbcdda1be673059a2eed16e700a710e32ce2fa67c9afd9b4
Instruction ID: 180d47d191b079c4de38bfffd8ad49dc2cea871e64a4e535c356fef6e14eddb3
Opcode Fuzzy Hash: d9cf3dd4be6a47c2bbcdda1be673059a2eed16e700a710e32ce2fa67c9afd9b4
Instruction Fuzzy Hash: 0DA26B706083419FD714DF18C484B6ABFE1BF89304F14896DE89A9B392D772EC85CB92

Function 0054676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00546766,?,?,00000008,?,?,0054FEFE,00000000), ref: 00546998

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3357750c0ab2e6af0b31174f06c12230542f54d63663b26414352bf51180f7f7
Instruction ID: e93db8e4fcc023ba353d75c78951ea72e99b9ec9bab419e8e81d22aa8d84caec
Opcode Fuzzy Hash: 3357750c0ab2e6af0b31174f06c12230542f54d63663b26414352bf51180f7f7
Instruction Fuzzy Hash: 22B15B31610609DFD719CF28C48ABA57FE0FF46368F258658E899CF2A2C335E991CB41

Function 0052B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0056851F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c29aeaa10a3b8757eb0b3a25c3dba397e8bdc29f2395b5372918fb1970a2307d
Instruction ID: 5c5ea13b49c66f16d1b63a57e8fba0a420e47a1751b90403a6d7de34746e4853
Opcode Fuzzy Hash: c29aeaa10a3b8757eb0b3a25c3dba397e8bdc29f2395b5372918fb1970a2307d
Instruction Fuzzy Hash: 06126F75A002299BDF14DF58D8806FEBBF5FF59310F14859AE849EB291DB309E81CB90

Function 0058EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0058EABD

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 29d3f5c5edae03487e1152dba985bcaef45ea37853529fdc6d3b2e9f4fc4aa5f
Instruction ID: e0f9a164f958f0ca17671cc39ec2c663608b09c8ba1b3d21dd89983a255078c8
Opcode Fuzzy Hash: 29d3f5c5edae03487e1152dba985bcaef45ea37853529fdc6d3b2e9f4fc4aa5f
Instruction Fuzzy Hash: EAE01A312002059FE710EF59D809E9ABFE9BF99760F008416FC49D7351DA70E8818B90

Function 005309D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,005303EE), ref: 005309DA

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b3f36f544b99d9c6b1559afa8afdcb790843ca92c1cb2ad20033261c2e6b4bd1
Instruction ID: 6731236b3270fc932bb6af9d12ce81b37ddfd2a7c636efd81943a63c572f10a7
Opcode Fuzzy Hash: b3f36f544b99d9c6b1559afa8afdcb790843ca92c1cb2ad20033261c2e6b4bd1
Instruction Fuzzy Hash:

Function 0053781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0053798B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: c72c856620d185eec990f30792e31fc344d2dd9885a31418fd5a459ee12330fe
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: EF516CF2E0C74E6BDB384568485E7BEAFC5BB5E340F180A49E982D7382C615DE01D355

Function 00582046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&^, xrefs: 00582053

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: 0&^
API String ID: 0-2485633877
Opcode ID: 5af71e68612727b4e5fa3f6dbadaf52ecfd76c5220cf684b171f7574932750c1
Instruction ID: efdc774adaccca72eb9060afdade9a38d72b28871f9316ceea658329a6bf2281
Opcode Fuzzy Hash: 5af71e68612727b4e5fa3f6dbadaf52ecfd76c5220cf684b171f7574932750c1
Instruction Fuzzy Hash: DE21D5326206518BDB2CCE79C82767A77E9B7A4310F14862EE4A7D73D0DE75A904DB80

Function 00546DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00957ae74aa333ff8c3dc43abd3739c771e98fcd8703cc6cbd7d3cb4f14d8e05
Instruction ID: 538f5619cd2a7d3531932885f1cc1bcf4285ae1ba0609ecf9c2ad259a2c2a61d
Opcode Fuzzy Hash: 00957ae74aa333ff8c3dc43abd3739c771e98fcd8703cc6cbd7d3cb4f14d8e05
Instruction Fuzzy Hash: 28324431D28F054EDB639634C8223756A8DAFBB3C9F15C737E81AB59A6EB28D4835100

Function 0052CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26b292e18e9a31aba765d270f4dac030bdf9532f4e90805d650d0f913a44ca5
Instruction ID: b4b2b6670b6a46d1a79ee37a0e1aa948a2e83be6d24b152ad9c1740506fc0e11
Opcode Fuzzy Hash: c26b292e18e9a31aba765d270f4dac030bdf9532f4e90805d650d0f913a44ca5
Instruction Fuzzy Hash: 1132F232A001658BDF28CE69D89467D7FA1FF46300F28856BD4EADB792D630DE81DB41

Function 00517920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df1b824fb751c9db15ead2e2fd79593689761ceeae5943f05296bfb10717a87
Instruction ID: 96dd3358aa9fc646125892e4841828c2d94547bf540d9603fff657cf00a5c39a
Opcode Fuzzy Hash: 3df1b824fb751c9db15ead2e2fd79593689761ceeae5943f05296bfb10717a87
Instruction Fuzzy Hash: 5A22B270A0460ADFEF14CF68D865AEEBBB5FF48301F10452AE816A7291FB35AD54CB50

Function 005191C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eefd29311bdfc5e2b1a939e7aa14834f950f7d5fe8fc793def21c9357b82f89
Instruction ID: 569ac9444a55ac1755b9f3dd5d1498b080e8181ff17d1e372d27061967790070
Opcode Fuzzy Hash: 7eefd29311bdfc5e2b1a939e7aa14834f950f7d5fe8fc793def21c9357b82f89
Instruction Fuzzy Hash: 5E02E8B1E00206EBDB05DF64D896AADBFB5FF44300F11856AE816DB291E731EE54CB81

Function 00549EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d3c448c2e139b22669b5166a571d3b3392011c7eb69f44aa409d58a05b9351
Instruction ID: 43689ecb61664e5e97fa1c94646beb450a6b8f5327d9f42c02463b4ded8d3e6b
Opcode Fuzzy Hash: c6d3c448c2e139b22669b5166a571d3b3392011c7eb69f44aa409d58a05b9351
Instruction Fuzzy Hash: 39B1F120D2AF404DD36396398831337BA8CAFBB2C5F91DB1BFC1674D22EB2295879140

Function 00537A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3209de6a0479d8c7121cce61d4ff15b729cf2cde7c9c6418e444edb62aa39ce3
Instruction ID: 50b5a69be44266dd7199e9a4bae3124cc82c5a7c218cc410244de98d72f1e9bc
Opcode Fuzzy Hash: 3209de6a0479d8c7121cce61d4ff15b729cf2cde7c9c6418e444edb62aa39ce3
Instruction Fuzzy Hash: 2F612AF1E0874E66DA785A2849B5BBEAFA4FF8D700F140D19F843DB281E6119E41C355

Function 00537CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d23281aacfac0db8e7e6f601fe87771f226220c8713d3e1c89d8b957484ce0d
Instruction ID: 7d8ec3ef7723152945fb120f14bb6e29f03ec609e5954a80949da84eca23569d
Opcode Fuzzy Hash: 1d23281aacfac0db8e7e6f601fe87771f226220c8713d3e1c89d8b957484ce0d
Instruction Fuzzy Hash: 0A6159F1E0870E66DE389A388895BBE2F98FF8E700F540D59F943DB281DA129D42D255

Function 00592ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00592B30
DeleteObject.GDI32(00000000), ref: 00592B43
DestroyWindow.USER32 ref: 00592B52
GetDesktopWindow.USER32 ref: 00592B6D
GetWindowRect.USER32(00000000), ref: 00592B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00592CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00592CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592CF8
GetClientRect.USER32(00000000,?), ref: 00592D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00592D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592DA8
GlobalFree.KERNEL32(00000000), ref: 00592DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,005AFC38,00000000), ref: 00592DDB
GlobalFree.KERNEL32(00000000), ref: 00592DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00592E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00592E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00592E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0059303F

Strings

DISPLAY, xrefs: 00592EA2
AutoIt v3, xrefs: 00592CF2
, xrefs: 00592FC5
static, xrefs: 00592D3A, 00592E91

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: a0d8ee3343bf5e662cf8efd1b1dad136db9ec5ae20eea3d995f91820ea175789
Instruction ID: a658e8566bcbc5b811fbe4d2704be4992c5475ad60fac345de20c93da84dea2f
Opcode Fuzzy Hash: a0d8ee3343bf5e662cf8efd1b1dad136db9ec5ae20eea3d995f91820ea175789
Instruction Fuzzy Hash: 75027A71A00209AFDB14DF68CC89EAE7FB9FF49310F008558F915AB2A1DB74AD45DB60

Function 005A70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 005A712F
GetSysColorBrush.USER32(0000000F), ref: 005A7160
GetSysColor.USER32(0000000F), ref: 005A716C
SetBkColor.GDI32(?,000000FF), ref: 005A7186
SelectObject.GDI32(?,?), ref: 005A7195
InflateRect.USER32(?,000000FF,000000FF), ref: 005A71C0
GetSysColor.USER32(00000010), ref: 005A71C8
CreateSolidBrush.GDI32(00000000), ref: 005A71CF
FrameRect.USER32(?,?,00000000), ref: 005A71DE
DeleteObject.GDI32(00000000), ref: 005A71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 005A7230
FillRect.USER32(?,?,?), ref: 005A7262
GetWindowLongW.USER32(?,000000F0), ref: 005A7284

Part of subcall function 005A73E8: GetSysColor.USER32(00000012), ref: 005A7421
Part of subcall function 005A73E8: SetTextColor.GDI32(?,?), ref: 005A7425
Part of subcall function 005A73E8: GetSysColorBrush.USER32(0000000F), ref: 005A743B
Part of subcall function 005A73E8: GetSysColor.USER32(0000000F), ref: 005A7446
Part of subcall function 005A73E8: GetSysColor.USER32(00000011), ref: 005A7463
Part of subcall function 005A73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 005A7471
Part of subcall function 005A73E8: SelectObject.GDI32(?,00000000), ref: 005A7482
Part of subcall function 005A73E8: SetBkColor.GDI32(?,00000000), ref: 005A748B
Part of subcall function 005A73E8: SelectObject.GDI32(?,?), ref: 005A7498
Part of subcall function 005A73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 005A74B7
Part of subcall function 005A73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005A74CE
Part of subcall function 005A73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 005A74DB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: e495c7623fa1525b9899bbbd19335958371dffef6ca14c58a27d130bded609a7
Instruction ID: 9e0bcbd9bb9c35c7f9045a8e5b9d3a3e4844c77660121f3b47190b4ba9668048
Opcode Fuzzy Hash: e495c7623fa1525b9899bbbd19335958371dffef6ca14c58a27d130bded609a7
Instruction Fuzzy Hash: 96A19C72508305AFDB009F60DC48A6FBFE9FF9E320F100A19FA62961A1D730E948DB51

Function 00592711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0059273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0059286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 005928A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 005928B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00592900
GetClientRect.USER32(00000000,?), ref: 0059290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00592955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00592964
GetStockObject.GDI32(00000011), ref: 00592974
SelectObject.GDI32(00000000,00000000), ref: 00592978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00592988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00592991
DeleteDC.GDI32(00000000), ref: 0059299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 005929C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 005929DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00592A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00592A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00592A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00592A77
GetStockObject.GDI32(00000011), ref: 00592A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00592A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00592A97

Strings

DISPLAY, xrefs: 0059295A
AutoIt v3, xrefs: 005928F8
static, xrefs: 0059294F, 00592A71
msctls_progress32, xrefs: 00592A13

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 2bd84887d2d0ebc291479d75db7d456c73165498930e3a0e3cd3a44019db8e54
Instruction ID: ea1cfc400f18c441bae5644aa6780bcb876581a182681f117f3de12bcfcece12
Opcode Fuzzy Hash: 2bd84887d2d0ebc291479d75db7d456c73165498930e3a0e3cd3a44019db8e54
Instruction Fuzzy Hash: 30B14A71A00219BFEB14DFA8CC89EAE7BA9FB59710F008515F915EB290D770AD44CBA4

Function 00584ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00584AED
GetDriveTypeW.KERNEL32(?,005ACB68,?,\\.\,005ACC08), ref: 00584BCA
SetErrorMode.KERNEL32(00000000,005ACB68,?,\\.\,005ACC08), ref: 00584D36

Strings

iSCSI, xrefs: 00584CC2
RAMDisk, xrefs: 00584BF4
SAS, xrefs: 00584CC9
SATA, xrefs: 00584CD0
CDROM, xrefs: 00584BFB
USB, xrefs: 00584CB4
ATA, xrefs: 00584C98
Network, xrefs: 00584C02
Fixed, xrefs: 00584C09
FileBackedVirtual, xrefs: 00584CEC
\\.\, xrefs: 00584B3F
Removable, xrefs: 00584C10, 00584C15
SSA, xrefs: 00584CA6
PhysicalDrive, xrefs: 00584B76
SSD, xrefs: 00584C4A
1394, xrefs: 00584C9F
Virtual, xrefs: 00584CE5
ATAPI, xrefs: 00584C91
RAID, xrefs: 00584CBB
Unknown, xrefs: 00584BED, 00584C83
MMC, xrefs: 00584CDE
Fibre, xrefs: 00584CAD
SCSI, xrefs: 00584C8A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 0f675184068f30a067ee6eb4d245cfc2c0f77a0779eb0a8264397a33c53efaf3
Instruction ID: a4fe4a10574a2f80bbe6cb3e0c7aae25122c1ee87098477094d33ddda477cca2
Opcode Fuzzy Hash: 0f675184068f30a067ee6eb4d245cfc2c0f77a0779eb0a8264397a33c53efaf3
Instruction Fuzzy Hash: 9F619F306052079BCB24FF28DA859A8BFB5BB44300B248817EC06BB391DB71ED42DF51

Function 005A73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 005A7421
SetTextColor.GDI32(?,?), ref: 005A7425
GetSysColorBrush.USER32(0000000F), ref: 005A743B
GetSysColor.USER32(0000000F), ref: 005A7446
CreateSolidBrush.GDI32(?), ref: 005A744B
GetSysColor.USER32(00000011), ref: 005A7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 005A7471
SelectObject.GDI32(?,00000000), ref: 005A7482
SetBkColor.GDI32(?,00000000), ref: 005A748B
SelectObject.GDI32(?,?), ref: 005A7498
InflateRect.USER32(?,000000FF,000000FF), ref: 005A74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005A74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 005A74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 005A752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 005A7554
InflateRect.USER32(?,000000FD,000000FD), ref: 005A7572
DrawFocusRect.USER32(?,?), ref: 005A757D
GetSysColor.USER32(00000011), ref: 005A758E
SetTextColor.GDI32(?,00000000), ref: 005A7596
DrawTextW.USER32(?,005A70F5,000000FF,?,00000000), ref: 005A75A8
SelectObject.GDI32(?,?), ref: 005A75BF
DeleteObject.GDI32(?), ref: 005A75CA
SelectObject.GDI32(?,?), ref: 005A75D0
DeleteObject.GDI32(?), ref: 005A75D5
SetTextColor.GDI32(?,?), ref: 005A75DB
SetBkColor.GDI32(?,?), ref: 005A75E5

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 9b5707a3c4ff48b5c4cf9c4dba9b8b1f77cc3c1142d4a5c4a50eb0c17a25add5
Instruction ID: fd6aa1b34001fde29dca1707c8de140ed363b044908c8989d770abc0267c3d0f
Opcode Fuzzy Hash: 9b5707a3c4ff48b5c4cf9c4dba9b8b1f77cc3c1142d4a5c4a50eb0c17a25add5
Instruction Fuzzy Hash: 19614A72D04218AFDF019FA4DC49AAEBFB9FF0E320F114525F915AB2A1D7749940DB90

Function 005A0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 005A1128
GetDesktopWindow.USER32 ref: 005A113D
GetWindowRect.USER32(00000000), ref: 005A1144
GetWindowLongW.USER32(?,000000F0), ref: 005A1199
DestroyWindow.USER32(?), ref: 005A11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 005A11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005A120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 005A121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 005A1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 005A1245
IsWindowVisible.USER32(00000000), ref: 005A12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 005A12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 005A12D0
GetWindowRect.USER32(00000000,?), ref: 005A12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 005A130E
GetMonitorInfoW.USER32(00000000,?), ref: 005A1328
CopyRect.USER32(?,?), ref: 005A133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 005A13AA

Strings

(, xrefs: 005A131B
tooltips_class32, xrefs: 005A11E6
0, xrefs: 005A10D3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 47b56bf184305f637032142a3dcff30c7487bbed3e454ac0d3ea40623ecda33c
Instruction ID: 198b70755214fe71dde5ade3987a4bcd251b9b3215ad0fd46f9e56ff55373691
Opcode Fuzzy Hash: 47b56bf184305f637032142a3dcff30c7487bbed3e454ac0d3ea40623ecda33c
Instruction Fuzzy Hash: D9B18E71608741AFE704DF64C888BAEBFE5FF89350F008919F9999B261D731E844CB95

Function 005A0241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005A02E5
_wcslen.LIBCMT ref: 005A031F
_wcslen.LIBCMT ref: 005A0389
_wcslen.LIBCMT ref: 005A03F1
_wcslen.LIBCMT ref: 005A0475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 005A04C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 005A0504

Part of subcall function 0052F9F2: _wcslen.LIBCMT ref: 0052F9FD

Part of subcall function 0057223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00572258
Part of subcall function 0057223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0057228A

Strings

VIEWCHANGE, xrefs: 005A0675
SELECT, xrefs: 005A0548
GETTEXT, xrefs: 005A03EC, 005A0407
GETSELECTEDCOUNT, xrefs: 005A0470, 005A048B
SELECTINVERT, xrefs: 005A057E
SELECTALL, xrefs: 005A0515
SELECTCLEAR, xrefs: 005A052D
GETSUBITEMCOUNT, xrefs: 005A0384, 005A039F
ISSELECTED, xrefs: 005A04DD
GETITEMCOUNT, xrefs: 005A0316, 005A0337
FINDITEM, xrefs: 005A0627
GETSELECTED, xrefs: 005A05E1
DESELECT, xrefs: 005A059C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 1fc21833fdea75421d92454de0b502d47e6d84d947715c964c0f38413dedc1f7
Instruction ID: 984c2dfb9d2ae1228b1a1d95e6a528d2329a0da863f49a3b135384f9c8660dd6
Opcode Fuzzy Hash: 1fc21833fdea75421d92454de0b502d47e6d84d947715c964c0f38413dedc1f7
Instruction Fuzzy Hash: F2E1AE312282019FCB14DF28C45496EBBE2BFCA314F14496DF8969B3A1EB30ED45CB91

Function 00528891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00528968
GetSystemMetrics.USER32(00000007), ref: 00528970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0052899B
GetSystemMetrics.USER32(00000008), ref: 005289A3
GetSystemMetrics.USER32(00000004), ref: 005289C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 005289E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 005289F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00528A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00528A3C
GetClientRect.USER32(00000000,000000FF), ref: 00528A5A
GetStockObject.GDI32(00000011), ref: 00528A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00528A81

Part of subcall function 0052912D: GetCursorPos.USER32(?), ref: 00529141
Part of subcall function 0052912D: ScreenToClient.USER32(00000000,?), ref: 0052915E
Part of subcall function 0052912D: GetAsyncKeyState.USER32(00000001), ref: 00529183
Part of subcall function 0052912D: GetAsyncKeyState.USER32(00000002), ref: 0052919D

SetTimer.USER32(00000000,00000000,00000028,005290FC), ref: 00528AA8

Strings

AutoIt v3 GUI, xrefs: 00528A20

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: d5d970c422ca8c4c55f010799f74d9583bce0dcc5143c72287e03b715905b41b
Instruction ID: a49518bc8308b6110373f55120e4a08c53023691890e86ad0f41bf4d57921c7d
Opcode Fuzzy Hash: d5d970c422ca8c4c55f010799f74d9583bce0dcc5143c72287e03b715905b41b
Instruction Fuzzy Hash: AAB17971A0021A9FDB14DFA8DD89BAE7FB5FB49314F104229FA15EB2D0DB30A840DB55

Function 00570D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005710F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00571114
Part of subcall function 005710F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00570B9B,?,?,?), ref: 00571120
Part of subcall function 005710F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00570B9B,?,?,?), ref: 0057112F
Part of subcall function 005710F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00570B9B,?,?,?), ref: 00571136
Part of subcall function 005710F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0057114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00570DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00570E29
GetLengthSid.ADVAPI32(?), ref: 00570E40
GetAce.ADVAPI32(?,00000000,?), ref: 00570E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00570E96
GetLengthSid.ADVAPI32(?), ref: 00570EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00570EB5
HeapAlloc.KERNEL32(00000000), ref: 00570EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00570EDD
CopySid.ADVAPI32(00000000), ref: 00570EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00570F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00570F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00570F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00570F6E
HeapFree.KERNEL32(00000000), ref: 00570F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00570F7E
HeapFree.KERNEL32(00000000), ref: 00570F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00570F8E
HeapFree.KERNEL32(00000000), ref: 00570F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00570FA1
HeapFree.KERNEL32(00000000), ref: 00570FA8

Part of subcall function 00571193: GetProcessHeap.KERNEL32(00000008,00570BB1,?,00000000,?,00570BB1,?), ref: 005711A1
Part of subcall function 00571193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00570BB1,?), ref: 005711A8
Part of subcall function 00571193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00570BB1,?), ref: 005711B7

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: bea69d52af77047b49f5a6392c53582e99e784c421afece7c01ef645d96fe983
Instruction ID: 94147933d3616d56b47a737123f6dcf21e42dfbca505811c516e75b67ece4b5c
Opcode Fuzzy Hash: bea69d52af77047b49f5a6392c53582e99e784c421afece7c01ef645d96fe983
Instruction Fuzzy Hash: 20714B72A0020AEBDF20DFA5EC48BAEBFB8BF15310F148115F919A6191D7719A09DB60

Function 0059C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0059C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,005ACC08,00000000,?,00000000,?,?), ref: 0059C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0059C5A4
_wcslen.LIBCMT ref: 0059C5F4
_wcslen.LIBCMT ref: 0059C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0059C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0059C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0059C84D
RegCloseKey.ADVAPI32(?), ref: 0059C881
RegCloseKey.ADVAPI32(00000000), ref: 0059C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0059C960

Strings

REG_EXPAND_SZ, xrefs: 0059C5CD
REG_BINARY, xrefs: 0059C913
REG_MULTI_SZ, xrefs: 0059C6F5
REG_DWORD, xrefs: 0059C804
REG_SZ, xrefs: 0059C644
REG_QWORD, xrefs: 0059C8C3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: ecd562a3499526a69a0238dd3215be9ca8ecb7fcacc5067f09f87d8eadb11a20
Instruction ID: 65d6091ea8e7ebefa0a227b30dc96ce80afb7bf4a83d511ccdbefd82c9d558a1
Opcode Fuzzy Hash: ecd562a3499526a69a0238dd3215be9ca8ecb7fcacc5067f09f87d8eadb11a20
Instruction Fuzzy Hash: 891248356042029FDB14DF18C895A6ABFE5FF88714F05885DF85A9B3A2DB31ED81CB81

Function 005A091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005A09C6
_wcslen.LIBCMT ref: 005A0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 005A0A54
_wcslen.LIBCMT ref: 005A0A8A
_wcslen.LIBCMT ref: 005A0B06
_wcslen.LIBCMT ref: 005A0B81

Part of subcall function 0052F9F2: _wcslen.LIBCMT ref: 0052F9FD

Part of subcall function 00572BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00572BFA

Strings

UNCHECK, xrefs: 005A0D3E
GETTOTALCOUNT, xrefs: 005A09F2, 005A0A17
SELECT, xrefs: 005A0D11
GETTEXT, xrefs: 005A0C97
EXISTS, xrefs: 005A0B7C, 005A0B97
COLLAPSE, xrefs: 005A0B01, 005A0B1C
CHECK, xrefs: 005A0A85, 005A0AA0
GETITEMCOUNT, xrefs: 005A0C1E
GETSELECTED, xrefs: 005A0C4E
ISCHECKED, xrefs: 005A0CE1
EXPAND, xrefs: 005A0BF8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 183a11114ebdba956d1e227a35ebcf89a2938ea692ca679c3ecc26221646e1a4
Instruction ID: 0b84ee3c1e562423bf36c7d2a3e3ff1fe8f90e3f4bb890a435a2b89ac42ce134
Opcode Fuzzy Hash: 183a11114ebdba956d1e227a35ebcf89a2938ea692ca679c3ecc26221646e1a4
Instruction Fuzzy Hash: 0EE17A312183069FC714DF28C45096EBBE2BF9A314F14895DF8969B3A2D731ED85CB91

Function 0059C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0059B6AE,?,?), ref: 0059C9B5
_wcslen.LIBCMT ref: 0059C9F1
_wcslen.LIBCMT ref: 0059CA68
_wcslen.LIBCMT ref: 0059CA9E
_wcslen.LIBCMT ref: 0059CAF9
_wcslen.LIBCMT ref: 0059CB2F
_wcslen.LIBCMT ref: 0059CB7F

Strings

HKCC, xrefs: 0059CBAC
HKU, xrefs: 0059CBF0
HKCR, xrefs: 0059CB29, 0059CB2E
HKEY_USERS, xrefs: 0059CBDF
HKLM, xrefs: 0059CA98, 0059CA9D
HKEY_CURRENT_USER, xrefs: 0059CBBD
HKCU, xrefs: 0059CBCE
HKEY_CLASSES_ROOT, xrefs: 0059CAF3, 0059CAF8
HKEY_LOCAL_MACHINE, xrefs: 0059CA62, 0059CA67
HKEY_CURRENT_CONFIG, xrefs: 0059CB79, 0059CB7E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 127438a9f410792700a45c4835133499e74ab092614900d6fa17821f88732fa9
Instruction ID: eaf357bb85fa78da58079f1accf41328e4737ca79a2a4b9a844b8bb73652b882
Opcode Fuzzy Hash: 127438a9f410792700a45c4835133499e74ab092614900d6fa17821f88732fa9
Instruction Fuzzy Hash: 5D71E23260016B8BCF20DE7CC9515BE3FA2BFA5764F650529F8669B284E635CD84C7A0

Function 005A833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005A835A
_wcslen.LIBCMT ref: 005A836E
_wcslen.LIBCMT ref: 005A8391
_wcslen.LIBCMT ref: 005A83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 005A83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,005A5BF2), ref: 005A844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 005A8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 005A84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 005A8501
FreeLibrary.KERNEL32(?), ref: 005A850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 005A851D
DestroyIcon.USER32(?,?,?,?,?,005A5BF2), ref: 005A852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 005A8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 005A8555

Strings

.dll, xrefs: 005A83AB
.icl, xrefs: 005A8368
.exe, xrefs: 005A8388

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 8dcef1b7d0d98209c2095154804ca46b79036a4fbb0d84f637fee62daa3745be
Instruction ID: 4000e39377e1ed38495077e0679b0884a2ba5d4673d1438b79dc369000e5dc70
Opcode Fuzzy Hash: 8dcef1b7d0d98209c2095154804ca46b79036a4fbb0d84f637fee62daa3745be
Instruction Fuzzy Hash: 9F61E07190020ABFEB14DF64CC45BBE7FA8FB49721F10450AF815DA1D1EB74A980DBA0

Function 00517778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#OnAutoItStartRegister, xrefs: 00517817
#ce, xrefs: 005178ED
#requireadmin, xrefs: 005177FF
#notrayicon, xrefs: 005177E7
#cs, xrefs: 00517873, 005178C5
Bad directive syntax error, xrefs: 0055519A
', xrefs: 00555169
#include-once, xrefs: 0051782F
#comments-end, xrefs: 005178D9
Unterminated group of comments, xrefs: 0055528C
#pragma compile, xrefs: 005177D3
", xrefs: 00555153
Cannot parse #include, xrefs: 00555279
#comments-start, xrefs: 0051785F, 005178B1
#include, xrefs: 00517847

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 23e1185765fcdb0110c6cddf5a56448abe5d3fa94c39c3b78a9f952bdc06ed47
Instruction ID: 8b0ea2b4074395fc69489bc7cb3bfefd18196bf34bccab275f2d21d2cdcfb67c
Opcode Fuzzy Hash: 23e1185765fcdb0110c6cddf5a56448abe5d3fa94c39c3b78a9f952bdc06ed47
Instruction Fuzzy Hash: 5B81E67160460ABBEB20AF64DC56FEE3F78FF59300F044025F905AA192EB70D985D7A1

Function 00583E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00583EF8
_wcslen.LIBCMT ref: 00583F03
_wcslen.LIBCMT ref: 00583F5A
_wcslen.LIBCMT ref: 00583F98
GetDriveTypeW.KERNEL32(?), ref: 00583FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0058401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00584059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00584087

Strings

wait, xrefs: 00584044
close cd wait, xrefs: 00584072
type cdaudio alias cd wait, xrefs: 00584001
set cd door , xrefs: 00584028
open , xrefs: 00583FE5
open, xrefs: 00583F54, 00583F59
close, xrefs: 00583EFE, 00583F18
closed, xrefs: 00583F08, 00583F2D, 00583F46, 00583F7E, 00583F97

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: b85a5ea33abb4c7150b880d2cbb4294d5dc32ddfa338ffaf67ef83e1cd37357b
Instruction ID: 215ecb3d53d929f388a7880e06f5c80c20b296177a816379dafcab293c2bd361
Opcode Fuzzy Hash: b85a5ea33abb4c7150b880d2cbb4294d5dc32ddfa338ffaf67ef83e1cd37357b
Instruction Fuzzy Hash: A97190316042029FD310EF24C8859AABFE4FF94754F10492EF995A7261EB35ED46CB91

Function 00575A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00575A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00575A40
SetWindowTextW.USER32(?,?), ref: 00575A57
GetDlgItem.USER32(?,000003EA), ref: 00575A6C
SetWindowTextW.USER32(00000000,?), ref: 00575A72
GetDlgItem.USER32(?,000003E9), ref: 00575A82
SetWindowTextW.USER32(00000000,?), ref: 00575A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00575AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00575AC3
GetWindowRect.USER32(?,?), ref: 00575ACC
_wcslen.LIBCMT ref: 00575B33
SetWindowTextW.USER32(?,?), ref: 00575B6F
GetDesktopWindow.USER32 ref: 00575B75
GetWindowRect.USER32(00000000), ref: 00575B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00575BD3
GetClientRect.USER32(?,?), ref: 00575BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00575C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00575C2F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 30612cc84018b78f48cf7f01230e89490f7eba844d435360fa553fc67054d6f2
Instruction ID: f717d6a50677cd11ac83ddbc175e8d267dfc15700b27c56e0b97a4f71b2ac2ed
Opcode Fuzzy Hash: 30612cc84018b78f48cf7f01230e89490f7eba844d435360fa553fc67054d6f2
Instruction Fuzzy Hash: B0717F31900B059FDB20DFA8DE85A6EBFF5FF48705F104918E18AA35A0E7B4E944DB50

Function 0058FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0058FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0058FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0058FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0058FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0058FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0058FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0058FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0058FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0058FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0058FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0058FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0058FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0058FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0058FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0058FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0058FECC
GetCursorInfo.USER32(?), ref: 0058FEDC
GetLastError.KERNEL32 ref: 0058FF1E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: bf5abb4dc0c1c5e019b0050a9ba05f14132099d8eb08f8e80cf2cdbd0d21cbc3
Instruction ID: d66161c3e5ed8d12d18b654362200d09650603ace43a04255dd92a3fcf9e320b
Opcode Fuzzy Hash: bf5abb4dc0c1c5e019b0050a9ba05f14132099d8eb08f8e80cf2cdbd0d21cbc3
Instruction Fuzzy Hash: 274151B0D443196ADB109FBA8C8985EBFE8FF08354B50452AE519E7281DB78A9018F91

Function 005730F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0057318D
_wcslen.LIBCMT ref: 005731F8

Strings

TEXT, xrefs: 0057347C
[], xrefs: 0057339A
INSTANCE, xrefs: 00573453
NAME, xrefs: 00573335, 00573346
REGEXPCLASS, xrefs: 00573255, 00573266
CLASS, xrefs: 00573188, 005731A5
CLASSNN, xrefs: 005731F3, 00573204

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[]
API String ID: 176396367-4125391415
Opcode ID: c85ac22828e6aa4ecbafa830eb0d43ad4ccbc1c81dd54fbe0dc067889a816da8
Instruction ID: 4fce7546877220f89ca9fbb137fdb8872f5243ea5fc453e8c3f1c017bfd1431e
Opcode Fuzzy Hash: c85ac22828e6aa4ecbafa830eb0d43ad4ccbc1c81dd54fbe0dc067889a816da8
Instruction Fuzzy Hash: FCE1E732A00516ABCF28DF78D4556EDBFB1BF44720F54C52AE45AA7240EB30AE85F790

Function 005300C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 005300C6

Part of subcall function 005300ED: InitializeCriticalSectionAndSpinCount.KERNEL32(005E070C,00000FA0,1263CB2F,?,?,?,?,005523B3,000000FF), ref: 0053011C
Part of subcall function 005300ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,005523B3,000000FF), ref: 00530127
Part of subcall function 005300ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,005523B3,000000FF), ref: 00530138
Part of subcall function 005300ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0053014E
Part of subcall function 005300ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0053015C
Part of subcall function 005300ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0053016A
Part of subcall function 005300ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00530195
Part of subcall function 005300ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 005301A0

___scrt_fastfail.LIBCMT ref: 005300E7

Part of subcall function 005300A3: __onexit.LIBCMT ref: 005300A9

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00530122
kernel32.dll, xrefs: 00530133
InitializeConditionVariable, xrefs: 00530148
SleepConditionVariableCS, xrefs: 00530154
WakeAllConditionVariable, xrefs: 00530162

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 7b9d8a64aef4c36090ce989931249560b62d120c9820ec9e071151759eed3783
Instruction ID: 2b027beda6b6cd48bbc23366fbf28800fc68745221f96054de72aafd0fca023f
Opcode Fuzzy Hash: 7b9d8a64aef4c36090ce989931249560b62d120c9820ec9e071151759eed3783
Instruction Fuzzy Hash: 63212632A407116BE7256BA4BC59B2E7FE8FB56B61F00113AF801E72D1DBB09C04DB90

Function 005844C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,005ACC08), ref: 00584527
_wcslen.LIBCMT ref: 0058453B
_wcslen.LIBCMT ref: 00584599
_wcslen.LIBCMT ref: 005845F4
_wcslen.LIBCMT ref: 0058463F
_wcslen.LIBCMT ref: 005846A7

Part of subcall function 0052F9F2: _wcslen.LIBCMT ref: 0052F9FD

GetDriveTypeW.KERNEL32(?,005D6BF0,00000061), ref: 00584743

Strings

cdrom, xrefs: 0058458F, 00584594
network, xrefs: 0058469D, 005846A2
ramdisk, xrefs: 005846F1
removable, xrefs: 005845EA, 005845EF
fixed, xrefs: 00584635, 0058463A
all, xrefs: 00584531, 00584536
unknown, xrefs: 00584708

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 045060e17fed9ee865c530bf999c969e4fb017f404a13b153530e7888972d2fe
Instruction ID: 52e427e6f0860e730395d9f9e12390ecf223d89397b3e5b1e8fc89aba3b4b925
Opcode Fuzzy Hash: 045060e17fed9ee865c530bf999c969e4fb017f404a13b153530e7888972d2fe
Instruction Fuzzy Hash: F2B19D316083039BC710EF28C894A6EBBE5BFA5764F50491DF896E7291E730D985CB92

Function 005A911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00529BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00529BB2

DragQueryPoint.SHELL32(?,?), ref: 005A9147

Part of subcall function 005A7674: ClientToScreen.USER32(?,?), ref: 005A769A
Part of subcall function 005A7674: GetWindowRect.USER32(?,?), ref: 005A7710
Part of subcall function 005A7674: PtInRect.USER32(?,?,005A8B89), ref: 005A7720

SendMessageW.USER32(?,000000B0,?,?), ref: 005A91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 005A91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 005A91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 005A9225
SendMessageW.USER32(?,000000B0,?,?), ref: 005A923E
SendMessageW.USER32(?,000000B1,?,?), ref: 005A9255
SendMessageW.USER32(?,000000B1,?,?), ref: 005A9277
DragFinish.SHELL32(?), ref: 005A927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 005A9371

Strings

p#^, xrefs: 005A92BB
@GUI_DRAGID, xrefs: 005A92E9
@GUI_DRAGFILE, xrefs: 005A9320
@GUI_DROPID, xrefs: 005A929E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#^
API String ID: 221274066-4237971630
Opcode ID: 5f30679c007cdd16b1e8693ff721ccc44b44fe8e2f45fe8d13d713b40d4e05dc
Instruction ID: b3122728a10f91d5f26426d0b86c766d0ab4d7bea99136e93a8158366580abd7
Opcode Fuzzy Hash: 5f30679c007cdd16b1e8693ff721ccc44b44fe8e2f45fe8d13d713b40d4e05dc
Instruction Fuzzy Hash: 3F613771108302AFD701DF54D889DAFBFE8FFD9750F00091AB595962A1DB309A49CB92

Function 0051326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(005E1990), ref: 00552F8D
GetMenuItemCount.USER32(005E1990), ref: 0055303D
GetCursorPos.USER32(?), ref: 00553081
SetForegroundWindow.USER32(00000000), ref: 0055308A
TrackPopupMenuEx.USER32(005E1990,00000000,?,00000000,00000000,00000000), ref: 0055309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005530A9

Strings

0, xrefs: 0051327D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: d7c98a3af3ab0c9bd6df4104012c2c044a401c71312918d80e350a9417940001
Instruction ID: af02a0ea856ff7407d1511b743f0a84c1853f589062e0e377b662b911064c1d2
Opcode Fuzzy Hash: d7c98a3af3ab0c9bd6df4104012c2c044a401c71312918d80e350a9417940001
Instruction Fuzzy Hash: 59710C30640206BEFB259F64DC99FAABF68FF06364F204216F9256A1E0C7B1AD54D750

Function 005A6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 005A6DEB

Part of subcall function 00516B57: _wcslen.LIBCMT ref: 00516B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 005A6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 005A6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005A6E94
DestroyWindow.USER32(?), ref: 005A6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00510000,00000000), ref: 005A6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005A6EFD
GetDesktopWindow.USER32 ref: 005A6F16
GetWindowRect.USER32(00000000), ref: 005A6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 005A6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 005A6F4D

Part of subcall function 00529944: GetWindowLongW.USER32(?,000000EB), ref: 00529952

Strings

tooltips_class32, xrefs: 005A6E58, 005A6EDD
0, xrefs: 005A6D98

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 506a175e713a4fc56172da299d6a9a383f13efea5092c41f58e99756c52f6758
Instruction ID: 3203997087ab0fa708173287b07fd1d54867da02243f37f160fb88a70989983f
Opcode Fuzzy Hash: 506a175e713a4fc56172da299d6a9a383f13efea5092c41f58e99756c52f6758
Instruction Fuzzy Hash: 92715B74144245AFDB25CF18DC84FABBFE9FB9A304F08041DF9998B2A1C770A949DB15

Function 0058C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0058C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0058C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0058C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0058C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0058C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0058C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0058C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0058C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0058C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0058C5F0
InternetCloseHandle.WININET(00000000), ref: 0058C5FB

Strings

, xrefs: 0058C575

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 0de946ff81234d531bb964b90ed3ced2c8a42ee93e6055016db4283a3cf7c6ac
Instruction ID: 2b1830867d0f22beec1514f2e3adb9b94de766b10f3f2ae826bf00e9bb3cd1cd
Opcode Fuzzy Hash: 0de946ff81234d531bb964b90ed3ced2c8a42ee93e6055016db4283a3cf7c6ac
Instruction Fuzzy Hash: 4F515DB1500205BFEB21AF64C948ABB7FFCFF19754F00441AF945A6210DB34E948AB70

Function 005A856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 005A8592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 005A85A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 005A85AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 005A85BA
GlobalLock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 005A85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 005A85D7
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 005A85E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 005A85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 005A85F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,005AFC38,?), ref: 005A8611
GlobalFree.KERNEL32(00000000), ref: 005A8621
GetObjectW.GDI32(?,00000018,?), ref: 005A8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 005A8671
DeleteObject.GDI32(?), ref: 005A8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 005A86AF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: c142638163b670bec78de0c767baafebf5741859c793f1e3d40871ee5266ff19
Instruction ID: 5f37d3b040e4651022a9867580da52e8007f0476a1de009eac8babf7375f861b
Opcode Fuzzy Hash: c142638163b670bec78de0c767baafebf5741859c793f1e3d40871ee5266ff19
Instruction Fuzzy Hash: 9E41E675600208BFDB119FA5DC48EAE7FB8FF9AB11F144059F905EB260DB309905DB60

Function 005814BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00581502
VariantCopy.OLEAUT32(?,?), ref: 0058150B
VariantClear.OLEAUT32(?), ref: 00581517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 005815FB
VarR8FromDec.OLEAUT32(?,?), ref: 00581657
VariantInit.OLEAUT32(?), ref: 00581708
SysFreeString.OLEAUT32(?), ref: 0058178C
VariantClear.OLEAUT32(?), ref: 005817D8
VariantClear.OLEAUT32(?), ref: 005817E7
VariantInit.OLEAUT32(00000000), ref: 00581823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00581625
Default, xrefs: 005816AF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 9a3d38d32e5b81ba8e8486362f8bbeb01862d5c81780f4cca55b6c5f0e73332a
Instruction ID: 980ad9e6b04b45b22e0d3514e6d0f2b74c22002dd6da3711dbea11301e905e12
Opcode Fuzzy Hash: 9a3d38d32e5b81ba8e8486362f8bbeb01862d5c81780f4cca55b6c5f0e73332a
Instruction Fuzzy Hash: 4BD1E271A00916DBDB10AF65E889B7DBFB9BF86700F10846AE846BB180DB30DC46DF55

Function 0059B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 0059C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0059B6AE,?,?), ref: 0059C9B5
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059C9F1
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059CA68
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0059B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0059B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0059B80A
RegCloseKey.ADVAPI32(?), ref: 0059B87E
RegCloseKey.ADVAPI32(?), ref: 0059B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0059B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0059B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0059B922
FreeLibrary.KERNEL32(00000000), ref: 0059B983
RegCloseKey.ADVAPI32(00000000), ref: 0059B994

Strings

advapi32.dll, xrefs: 0059B8ED
RegDeleteKeyExW, xrefs: 0059B8FE

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 6a1a88d45215d4979a5948132567b1484d54f2d3b5c5c73003281dc6ee59eb80
Instruction ID: 4ec804f3d070aa3baf3fd6b8bd418a48a303274b3022ac858df8b860c9b2d091
Opcode Fuzzy Hash: 6a1a88d45215d4979a5948132567b1484d54f2d3b5c5c73003281dc6ee59eb80
Instruction Fuzzy Hash: B9C17D30204202AFEB10DF14D599F6ABFE5FF84308F14855CE59A4B2A2CB75ED86CB91

Function 0059255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005925D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 005925E8
CreateCompatibleDC.GDI32(?), ref: 005925F4
SelectObject.GDI32(00000000,?), ref: 00592601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0059266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 005926AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 005926D0
SelectObject.GDI32(?,?), ref: 005926D8
DeleteObject.GDI32(?), ref: 005926E1
DeleteDC.GDI32(?), ref: 005926E8
ReleaseDC.USER32(00000000,?), ref: 005926F3

Strings

(, xrefs: 0059268D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 1e24d5a985a67cc51925da6848fca18dfbfd742e92b5dd8da6330ac857f3c179
Instruction ID: 3c1a2fd0e8e0f01e1f23edcf63cf8a97ac779e41231635b2ac480e4f37ea9cc5
Opcode Fuzzy Hash: 1e24d5a985a67cc51925da6848fca18dfbfd742e92b5dd8da6330ac857f3c179
Instruction Fuzzy Hash: A061D275E00219EFCF05CFA8D988AAEBBF5FF58310F208529E956A7250D770A941DF90

Function 0054DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0054DAA1

Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D659
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D66B
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D67D
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D68F
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D6A1
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D6B3
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D6C5
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D6D7
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D6E9
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D6FB
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D70D
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D71F
Part of subcall function 0054D63C: _free.LIBCMT ref: 0054D731

_free.LIBCMT ref: 0054DA96

Part of subcall function 005429C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000), ref: 005429DE
Part of subcall function 005429C8: GetLastError.KERNEL32(00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000,00000000), ref: 005429F0

_free.LIBCMT ref: 0054DAB8
_free.LIBCMT ref: 0054DACD
_free.LIBCMT ref: 0054DAD8
_free.LIBCMT ref: 0054DAFA
_free.LIBCMT ref: 0054DB0D
_free.LIBCMT ref: 0054DB1B
_free.LIBCMT ref: 0054DB26
_free.LIBCMT ref: 0054DB5E
_free.LIBCMT ref: 0054DB65
_free.LIBCMT ref: 0054DB82
_free.LIBCMT ref: 0054DB9A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b3ae0baad26f4e2af38f5549d0badfd1301e6b9d7241c27b315384a19c02709b
Instruction ID: 2d6e3b6f5a3c5c42a1fc12d99973f5fba1c2b25e96e381818fc4bf4e6d23e272
Opcode Fuzzy Hash: b3ae0baad26f4e2af38f5549d0badfd1301e6b9d7241c27b315384a19c02709b
Instruction Fuzzy Hash: 28312A316046069FEB22AA3AE849BDA7FF9FF40318F55441AF449D7291DA35AC80CB30

Function 0057365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0057369C
_wcslen.LIBCMT ref: 005736A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00573797
GetClassNameW.USER32(?,?,00000400), ref: 0057380C
GetDlgCtrlID.USER32(?), ref: 0057385D
GetWindowRect.USER32(?,?), ref: 00573882
GetParent.USER32(?), ref: 005738A0
ScreenToClient.USER32(00000000), ref: 005738A7
GetClassNameW.USER32(?,?,00000100), ref: 00573921
GetWindowTextW.USER32(?,?,00000400), ref: 0057395D

Strings

%s%u, xrefs: 00573734

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: b091d4a713847a398f5cf6878d371f3e932a002880d4072c36217f3b55f70b25
Instruction ID: 317b7c397bd0880e0e8153a9bc3f02a8e07af5eaf326be7df6a93a3a6328cd43
Opcode Fuzzy Hash: b091d4a713847a398f5cf6878d371f3e932a002880d4072c36217f3b55f70b25
Instruction Fuzzy Hash: D991B371204617AFD718DF24D885BAABFA8FF44360F008529FA9DD2190DB30EA45EB91

Function 00574954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00574994
GetWindowTextW.USER32(?,?,00000400), ref: 005749DA
_wcslen.LIBCMT ref: 005749EB
CharUpperBuffW.USER32(?,00000000), ref: 005749F7
_wcsstr.LIBVCRUNTIME ref: 00574A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00574A64
GetWindowTextW.USER32(?,?,00000400), ref: 00574A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00574AE6
GetClassNameW.USER32(?,?,00000400), ref: 00574B20
GetWindowRect.USER32(?,?), ref: 00574B8B

Strings

ThumbnailClass, xrefs: 00574A6F, 00574AF1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 42d577b76fd0bda4483f780d65c0f34e8e3a9897fe1e0805741d6af090705f48
Instruction ID: 6862e355f64ae1b0f7a1f9936421b4d5cbe64e2ad6600e7fc6a1b810eebfb31d
Opcode Fuzzy Hash: 42d577b76fd0bda4483f780d65c0f34e8e3a9897fe1e0805741d6af090705f48
Instruction Fuzzy Hash: D891AA310042069FDB05DF14E985BAABFE9FF84314F04846AFD899A096EB30ED45DFA1

Function 005A8D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00529BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00529BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 005A8D5A
GetFocus.USER32 ref: 005A8D6A
GetDlgCtrlID.USER32(00000000), ref: 005A8D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 005A8E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 005A8ECF
GetMenuItemCount.USER32(?), ref: 005A8EEC
GetMenuItemID.USER32(?,00000000), ref: 005A8EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 005A8F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 005A8F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 005A8FA1

Strings

0, xrefs: 005A8E9F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 500fa033b1135057109fd9e57d6f91e4c9d9a3d3fcbf8c43207ba964e9f4ea5a
Instruction ID: fbe2605fa42ec8feb1f36669579a9faec27f22c9a864aecfae981815a84f2d8a
Opcode Fuzzy Hash: 500fa033b1135057109fd9e57d6f91e4c9d9a3d3fcbf8c43207ba964e9f4ea5a
Instruction Fuzzy Hash: 25818C71508302AFDB20CF24D888ABFBFE9FB9A354F140919F98597291DB70D905DBA1

Function 0057BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(005E1990,000000FF,00000000,00000030), ref: 0057BFAC
SetMenuItemInfoW.USER32(005E1990,00000004,00000000,00000030), ref: 0057BFE1
Sleep.KERNEL32(000001F4), ref: 0057BFF3
GetMenuItemCount.USER32(?), ref: 0057C039
GetMenuItemID.USER32(?,00000000), ref: 0057C056
GetMenuItemID.USER32(?,-00000001), ref: 0057C082
GetMenuItemID.USER32(?,?), ref: 0057C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0057C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0057C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0057C145

Strings

0, xrefs: 0057BF3D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 74c2557899bf48506f8ae4ad6ef4ca7878785fda12a049f53414c2e304d0391b
Instruction ID: 0d42eaf77828a8b02cc286e80f402a9392508cd0b112288fca6330b16e803765
Opcode Fuzzy Hash: 74c2557899bf48506f8ae4ad6ef4ca7878785fda12a049f53414c2e304d0391b
Instruction Fuzzy Hash: 8E6180B0900246AFDF15CF64EC8CAEE7FA8FB45344F408469F859A7291D735AD05EBA0

Function 0057DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0057DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0057DC46
_wcslen.LIBCMT ref: 0057DC50
_wcsstr.LIBVCRUNTIME ref: 0057DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0057DCBC

Strings

%u.%u.%u.%u, xrefs: 0057DD9A
DefaultLangCodepage, xrefs: 0057DD1F
StringFileInfo\, xrefs: 0057DC8F
\VarFileInfo\Translation, xrefs: 0057DCB4
04090000, xrefs: 0057DCF2

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: fc23e9d0f824a201ba731f8511ce10d879f49e5f49702a08dfebba96a41e5c1e
Instruction ID: a6a3614565d9b517705589f2814310146a26f822746f02c13d5b7f649d69489c
Opcode Fuzzy Hash: fc23e9d0f824a201ba731f8511ce10d879f49e5f49702a08dfebba96a41e5c1e
Instruction Fuzzy Hash: 454136729402167ADB15A774AC4BEBF7FBCFF92710F10406AF904A6182EB719901A7B4

Function 0059CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0059CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0059CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0059CD48

Part of subcall function 0059CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0059CCAA
Part of subcall function 0059CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0059CCBD
Part of subcall function 0059CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0059CCCF
Part of subcall function 0059CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0059CD05
Part of subcall function 0059CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0059CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0059CCF3

Strings

advapi32.dll, xrefs: 0059CCB8
RegDeleteKeyExW, xrefs: 0059CCC9

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: a64dd6b452da4cc87a53810dfd57076986f40d08d64c7ba6537ffcaba2ffda7f
Instruction ID: 76449b2b1065bb2c4135b0473957e9dec6189acc7770e4949f094441577c5f4f
Opcode Fuzzy Hash: a64dd6b452da4cc87a53810dfd57076986f40d08d64c7ba6537ffcaba2ffda7f
Instruction Fuzzy Hash: 94316E71A41229BBDB208B54DC88EFFBFBCFF56750F000165E905E6240DB349E49EAA0

Function 00583D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00583D40
_wcslen.LIBCMT ref: 00583D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00583D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00583DBE
RemoveDirectoryW.KERNEL32(?), ref: 00583DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00583E55
CloseHandle.KERNEL32(00000000), ref: 00583E60
CloseHandle.KERNEL32(00000000), ref: 00583E6B

Strings

\??\%s, xrefs: 00583D5B
\, xrefs: 00583D77
:, xrefs: 00583D82

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: c9c863edca603b7c2968325ee53bb6d66d8035e646f3831242a5d39890c550c9
Instruction ID: 9c2d64e5f8216587f0489e833cde29f80c4912b085c2dabc9663322792831530
Opcode Fuzzy Hash: c9c863edca603b7c2968325ee53bb6d66d8035e646f3831242a5d39890c550c9
Instruction Fuzzy Hash: 7D31967550011A6BDB21ABA0DC49FEF3BBCFF89B40F1041B6F905E6150EB7497458B24

Function 0057E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0057E6B4

Part of subcall function 0052E551: timeGetTime.WINMM(?,?,0057E6D4), ref: 0052E555

Sleep.KERNEL32(0000000A), ref: 0057E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0057E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0057E727
SetActiveWindow.USER32 ref: 0057E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0057E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0057E773
Sleep.KERNEL32(000000FA), ref: 0057E77E
IsWindow.USER32 ref: 0057E78A
EndDialog.USER32(00000000), ref: 0057E79B

Strings

BUTTON, xrefs: 0057E719

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: a494808b6dc206de66f1f48140752f687c2c423c56e22be94da2a861d6eeeb14
Instruction ID: f073b9751afbd4aa994e19799cc77203efcd0e95fc8a64b490d8719a6423eb07
Opcode Fuzzy Hash: a494808b6dc206de66f1f48140752f687c2c423c56e22be94da2a861d6eeeb14
Instruction Fuzzy Hash: 4B2162B0200385AFEF045F25FCCAA253F6DF77A349F108465F549861A5DFB1AC08BA24

Function 0057E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0057EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0057EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0057EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0057EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0057EAA7

Strings

close PlayMe, xrefs: 0057EA6E, 0057EA9B
open , xrefs: 0057EA0C
play PlayMe, xrefs: 0057EAA2
alias PlayMe, xrefs: 0057EA36
status PlayMe mode, xrefs: 0057EA58
play PlayMe wait, xrefs: 0057EA91

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 61a8cefd10ec93d11d4f7b626158cb2532e02c0f54a0e6227855c869ed93631e
Instruction ID: b23c9614e526a7b91241434ed60e74c863b90059a5dfcc7ebf550558c172c401
Opcode Fuzzy Hash: 61a8cefd10ec93d11d4f7b626158cb2532e02c0f54a0e6227855c869ed93631e
Instruction Fuzzy Hash: C2115131A5021A79E720A7A5DC5FDFF6F7CFBD5B40F00082BB811A21D1EA701946D9B1

Function 00575CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00575CE2
GetWindowRect.USER32(00000000,?), ref: 00575CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00575D59
GetDlgItem.USER32(?,00000002), ref: 00575D69
GetWindowRect.USER32(00000000,?), ref: 00575D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00575DCF
GetDlgItem.USER32(?,000003E9), ref: 00575DDD
GetWindowRect.USER32(00000000,?), ref: 00575DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00575E31
GetDlgItem.USER32(?,000003EA), ref: 00575E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00575E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00575E67

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: df01c4290a76ff926ad615a713a8996397b6e8ad68142963d5adad664806d083
Instruction ID: 107baca27bcc17ec47cf771bdebb0b3bdca4a7a8fb2cf8d1ceb04834e20c185c
Opcode Fuzzy Hash: df01c4290a76ff926ad615a713a8996397b6e8ad68142963d5adad664806d083
Instruction Fuzzy Hash: 7F51FF71A00615AFDB18CF68DD89AAE7FB9FB58300F548129F91AE7290E7709E04DB50

Function 00528BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00528F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00528BE8,?,00000000,?,?,?,?,00528BBA,00000000,?), ref: 00528FC5

DestroyWindow.USER32(?), ref: 00528C81
KillTimer.USER32(00000000,?,?,?,?,00528BBA,00000000,?), ref: 00528D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00566973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00528BBA,00000000,?), ref: 005669A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00528BBA,00000000,?), ref: 005669B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00528BBA,00000000), ref: 005669D4
DeleteObject.GDI32(00000000), ref: 005669E6

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: f24463815d56d80adb4a558604b0bac160634a9bf37ff793da9c8934840065d8
Instruction ID: 30d0a4b81ba2f000b36e6c4fb785cd3ddd457784389474be67a17238baca1d2b
Opcode Fuzzy Hash: f24463815d56d80adb4a558604b0bac160634a9bf37ff793da9c8934840065d8
Instruction Fuzzy Hash: 45618031502B61DFDB259F54EA487397FF1FF62312F144918E082AB5A0CB35AC98EB54

Function 00529838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00529944: GetWindowLongW.USER32(?,000000EB), ref: 00529952

GetSysColor.USER32(0000000F), ref: 00529862

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: d9ff70b674d20776c70e0103e6a8df3a9f10bd990e5cc0271dfdb4b142fa2434
Instruction ID: 4cb9e7f3d078a931fe476a7b2be02545f5e048aca7da1330e3f638e743243659
Opcode Fuzzy Hash: d9ff70b674d20776c70e0103e6a8df3a9f10bd990e5cc0271dfdb4b142fa2434
Instruction Fuzzy Hash: DD41AF31504654AFDB245F38AC88BB93FA5BF27330F184655F9A28B2E2D7319846EB10

Function 00548D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.S, xrefs: 0054903A, 00548FD0, 00548FF2

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: .S
API String ID: 0-1539595904
Opcode ID: f4084f31dbfe58e50bcc5b216dca1cda73154b838ff3e5d66c7742d360502bd2
Instruction ID: 4df9f2ad0d55cb23b9e7b728096982678500be7613d02536fa81326fd622d9b8
Opcode Fuzzy Hash: f4084f31dbfe58e50bcc5b216dca1cda73154b838ff3e5d66c7742d360502bd2
Instruction Fuzzy Hash: ABC1E174D04249AFDB15DFA8D84ABEEBFB0BF59318F044099F418AB392C7709941CB61

Function 005796E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0055F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00579717
LoadStringW.USER32(00000000,?,0055F7F8,00000001), ref: 00579720

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0055F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00579742
LoadStringW.USER32(00000000,?,0055F7F8,00000001), ref: 00579745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00579866

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0057984A
Error: , xrefs: 0057981D
Line %d:, xrefs: 005797A0
^ ERROR, xrefs: 005797FB
Line %d (File "%s"):, xrefs: 0057978F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: af6b7b827216762ec88a924427d34ffe46f42bc3cdc9ffdd9ec789559f132d71
Instruction ID: 80cc43e4dae3be0c9425749b8b5899d28683a7dc2cdb02409d0af7afc2769872
Opcode Fuzzy Hash: af6b7b827216762ec88a924427d34ffe46f42bc3cdc9ffdd9ec789559f132d71
Instruction Fuzzy Hash: 7541207280021AAADF14EBE0DD9ADEE7B78BF95340F104425F60572092EB356F89DB71

Function 005706DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00516B57: _wcslen.LIBCMT ref: 00516B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 005707A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 005707BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 005707DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00570804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0057082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00570837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0057083C

Strings

\IPC$, xrefs: 00570784
SOFTWARE\Classes\, xrefs: 0057070E
\CLSID, xrefs: 00570724

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: c301f0c6cb9751d543b5ef0558e464e761b8ca576a4731dfaf54e9aebf7531cc
Instruction ID: 24b33ed58f2f657a203f1727a9fedcb3e013658d3200f73d438afd1070e70d02
Opcode Fuzzy Hash: c301f0c6cb9751d543b5ef0558e464e761b8ca576a4731dfaf54e9aebf7531cc
Instruction Fuzzy Hash: F9411A71C10229EBDF15EFA4DC998EDBBB8FF54350F144526E905A31A1EB30AE44DB90

Function 00593C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00593C5C
CoInitialize.OLE32(00000000), ref: 00593C8A
CoUninitialize.OLE32 ref: 00593C94
_wcslen.LIBCMT ref: 00593D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00593DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00593ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00593F0E
CoGetObject.OLE32(?,00000000,005AFB98,?), ref: 00593F2D
SetErrorMode.KERNEL32(00000000), ref: 00593F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00593FC4
VariantClear.OLEAUT32(?), ref: 00593FD8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: cf7ae2bac5c9028cb49224f752ac1cdec4d35337ed0afd721d9f73fa068da959
Instruction ID: 2ab23bee25734d39621ab944db3876b769ad1d3830e7beafb1ce5e955c1a112f
Opcode Fuzzy Hash: cf7ae2bac5c9028cb49224f752ac1cdec4d35337ed0afd721d9f73fa068da959
Instruction Fuzzy Hash: E3C10171608305EFDB00DF68C88492ABBE9FF89744F14491DF98A9B250DB31EE45CB52

Function 00587A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00587AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00587B8F
SHGetDesktopFolder.SHELL32(?), ref: 00587BA3
CoCreateInstance.OLE32(005AFD08,00000000,00000001,005D6E6C,?), ref: 00587BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00587C74
CoTaskMemFree.OLE32(?,?), ref: 00587CCC
SHBrowseForFolderW.SHELL32(?), ref: 00587D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00587D7A
CoTaskMemFree.OLE32(00000000), ref: 00587D81
CoTaskMemFree.OLE32(00000000), ref: 00587DD6
CoUninitialize.OLE32 ref: 00587DDC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: ef0993f72be85da02e4b8527e18a1de93ef582aaae3c1ea953ac539c6ad92c24
Instruction ID: e0eb0b44b998ba408dac48f68a003ae90e1cc16954d485a252e6de2c1b545eeb
Opcode Fuzzy Hash: ef0993f72be85da02e4b8527e18a1de93ef582aaae3c1ea953ac539c6ad92c24
Instruction Fuzzy Hash: 1DC10B75A04109AFDB14DFA4C888DAEBFF9FF48304B148499E819AB361D731EE45CB90

Function 005A541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 005A5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005A5515
CharNextW.USER32(00000158), ref: 005A5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 005A5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 005A559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005A55AC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: d5886003ec15155a33efa9b38eafa08cfe157a35db590d3bee6c0fb55c518d32
Instruction ID: ea8e2b4be976ada3c33e14a844faf45e9a5f019e2946aaab4e145fcb64cc028e
Opcode Fuzzy Hash: d5886003ec15155a33efa9b38eafa08cfe157a35db590d3bee6c0fb55c518d32
Instruction Fuzzy Hash: D7615931904609EFDF119F64CC84EBE7FB9FB1A720F104545FA25AB290E7748A84DB60

Function 0056FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0056FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0056FB08
VariantInit.OLEAUT32(?), ref: 0056FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0056FB3A
VariantCopy.OLEAUT32(?,?), ref: 0056FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0056FBA1
VariantClear.OLEAUT32(?), ref: 0056FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0056FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0056FBCC
VariantClear.OLEAUT32(?), ref: 0056FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0056FBE9

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 9356f6dfa460259c161621eaeb9fb15b02d14413d0e097da0380477a65ed9a83
Instruction ID: 052c8d2941b85b41d45c82aff44a66275088f8fcaffea0f8c130a4442233d49e
Opcode Fuzzy Hash: 9356f6dfa460259c161621eaeb9fb15b02d14413d0e097da0380477a65ed9a83
Instruction Fuzzy Hash: B4415F35E002199FCF00DFA4D8589AEBFB9FF59345F008069E906A7261DB70A945DBA0

Function 00579C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00579CA1
GetAsyncKeyState.USER32(000000A0), ref: 00579D22
GetKeyState.USER32(000000A0), ref: 00579D3D
GetAsyncKeyState.USER32(000000A1), ref: 00579D57
GetKeyState.USER32(000000A1), ref: 00579D6C
GetAsyncKeyState.USER32(00000011), ref: 00579D84
GetKeyState.USER32(00000011), ref: 00579D96
GetAsyncKeyState.USER32(00000012), ref: 00579DAE
GetKeyState.USER32(00000012), ref: 00579DC0
GetAsyncKeyState.USER32(0000005B), ref: 00579DD8
GetKeyState.USER32(0000005B), ref: 00579DEA

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 8f6b53878ed8cd5fe1f2804be95c920d8f962817de2d43954889e4c7bc82ad7e
Instruction ID: 685d34758f6ca7475cc448b13190a1fd413ce8ef14e5e60e09656be6af4b914b
Opcode Fuzzy Hash: 8f6b53878ed8cd5fe1f2804be95c920d8f962817de2d43954889e4c7bc82ad7e
Instruction Fuzzy Hash: 1941EB345047C96DFF318764A4043B5BEA47F22344F08C05ADACA575C2EBA49DC8E7B2

Function 0059055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 005905BC
inet_addr.WSOCK32(?), ref: 0059061C
gethostbyname.WSOCK32(?), ref: 00590628
IcmpCreateFile.IPHLPAPI ref: 00590636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 005906C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 005906E5
IcmpCloseHandle.IPHLPAPI(?), ref: 005907B9
WSACleanup.WSOCK32 ref: 005907BF

Strings

Ping, xrefs: 00590676

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 57ea9d76adbd8cda1ff371c8025f5f70ecf49bf71473f5d630757a9f3533eb26
Instruction ID: 9f814ae3ae2f078b379af0feebdecb90875333d50973ea182e424a9ce42a4572
Opcode Fuzzy Hash: 57ea9d76adbd8cda1ff371c8025f5f70ecf49bf71473f5d630757a9f3533eb26
Instruction Fuzzy Hash: F5916C356042019FDB20DF15D488B1ABFE4FF85328F1599A9E4698B6A2C730FD85CF91

Function 00598CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00598CF3

Part of subcall function 00578E54: _wcslen.LIBCMT ref: 00578E77

_wcslen.LIBCMT ref: 00598D4E
_wcslen.LIBCMT ref: 00598D9C
_wcslen.LIBCMT ref: 00598DDC
_wcslen.LIBCMT ref: 00598E6E

Strings

cdecl, xrefs: 00598D48, 00598D4D
none, xrefs: 00598E65, 00598E6A
stdcall, xrefs: 00598DD6, 00598DDB
winapi, xrefs: 00598D96, 00598D9B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 9bf8d05e32af8baac46059f62ffa2f4972ba75bb22e3154c9535cd29a3a4b901
Instruction ID: a53a5601b67f748e7e8b52716f4967f956f04f3a7f262ffda55c86cccd0f5692
Opcode Fuzzy Hash: 9bf8d05e32af8baac46059f62ffa2f4972ba75bb22e3154c9535cd29a3a4b901
Instruction Fuzzy Hash: AC519431A001179BCF24DF6CC9509BEBBA5BF66720B244629E426E73C4DB35DD40C790

Function 0059372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00593774
CoUninitialize.OLE32 ref: 0059377F
CoCreateInstance.OLE32(?,00000000,00000017,005AFB78,?), ref: 005937D9
IIDFromString.OLE32(?,?), ref: 0059384C
VariantInit.OLEAUT32(?), ref: 005938E4
VariantClear.OLEAUT32(?), ref: 00593936

Strings

Invalid parameter, xrefs: 00593865
NULL Pointer assignment, xrefs: 0059381E
Failed to create object, xrefs: 005937E4, 0059389A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: c55db850f75ac87a2f66fc61aae2700cba9ce81ecf80317b74ef240c099ae4d2
Instruction ID: 21e47184bd8155c0ce31768e3ffbbb48a829bf99ac12fd1f2fd0b081e013da92
Opcode Fuzzy Hash: c55db850f75ac87a2f66fc61aae2700cba9ce81ecf80317b74ef240c099ae4d2
Instruction Fuzzy Hash: EB617971608202EFDB10DF54D889B6ABFE8FF89710F004819F9859B291D770EE49CB92

Function 005A8B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00529BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00529BB2

Part of subcall function 0052912D: GetCursorPos.USER32(?), ref: 00529141
Part of subcall function 0052912D: ScreenToClient.USER32(00000000,?), ref: 0052915E
Part of subcall function 0052912D: GetAsyncKeyState.USER32(00000001), ref: 00529183
Part of subcall function 0052912D: GetAsyncKeyState.USER32(00000002), ref: 0052919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 005A8B6B
ImageList_EndDrag.COMCTL32 ref: 005A8B71
ReleaseCapture.USER32 ref: 005A8B77
SetWindowTextW.USER32(?,00000000), ref: 005A8C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 005A8C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 005A8CFF

Strings

p#^, xrefs: 005A8C71
@GUI_DRAGFILE, xrefs: 005A8C9A
@GUI_DROPID, xrefs: 005A8C51

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$p#^
API String ID: 1924731296-4032057566
Opcode ID: 7255353e0b415c17d4dc668ef01e103db485d23319a13e91d11dab246129a5f3
Instruction ID: d65b7d930107cc718ae49dd7914e4df3004e74037b0c6302dae5329496e7391d
Opcode Fuzzy Hash: 7255353e0b415c17d4dc668ef01e103db485d23319a13e91d11dab246129a5f3
Instruction Fuzzy Hash: 9A518D70104345AFE714DF14DCA9BAE7BE4FB89714F000529F9929B2E2DB709D48CB62

Function 00583388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 005833CF

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 005833F0

Strings

Incorrect parameters to object property !, xrefs: 005834AB
Error: , xrefs: 005834D1
"%s" (%d) : ==> %s:, xrefs: 00583522
"%s" (%d) : ==> %s:%s%s, xrefs: 00583504
Line %d (File "%s"):, xrefs: 00583443, 0058345C
^ ERROR , xrefs: 0058349E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 2c5b753b663f0a139c51f28c0c28e159c0975d32c3bfecdbbcecb43d0f98862c
Instruction ID: b97928cbf6668750fe2cbab7faf2d9bd8b255a27dcb82d62a7769dcb87649bd9
Opcode Fuzzy Hash: 2c5b753b663f0a139c51f28c0c28e159c0975d32c3bfecdbbcecb43d0f98862c
Instruction Fuzzy Hash: EE51B37180020ABAEF15EBA0DD5AEEEBF78BF54740F104466F50572161EB312F98DB60

Function 0057B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0057B5FC
_wcslen.LIBCMT ref: 0057B608
_wcslen.LIBCMT ref: 0057B64D
_wcslen.LIBCMT ref: 0057B68C
_wcslen.LIBCMT ref: 0057B6C7

Strings

KEYS, xrefs: 0057B647, 0057B64C
EXISTS, xrefs: 0057B686, 0057B68B
REMOVE, xrefs: 0057B602, 0057B607
APPEND, xrefs: 0057B6C1, 0057B6C6

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 6c34b784d65c3a51936ad62e978f5782042e8d66e6090e8b84198591dbbcaad6
Instruction ID: 9d3d8b958fce7c9f6bb1e33cf411d7d3e757fb5e8f625136b9ba80c7532fa462
Opcode Fuzzy Hash: 6c34b784d65c3a51936ad62e978f5782042e8d66e6090e8b84198591dbbcaad6
Instruction Fuzzy Hash: 2C41FD72A000279BDB205F7DD8906BE7FB5FFA0754B24812AE629D7284E735CD81D790

Function 00585393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005853A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00585416
GetLastError.KERNEL32 ref: 00585420
SetErrorMode.KERNEL32(00000000,READY), ref: 005854A7

Strings

NOTREADY, xrefs: 0058544B
READONLY, xrefs: 00585452
READY, xrefs: 00585460, 00585468
INVALID, xrefs: 00585459
UNKNOWN, xrefs: 00585444

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 4ac313710d03adff532ea9e41e96507077347536d5ad7b03e5072371345dc921
Instruction ID: bbbc0acc88e2e69d1789eae54116aef7bc10f5fac25d6c84168142adee5899ab
Opcode Fuzzy Hash: 4ac313710d03adff532ea9e41e96507077347536d5ad7b03e5072371345dc921
Instruction Fuzzy Hash: B4318F35A006059FDB10EF68C488AAA7FF4FF45305F548066E805EB3A2EB71DD86CB90

Function 005A3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 005A3C79
SetMenu.USER32(?,00000000), ref: 005A3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005A3D10
IsMenu.USER32(?), ref: 005A3D24
CreatePopupMenu.USER32 ref: 005A3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 005A3D5B
DrawMenuBar.USER32 ref: 005A3D63

Strings

0, xrefs: 005A3C54
F, xrefs: 005A3D4E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 0d2f37f1e57237b641743da74e3f7dc7c0f261496fcb4c8271f0836d73c1a862
Instruction ID: 27a32d64678b2d3c73eb1829b21462897e1da032068909cd2280e2de5c407997
Opcode Fuzzy Hash: 0d2f37f1e57237b641743da74e3f7dc7c0f261496fcb4c8271f0836d73c1a862
Instruction Fuzzy Hash: 18416879A01209EFDB14CF64D884AAE7FB5FF5A354F140029F946A7360D730AA14DB94

Function 00571EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 00573CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00573CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00571F64
GetDlgCtrlID.USER32 ref: 00571F6F
GetParent.USER32 ref: 00571F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00571F8E
GetDlgCtrlID.USER32(?), ref: 00571F97
GetParent.USER32(?), ref: 00571FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00571FAE

Strings

ListBox, xrefs: 00571F21
ComboBox, xrefs: 00571EEC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 6988849035dfbdd36d139ad445dcf7a536a518007fcf593bf0dced547869c3c8
Instruction ID: a48eb5abc76949db3d1615c25b98a0889183bc080912d25388fa365ffbb7892b
Opcode Fuzzy Hash: 6988849035dfbdd36d139ad445dcf7a536a518007fcf593bf0dced547869c3c8
Instruction Fuzzy Hash: 0421D070900214BBDF11EFA8DC89DEEBFB8BF56350F004116F9656B291DB344908EB60

Function 00571FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 00573CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00573CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00572043
GetDlgCtrlID.USER32 ref: 0057204E
GetParent.USER32 ref: 0057206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0057206D
GetDlgCtrlID.USER32(?), ref: 00572076
GetParent.USER32(?), ref: 0057208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0057208D

Strings

ListBox, xrefs: 00572002
ComboBox, xrefs: 00571FCD

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: a6c9aca4f10ac45b3761e12970c75b2eb348c03fa41b191422d441615f6e1d70
Instruction ID: 86fe38d3784bab02a1d1d80e9a7d5d2409d65192834e0970f793663afd086e34
Opcode Fuzzy Hash: a6c9aca4f10ac45b3761e12970c75b2eb348c03fa41b191422d441615f6e1d70
Instruction Fuzzy Hash: 7621CF71900214BBDF10EFA4DC89EEEBFB8BF15340F004416B996AB2A1DA754958EB60

Function 005A3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 005A3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 005A3AA0
GetWindowLongW.USER32(?,000000F0), ref: 005A3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 005A3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 005A3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 005A3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 005A3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 005A3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 005A3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 005A3C13

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 6a121adec603426d56cb2149658e46ed74cc961d9af572a72530947eae12d603
Instruction ID: 54982ee2cc5b44355717b08d8d85a7a00505cbc00a454a5e6c79052ab5caf453
Opcode Fuzzy Hash: 6a121adec603426d56cb2149658e46ed74cc961d9af572a72530947eae12d603
Instruction Fuzzy Hash: D5615975900248AFDB10DFA8CC81EEE7BF8BF4A714F100099FA15AB291C770AE45DB60

Function 00542C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00542C94

Part of subcall function 005429C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000), ref: 005429DE
Part of subcall function 005429C8: GetLastError.KERNEL32(00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000,00000000), ref: 005429F0

_free.LIBCMT ref: 00542CA0
_free.LIBCMT ref: 00542CAB
_free.LIBCMT ref: 00542CB6
_free.LIBCMT ref: 00542CC1
_free.LIBCMT ref: 00542CCC
_free.LIBCMT ref: 00542CD7
_free.LIBCMT ref: 00542CE2
_free.LIBCMT ref: 00542CED
_free.LIBCMT ref: 00542CFB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: cb3ab96e268b8459a62f3b421e9f9936c1086efe2ad853fe3524ff0753285d84
Instruction ID: f2b647019b5027eac990fe8d3f060b4f816d861e06b3150a55d4c80a2b105c10
Opcode Fuzzy Hash: cb3ab96e268b8459a62f3b421e9f9936c1086efe2ad853fe3524ff0753285d84
Instruction Fuzzy Hash: DF11C076100119AFDB02EF95D886CDD3FB9FF45354F9144A0FA489B222DA31EE909B90

Function 00511410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00511459
OleUninitialize.OLE32(?,00000000), ref: 005114F8
UnregisterHotKey.USER32(?), ref: 005116DD
DestroyWindow.USER32(?), ref: 005524B9
FreeLibrary.KERNEL32(?), ref: 0055251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0055254B

Strings

close all, xrefs: 00511454

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 4c7284e9177615424abd33aea7964d3098e44775fd7943789c732cef821113a9
Instruction ID: 6868d8ac1e200b6f10c86dff4f2ce615e05f25ca166e739ad64f0d328634d7ee
Opcode Fuzzy Hash: 4c7284e9177615424abd33aea7964d3098e44775fd7943789c732cef821113a9
Instruction Fuzzy Hash: 4AD1BD31701622CFEB19EF14D4A8A69FFA4BF46700F1441EEE94A6B252DB30AC56CF54

Function 00587DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00587FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00587FC1
GetFileAttributesW.KERNEL32(?), ref: 00587FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00588005
SetCurrentDirectoryW.KERNEL32(?), ref: 00588017
SetCurrentDirectoryW.KERNEL32(?), ref: 00588060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 005880B0

Strings

*.*, xrefs: 00588066

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 9a0e5fb5a9e78eb493b66398a5808f62e9e483d66d19b361993f78d6c71b18f5
Instruction ID: 726c6ec4c52bc6c92eed617e448c41a757dd9d9d81981cf118759105984ed499
Opcode Fuzzy Hash: 9a0e5fb5a9e78eb493b66398a5808f62e9e483d66d19b361993f78d6c71b18f5
Instruction Fuzzy Hash: 9A81A3725082059BDB20FF64C4489BABBE8BF89310F644C5AFC85E7250EB35DD49CB52

Function 00515BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00515C7A

Part of subcall function 00515D0A: GetClientRect.USER32(?,?), ref: 00515D30
Part of subcall function 00515D0A: GetWindowRect.USER32(?,?), ref: 00515D71
Part of subcall function 00515D0A: ScreenToClient.USER32(?,?), ref: 00515D99

GetDC.USER32 ref: 005546F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00554708
SelectObject.GDI32(00000000,00000000), ref: 00554716
SelectObject.GDI32(00000000,00000000), ref: 0055472B
ReleaseDC.USER32(?,00000000), ref: 00554733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 005547C4

Strings

U, xrefs: 00554693

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 606f041d2381b20eb5b647d1b542239d452e97a4a0ec60724ef10875ce4f5126
Instruction ID: 6a7442baf897b7f100ead10c7b58d3ad4d9cbc5dbde225e092372e4ab66aa7f3
Opcode Fuzzy Hash: 606f041d2381b20eb5b647d1b542239d452e97a4a0ec60724ef10875ce4f5126
Instruction Fuzzy Hash: 1671DF34400205DFCF258F64C998AEA3FB5FF8A31AF14426AED555A266D7309CCADF50

Function 0058359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 005835E4

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

LoadStringW.USER32(005E2390,?,00000FFF,?), ref: 0058360A

Strings

Error: , xrefs: 005836EF
"%s" (%d) : ==> %s:, xrefs: 00583742
"%s" (%d) : ==> %s:%s%s, xrefs: 00583724
^ ERROR, xrefs: 005836C9
Line %d (File "%s"):, xrefs: 0058366B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: f740b3057fc6fac08b1663d068b5317b56afb3e53c0ca98e25f1983bee0a3a34
Instruction ID: 01a258eaff1156b73ec1966dd901fbecae17bf0f3fcd8015bee7ecbafa8b6670
Opcode Fuzzy Hash: f740b3057fc6fac08b1663d068b5317b56afb3e53c0ca98e25f1983bee0a3a34
Instruction Fuzzy Hash: 0C516B7180020ABAEF14EBA0DC9AEEDBF38FF54700F144525F515721A1EB306B99DBA0

Function 0058C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0058C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0058C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0058C2CA
GetLastError.KERNEL32 ref: 0058C322
SetEvent.KERNEL32(?), ref: 0058C336
InternetCloseHandle.WININET(00000000), ref: 0058C341

Strings

, xrefs: 0058C2BB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 98d7d3055c148619287e8690006587210a279fd393ab516df3775419a9338fdd
Instruction ID: 7790a83be29ec81c6077cf97ffaada539440bc72bc764fc059f9443af2f9ae57
Opcode Fuzzy Hash: 98d7d3055c148619287e8690006587210a279fd393ab516df3775419a9338fdd
Instruction Fuzzy Hash: 64317FB1500604AFD721AF649C88AAB7FFCFB59744F10891EF886A2240DB34DD099B70

Function 0057989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00553AAF,?,?,Bad directive syntax error,005ACC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 005798BC
LoadStringW.USER32(00000000,?,00553AAF,?), ref: 005798C3

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00579987

Strings

., xrefs: 0057996D
Line %d:, xrefs: 00579912
Error: , xrefs: 00579955
Line %d (File "%s"):, xrefs: 0057992D
%s (%d) : ==> %s.: %s %s, xrefs: 005798F1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: cf11680bd29c287107490eb45fe4780d5aca51db3f22cd620debb7e661b1d1b6
Instruction ID: 3543e181bf1943ab2dec9d3879c9b890ed7313b46a79ed3319eb8e9b89e6397c
Opcode Fuzzy Hash: cf11680bd29c287107490eb45fe4780d5aca51db3f22cd620debb7e661b1d1b6
Instruction Fuzzy Hash: 3D21943180021BBBDF11AF90DC5AEED7F75FF54300F044826F519620A1EB71AA58EB60

Function 0057209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 005720AB
GetClassNameW.USER32(00000000,?,00000100), ref: 005720C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0057214D

Strings

details, xrefs: 005720FB
list, xrefs: 0057212F
largeicons, xrefs: 005720E1
SHELLDLL_DefView, xrefs: 005720CC
smallicons, xrefs: 00572115

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: e8a184e5a12ad1e1daeace80f8dfb6591ca979f161a6249e322417ef7e8af23c
Instruction ID: e24e2ee8d6ef4f15f5b1a9a8917e5d0e8b7af0ecbfbba80c76c1da46cb71f507
Opcode Fuzzy Hash: e8a184e5a12ad1e1daeace80f8dfb6591ca979f161a6249e322417ef7e8af23c
Instruction Fuzzy Hash: 9C11597A288307BAF6116229FC0BDA63F9CFB15324F20401BFB09A50D1FE716841BA14

Function 0054CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0054CEB7
_free.LIBCMT ref: 0054CF22
_free.LIBCMT ref: 0054CF48
_free.LIBCMT ref: 0054CF71
_free.LIBCMT ref: 0054CFA9
_free.LIBCMT ref: 0054CFDA
_free.LIBCMT ref: 0054D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0054D09C
_free.LIBCMT ref: 0054D0B5

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 35c5133244bc30a076be77cc1833b6e730a0e82258f093994e484aa6b43f7f69
Instruction ID: 0c4c8da63d30988a50988f37c33bf85e18892c3feaad86dce66b3f4f2a063d49
Opcode Fuzzy Hash: 35c5133244bc30a076be77cc1833b6e730a0e82258f093994e484aa6b43f7f69
Instruction Fuzzy Hash: FF618771905312BFDB25AFB49C89AEE7FA5FF81318F04016DF9449B282EB359C489760

Function 005A50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 005A5186
ShowWindow.USER32(?,00000000), ref: 005A51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 005A51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 005A51D1

Part of subcall function 005A6FBA: DeleteObject.GDI32(00000000), ref: 005A6FE6

GetWindowLongW.USER32(?,000000F0), ref: 005A520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005A521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 005A524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 005A5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 005A5296

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: af91222d32c97ee58d4a0023129f4cb45ae7f0fa1f0a1f341734ad401d6bbe70
Instruction ID: fe7235efff2c23d5327d5b586f3a8d11d5ceac297eb2c576746703b80b7ff7a7
Opcode Fuzzy Hash: af91222d32c97ee58d4a0023129f4cb45ae7f0fa1f0a1f341734ad401d6bbe70
Instruction Fuzzy Hash: 9B517A34A40A09AEEF249F24DC4AFEC3FA5FF57321F144011F6559A2E1E775A984EB40

Function 00528B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00566890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 005668A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 005668B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 005668D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 005668F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00528874,00000000,00000000,00000000,000000FF,00000000), ref: 00566901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0056691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00528874,00000000,00000000,00000000,000000FF,00000000), ref: 0056692D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 66e45f2eea7abb2dca242a926c55c8933cb1b674fe93f8eb8f41bae400671fa7
Instruction ID: 5e0b6f25aa68993db56f952f6c905eec3b766dfcd013a009b4c7cdb023e2328e
Opcode Fuzzy Hash: 66e45f2eea7abb2dca242a926c55c8933cb1b674fe93f8eb8f41bae400671fa7
Instruction Fuzzy Hash: B2519570A00609AFDB20CF64DC95BAA3FB5FF9A710F104518F9529B2E0DB70E990EB40

Function 0058C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0058C182
GetLastError.KERNEL32 ref: 0058C195
SetEvent.KERNEL32(?), ref: 0058C1A9

Part of subcall function 0058C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0058C272
Part of subcall function 0058C253: GetLastError.KERNEL32 ref: 0058C322
Part of subcall function 0058C253: SetEvent.KERNEL32(?), ref: 0058C336
Part of subcall function 0058C253: InternetCloseHandle.WININET(00000000), ref: 0058C341

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: cfdfb2378b12210eccc5a6195d0abf4f229cbddccc759d77990079f3f2e33ecd
Instruction ID: ef4ebc6702325274392a1a6c707f3af78ee6a66c85632095370511702284238e
Opcode Fuzzy Hash: cfdfb2378b12210eccc5a6195d0abf4f229cbddccc759d77990079f3f2e33ecd
Instruction Fuzzy Hash: 46318075200601AFDB21AFB5DC48A66BFF9FF69300B00441DF997A2650DB31E814EB70

Function 005725A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00573A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00573A57
Part of subcall function 00573A3D: GetCurrentThreadId.KERNEL32 ref: 00573A5E
Part of subcall function 00573A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005725B3), ref: 00573A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 005725BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 005725DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 005725DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 005725E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00572601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00572605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0057260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00572623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00572627

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: e960b58145b9f48b7a03b2e116e9c117e650d9a739f5235b9cb96ab3c7203277
Instruction ID: 6c4d37684ed6d9e3cd017629e0a6cd174e5f0399fcc14a979a4e7f699d898d2d
Opcode Fuzzy Hash: e960b58145b9f48b7a03b2e116e9c117e650d9a739f5235b9cb96ab3c7203277
Instruction Fuzzy Hash: 6E01D431390210BBFB1067699C8EF593F59EB9EB12F104001F318AF0D1C9E22449EA69

Function 00571803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00571449,?,?,00000000), ref: 0057180C
HeapAlloc.KERNEL32(00000000,?,00571449,?,?,00000000), ref: 00571813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00571449,?,?,00000000), ref: 00571828
GetCurrentProcess.KERNEL32(?,00000000,?,00571449,?,?,00000000), ref: 00571830
DuplicateHandle.KERNEL32(00000000,?,00571449,?,?,00000000), ref: 00571833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00571449,?,?,00000000), ref: 00571843
GetCurrentProcess.KERNEL32(00571449,00000000,?,00571449,?,?,00000000), ref: 0057184B
DuplicateHandle.KERNEL32(00000000,?,00571449,?,?,00000000), ref: 0057184E
CreateThread.KERNEL32(00000000,00000000,00571874,00000000,00000000,00000000), ref: 00571868

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 09e8468a245220e03fdfcd945d78faa8b3f697f1e8659289c2849273603031c6
Instruction ID: 46fec11f13f0ccf2d9f6bbdd5053c8cba2646cac1bf36057acf69a3238f3dc8e
Opcode Fuzzy Hash: 09e8468a245220e03fdfcd945d78faa8b3f697f1e8659289c2849273603031c6
Instruction Fuzzy Hash: 5701BBB5340308BFE710ABA5DC4DF6B3FACEB9AB11F008411FA05DB1A1DA709804DB20

Function 00543E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00543F0B
__alldvrm.LIBCMT ref: 0054410C
__alldvrm.LIBCMT ref: 0054412E

Strings

}}S, xrefs: 00543E8A
}}S, xrefs: 005440CD
}}S, xrefs: 00543E96, 00543EF1, 00543F0A, 00544090

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}S$}}S$}}S
API String ID: 1036877536-895446879
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 1f58a2e901280b91e106e65eba6a01f1f909075f1f2f293f49a04c21a9fdcb07
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 8DA13671D407869FEB25CE18C8957EEBFF4FF61358F18416EE5859B282C2388985CB50

Function 0059A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0057D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0057D501
Part of subcall function 0057D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0057D50F
Part of subcall function 0057D4DC: CloseHandle.KERNEL32(00000000), ref: 0057D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0059A16D
GetLastError.KERNEL32 ref: 0059A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0059A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0059A268
GetLastError.KERNEL32(00000000), ref: 0059A273
CloseHandle.KERNEL32(00000000), ref: 0059A2C4

Strings

SeDebugPrivilege, xrefs: 0059A18F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: ac8467f77acd6d20e48965530fabdb13270f78c6b943394862487d9f12b233cc
Instruction ID: e0704fa6ca13c87619b056634e1cb1450a27cccd01a9f3c3f23e821b2de89b9e
Opcode Fuzzy Hash: ac8467f77acd6d20e48965530fabdb13270f78c6b943394862487d9f12b233cc
Instruction Fuzzy Hash: 5D615E342042429FEB10DF18C498F55BFA1BF94318F14849CE4664B7A2C776ED45CBD2

Function 005A3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 005A3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 005A393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 005A3954
_wcslen.LIBCMT ref: 005A3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 005A39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 005A39F4

Strings

SysListView32, xrefs: 005A38F7

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: f01334a2a6e1618b05379d73bd6a9e98ff72a4ae3d3d6b655d43d670c74be508
Instruction ID: a1f9f8aba6b8e4cb58b309b81d8268a2f0420fcd9578ca1bfad196a03ca267d3
Opcode Fuzzy Hash: f01334a2a6e1618b05379d73bd6a9e98ff72a4ae3d3d6b655d43d670c74be508
Instruction Fuzzy Hash: A641D071A00219ABEB21DF64CC49BEE7FA9FF49354F100526F948E7281D7B49E84CB90

Function 0057BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0057BCFD
IsMenu.USER32(00000000), ref: 0057BD1D
CreatePopupMenu.USER32 ref: 0057BD53
GetMenuItemCount.USER32(00E04CC0), ref: 0057BDA4
InsertMenuItemW.USER32(00E04CC0,?,00000001,00000030), ref: 0057BDCC

Strings

0, xrefs: 0057BCA8
2, xrefs: 0057BD37

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 494da3f4b1aa77ae215433e21e77289b6ffb16378bea6289337b786cb5ad49f7
Instruction ID: 2c2c97a1fb7455183e1d6cc62613661665a13b37a265714c6c8adc8c2d7d318f
Opcode Fuzzy Hash: 494da3f4b1aa77ae215433e21e77289b6ffb16378bea6289337b786cb5ad49f7
Instruction Fuzzy Hash: 72519F70A002059FEB21CFA8E888BAEBFF4BF55314F14C519E419D7291E7719944EB51

Function 00532D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00532D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00532D53
_ValidateLocalCookies.LIBCMT ref: 00532DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00532E0C
_ValidateLocalCookies.LIBCMT ref: 00532E61

Strings

csm, xrefs: 00532DF6
&HS, xrefs: 00532DFE, 00532E07, 00532E18

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &HS$csm
API String ID: 1170836740-2847240634
Opcode ID: 60946cf2c6352f6042e4c9637a5862af839fd061c5a36f7a07a9601b591cae74
Instruction ID: 0bea1da9764ef4f34922b89c5fa33763107bcb5945878550b89b573c13aae0ce
Opcode Fuzzy Hash: 60946cf2c6352f6042e4c9637a5862af839fd061c5a36f7a07a9601b591cae74
Instruction Fuzzy Hash: C841A434A01609EBCF10DF68C849A9EBFB5BF84324F148555E915AB392D731EE06CBD0

Function 0057C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0057C913

Strings

warning, xrefs: 0057C8FC
question, xrefs: 0057C8CC
info, xrefs: 0057C8B4
stop, xrefs: 0057C8E4
blank, xrefs: 0057C895

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: ea2bc0b084ce332786ab556cd7c5520075d54c1e45639393e8a50dd1be2c80e2
Instruction ID: e212c30a210cf7aa27542c3ff9acd9c788ff0629e0f630f1785aae49e8fb743c
Opcode Fuzzy Hash: ea2bc0b084ce332786ab556cd7c5520075d54c1e45639393e8a50dd1be2c80e2
Instruction Fuzzy Hash: EE11EB3168930BBBA7119B54AC82CEA7F9CFF15754B10442FF608A6282D7707D417665

Function 0057DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0057DE42
gethostname.WSOCK32(?,00000100), ref: 0057DE5C
gethostbyname.WSOCK32(?), ref: 0057DE69
inet_ntoa.WSOCK32(?), ref: 0057DEAB
_strcat.LIBCMT ref: 0057DEB9
WSACleanup.WSOCK32 ref: 0057DEDE

Strings

0.0.0.0, xrefs: 0057DE87

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: f2909701a1f36104c4a9528f267ed85dbf4d72a721e7060cbc784d3146c55ebd
Instruction ID: ee75dfb84620e70e6cfd8f51af7230fc58ee946da8e1a084ae9e42d6b3fa5ff5
Opcode Fuzzy Hash: f2909701a1f36104c4a9528f267ed85dbf4d72a721e7060cbc784d3146c55ebd
Instruction Fuzzy Hash: AE110A72504115AFDB21AB20AC0EEDE7FBCFF55711F004169F40996091EF759A81AA70

Function 0057ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0057ED2A
_wcslen.LIBCMT ref: 0057ED3B
_wcslen.LIBCMT ref: 0057ED79
_wcslen.LIBCMT ref: 0057EDAF
_wcslen.LIBCMT ref: 0057EDDF
_wcslen.LIBCMT ref: 0057EDEF
_wcslen.LIBCMT ref: 0057EE2B
_wcslen.LIBCMT ref: 0057EE5A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 91c284f149294394141a96bf077773e97512e10061c01fc198e0c790f3d07584
Instruction ID: fd9260e992b1fcecdb2533b2e0b1c8fb117d3ad969f22688c65896332eea0067
Opcode Fuzzy Hash: 91c284f149294394141a96bf077773e97512e10061c01fc198e0c790f3d07584
Instruction Fuzzy Hash: 80418466C1021975CB11EBB4988EACF7BBCBF89710F508466F518E3122FB34E255C7A5

Function 0052F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0056682C,00000004,00000000,00000000), ref: 0052F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0056682C,00000004,00000000,00000000), ref: 0056F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0056682C,00000004,00000000,00000000), ref: 0056F454

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: f5ab306eff1324f93fdcd4cc58085cb522e10ed4707579ddb1687351b8d3cbf4
Instruction ID: 07321a2e70d98a1bac38aea76dd3c6b95a3245066138fbfcc962061d945a9381
Opcode Fuzzy Hash: f5ab306eff1324f93fdcd4cc58085cb522e10ed4707579ddb1687351b8d3cbf4
Instruction Fuzzy Hash: FB410B31608690BAC7398B2DF88872A7FB1BF97314F14483CE087576E1D631A8C4DB11

Function 005A2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 005A2D1B
GetDC.USER32(00000000), ref: 005A2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 005A2D2E
ReleaseDC.USER32(00000000,00000000), ref: 005A2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 005A2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 005A2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,005A5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 005A2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 005A2DE1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 826aeedad7eb1065195f62f79de3374bf1494445f255d6e05f40f3e10ce37e8e
Instruction ID: b6d39b8348042ce4923334a8c5d0a1ebf2a7551c46a4fdac2a551361e7c2b3a7
Opcode Fuzzy Hash: 826aeedad7eb1065195f62f79de3374bf1494445f255d6e05f40f3e10ce37e8e
Instruction Fuzzy Hash: 92316972201214BBEB218F548C8AFEB3FA9FB1A715F044055FE089A292C6759C55CBA4

Function 00575622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00575637
_memcmp.LIBVCRUNTIME ref: 00575659
_memcmp.LIBVCRUNTIME ref: 00575671
_memcmp.LIBVCRUNTIME ref: 00575684
_memcmp.LIBVCRUNTIME ref: 0057569E
_memcmp.LIBVCRUNTIME ref: 005756B1
_memcmp.LIBVCRUNTIME ref: 005756C9
_memcmp.LIBVCRUNTIME ref: 005756E4

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 70b45551231ea2c49f2181fb741abaf3fd90eb8826f5753e55158a43b827ec74
Instruction ID: ce476ce3a50280507b72a00b44a597f3a5bb3df3f37a3004d0808bb695d88dfd
Opcode Fuzzy Hash: 70b45551231ea2c49f2181fb741abaf3fd90eb8826f5753e55158a43b827ec74
Instruction Fuzzy Hash: 82212961644E0A77D2185521AD96FFE3F5CFF61394F448420FD0E9A581FBA0EE1092E9

Function 00594FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00595007
NULL Pointer assignment, xrefs: 0059502E, 00595383

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 70bce1d01f652fe3e5b6a137a3f6839ccc78ef89e5bbd673c84e2f00c0dc5709
Instruction ID: 4994603213440e1249d98e5c545af81e94d688fc66b64a5b5c8d9e703bc23fe2
Opcode Fuzzy Hash: 70bce1d01f652fe3e5b6a137a3f6839ccc78ef89e5bbd673c84e2f00c0dc5709
Instruction Fuzzy Hash: A9D1E271A0060AAFDF11CFA8C885FAEBBB5FF48344F148469E915AB281E770DD55CB90

Function 00551522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,005517FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 005515CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,005517FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00551651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,005517FB,?,005517FB,00000000,00000000,?,00000000,?,?,?,?), ref: 005516E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,005517FB,00000000,00000000,?,00000000,?,?,?,?), ref: 005516FB

Part of subcall function 00543820: RtlAllocateHeap.NTDLL(00000000,?,005E1444,?,0052FDF5,?,?,0051A976,00000010,005E1440,005113FC,?,005113C6,?,00511129), ref: 00543852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,005517FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00551777
__freea.LIBCMT ref: 005517A2
__freea.LIBCMT ref: 005517AE

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: e8304211e53872cf78084dfc1e33bd3c4004e3408b64d64a4d2f45e1bf780cc9
Instruction ID: c04c13829556676bdde93f596624673d63ad07e03a4ba3af2b3dd2827bf6d391
Opcode Fuzzy Hash: e8304211e53872cf78084dfc1e33bd3c4004e3408b64d64a4d2f45e1bf780cc9
Instruction Fuzzy Hash: 9D91C671E10A165ADB208E78C8A5BEE7FB5FF49315F18055AEC02E7141EB35DC48CB68

Function 00594523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00594648
VariantInit.OLEAUT32(?), ref: 00594749
VariantClear.OLEAUT32(?), ref: 00594753
VariantClear.OLEAUT32(?), ref: 005947B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 005945D8, 00594706, 005947BE
Incorrect Object type in FOR..IN loop, xrefs: 0059472C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 77306e72be91a7ecf0ba1ce4349f5b5347728ad51ca2df2036dff4ae9b387d75
Instruction ID: 41213f7b4867b2642b7d579067c4a1d108a3a7272f84ede0c31922d5a4a1301b
Opcode Fuzzy Hash: 77306e72be91a7ecf0ba1ce4349f5b5347728ad51ca2df2036dff4ae9b387d75
Instruction Fuzzy Hash: B5917E71A00219ABDF24CFA4D848FAEBFB8FF46715F108559E505AB280D7709D46CFA0

Function 00581187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0058125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00581284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 005812A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 005812D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0058135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 005813C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00581430

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 148ef1dbce5227e56b34e09841ee106e26920361c44d50065e1b0d91fa047f87
Instruction ID: de43210863cf6dd09675dc264b1f14575ccda69dbb8db402c8801cd81d3bf2c4
Opcode Fuzzy Hash: 148ef1dbce5227e56b34e09841ee106e26920361c44d50065e1b0d91fa047f87
Instruction Fuzzy Hash: 7F91E175A006199FDB00EF94C889BBEBFB9FF85311F104429E901FB291D774A946CB98

Function 0052948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 83f3c22fb306f6be88ca3d7481be7fa10cefbf19928e3787af2bff1dfcc73a85
Instruction ID: 3cb3b983fbfa0f9e69b899443e4a6e3a1e498c1d3afaa14e7ea96eee4cdfe8c9
Opcode Fuzzy Hash: 83f3c22fb306f6be88ca3d7481be7fa10cefbf19928e3787af2bff1dfcc73a85
Instruction Fuzzy Hash: 46910671E00219AFCB14CFA9D888AEEBFB8FF4A320F144555E515B7291D774A941CBA0

Function 00593947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0059396B
CharUpperBuffW.USER32(?,?), ref: 00593A7A
_wcslen.LIBCMT ref: 00593A8A
VariantClear.OLEAUT32(?), ref: 00593C1F

Part of subcall function 00580CDF: VariantInit.OLEAUT32(00000000), ref: 00580D1F
Part of subcall function 00580CDF: VariantCopy.OLEAUT32(?,?), ref: 00580D28
Part of subcall function 00580CDF: VariantClear.OLEAUT32(?), ref: 00580D34

Strings

AUTOIT.ERROR, xrefs: 00593A80, 00593A85
Incorrect Parameter format, xrefs: 005939A6, 00593BA1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: d1de0cec47eb83c8b73fed0c5b2871f7964d3ad9d0ec9e0fbbb42569a274da58
Instruction ID: dc642ee4a540e05f302883e646ca5ec0a6347dd7f755bcea8d9dc74af3d1ce25
Opcode Fuzzy Hash: d1de0cec47eb83c8b73fed0c5b2871f7964d3ad9d0ec9e0fbbb42569a274da58
Instruction Fuzzy Hash: 769136756083069FCB10EF28C49596ABBE5FF89314F14882DF88997351DB30EE45CB92

Function 00594BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0057000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0056FF41,80070057,?,?,?,0057035E), ref: 0057002B
Part of subcall function 0057000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0056FF41,80070057,?,?), ref: 00570046
Part of subcall function 0057000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0056FF41,80070057,?,?), ref: 00570054
Part of subcall function 0057000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0056FF41,80070057,?), ref: 00570064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00594C51
_wcslen.LIBCMT ref: 00594D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00594DCF
CoTaskMemFree.OLE32(?), ref: 00594DDA

Strings

NULL Pointer assignment, xrefs: 00594E23, 00594E52

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 0d877d0f5680bbfd8bc4b1a12b15a4521c267de10851dd49e1813de6f20319c2
Instruction ID: 60621b3f739e646e4d965c75ee284f12d03f14d315a975b55d033b0dbefe4138
Opcode Fuzzy Hash: 0d877d0f5680bbfd8bc4b1a12b15a4521c267de10851dd49e1813de6f20319c2
Instruction Fuzzy Hash: 80911671D0021AAFDF10DFA4D895EEEBBB8BF48310F108569E919A7241DB309E45CF60

Function 005A20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 005A2183
GetMenuItemCount.USER32(00000000), ref: 005A21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 005A21DD
_wcslen.LIBCMT ref: 005A2213
GetMenuItemID.USER32(?,?), ref: 005A224D
GetSubMenu.USER32(?,?), ref: 005A225B

Part of subcall function 00573A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00573A57
Part of subcall function 00573A3D: GetCurrentThreadId.KERNEL32 ref: 00573A5E
Part of subcall function 00573A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005725B3), ref: 00573A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 005A22E3

Part of subcall function 0057E97B: Sleep.KERNELBASE ref: 0057E9F3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 6d2d86c397e51629941336921d31eade84037df1898bd7cd74ec3e22cd8fa983
Instruction ID: c20852dbd681ee844113cfb4df46e37ba3a5a5cefbeecbe0b2aa2c3e45403db4
Opcode Fuzzy Hash: 6d2d86c397e51629941336921d31eade84037df1898bd7cd74ec3e22cd8fa983
Instruction Fuzzy Hash: 55714B75A00215AFCB10DF68C846AAEBFF5BF8A310F148469E916AB351DB34ED418B90

Function 005A7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00E04D88), ref: 005A7F37
IsWindowEnabled.USER32(00E04D88), ref: 005A7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 005A801E
SendMessageW.USER32(00E04D88,000000B0,?,?), ref: 005A8051
IsDlgButtonChecked.USER32(?,?), ref: 005A8089
GetWindowLongW.USER32(00E04D88,000000EC), ref: 005A80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 005A80C3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: d87aec16feb92479b5353dc36a41eb92670cc3dde134ae5ce6792a76c3e342d5
Instruction ID: e6b27c16929c0c9da5fd5348c41c6e9a936cb2a796b9d50470e2dde8bed12b99
Opcode Fuzzy Hash: d87aec16feb92479b5353dc36a41eb92670cc3dde134ae5ce6792a76c3e342d5
Instruction Fuzzy Hash: 1771AB34608248AFEB219F64CC88FBEBFB9FF5B300F144459E95597261CB31AA44DB20

Function 0057AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0057AEF9
GetKeyboardState.USER32(?), ref: 0057AF0E
SetKeyboardState.USER32(?), ref: 0057AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0057AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0057AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0057AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0057B020

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4f1173effa0c305a0a07e059feb70ada640a78b3b7c93d56ff0aa68b6667f26a
Instruction ID: 7be483fbd37eb13ca928255f13004dd394cd7099eaf4d2ad01014ca44ad8056f
Opcode Fuzzy Hash: 4f1173effa0c305a0a07e059feb70ada640a78b3b7c93d56ff0aa68b6667f26a
Instruction Fuzzy Hash: 4351D1A06087D53DFB3682349C49BBEBEA96B46304F08C589E1DD958C3D398ACC8E751

Function 0057ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0057AD19
GetKeyboardState.USER32(?), ref: 0057AD2E
SetKeyboardState.USER32(?), ref: 0057AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0057ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0057ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0057AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0057AE38

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c43deac456268518980e2d445fc184cb9d67f655e4d90ae42bd94ce82bec954f
Instruction ID: 2a5d4e7a1b1f96e325617f309cc14afbe8a8c276494c597c50560d8cea99cd91
Opcode Fuzzy Hash: c43deac456268518980e2d445fc184cb9d67f655e4d90ae42bd94ce82bec954f
Instruction Fuzzy Hash: 8D51B3A15047D53DFB3783249C55BBE7EA97B86300F08C589E5DD868C2D294EC88F762

Function 0054542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00553CD6,?,?,?,?,?,?,?,?,00545BA3,?,?,00553CD6,?,?), ref: 00545470
__fassign.LIBCMT ref: 005454EB
__fassign.LIBCMT ref: 00545506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00553CD6,00000005,00000000,00000000), ref: 0054552C
WriteFile.KERNEL32(?,00553CD6,00000000,00545BA3,00000000,?,?,?,?,?,?,?,?,?,00545BA3,?), ref: 0054554B
WriteFile.KERNEL32(?,?,00000001,00545BA3,00000000,?,?,?,?,?,?,?,?,?,00545BA3,?), ref: 00545584

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 682d5176a5f3b3f1c0d048d993e3aceda236afee3b24c48ac106d56ed995fb66
Instruction ID: 24808c6eb1eebcecf855a58c8dca5a9990f6fc865d75660e9bc5a7327662084e
Opcode Fuzzy Hash: 682d5176a5f3b3f1c0d048d993e3aceda236afee3b24c48ac106d56ed995fb66
Instruction Fuzzy Hash: 4B51E270A00649AFDB11CFA8D885AEEBFF9FF09304F14451AF955E7292E7309A41CB60

Function 005910B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0059304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0059307A
Part of subcall function 0059304E: _wcslen.LIBCMT ref: 0059309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00591112
WSAGetLastError.WSOCK32 ref: 00591121
WSAGetLastError.WSOCK32 ref: 005911C9
closesocket.WSOCK32(00000000), ref: 005911F9

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 52c1d0984418bdefbaf55567892f54968910bd33872977c18160b35f4cdbc218
Instruction ID: 04beafee710abd91a90cd2a77743609229ea6634105e9c3ca98ffbced2de8dcd
Opcode Fuzzy Hash: 52c1d0984418bdefbaf55567892f54968910bd33872977c18160b35f4cdbc218
Instruction Fuzzy Hash: 7C412531600616AFEB109F14C888BA9BFE9FF85324F148059FD169B291C774ED85DBE4

Function 0057CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0057CF22,?), ref: 0057DDFD

Part of subcall function 0057DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0057CF22,?), ref: 0057DE16

lstrcmpiW.KERNEL32(?,?), ref: 0057CF45
MoveFileW.KERNEL32(?,?), ref: 0057CF7F
_wcslen.LIBCMT ref: 0057D005
_wcslen.LIBCMT ref: 0057D01B
SHFileOperationW.SHELL32(?), ref: 0057D061

Strings

\*.*, xrefs: 0057CFF3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: b2adf41d0e0980f70a79bc6dd2825a0315901cbbea0c00f4b0856cc63b38b3cf
Instruction ID: ada66f8667195852e43d9519554c622855c0565a0c124dc18f69882a95181e2f
Opcode Fuzzy Hash: b2adf41d0e0980f70a79bc6dd2825a0315901cbbea0c00f4b0856cc63b38b3cf
Instruction Fuzzy Hash: FA4158719052195FDF12EFA4D985BDD7FB8BF49340F0040E6E509E7141EA34A688DB50

Function 005A2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 005A2E1C
GetWindowLongW.USER32(?,000000F0), ref: 005A2E4F
GetWindowLongW.USER32(?,000000F0), ref: 005A2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 005A2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 005A2EE0
GetWindowLongW.USER32(?,000000F0), ref: 005A2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005A2F0B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: a10d1cbca326467a2bf8d54234813347081dd57b8fbb8e05d43d1b0f40771c60
Instruction ID: 1ece014ebc33cc210ac4a3980a161cae4336022ef94b4a8af5ac0834027a5871
Opcode Fuzzy Hash: a10d1cbca326467a2bf8d54234813347081dd57b8fbb8e05d43d1b0f40771c60
Instruction Fuzzy Hash: EC31E230604150AFDB25CF5CDC86F693BE9FBAA710F150164F944CF2A2CB71A884EB41

Function 00577726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00577769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0057778F
SysAllocString.OLEAUT32(00000000), ref: 00577792
SysAllocString.OLEAUT32(?), ref: 005777B0
SysFreeString.OLEAUT32(?), ref: 005777B9
StringFromGUID2.OLE32(?,?,00000028), ref: 005777DE
SysAllocString.OLEAUT32(?), ref: 005777EC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 30a8af65b575c4b32c49ff329ad1760fcc9de2236d179f69995b760978716db4
Instruction ID: 2c3f50426a146e8d2bc7d00069235f1cea404695fe4d317a572107786424b804
Opcode Fuzzy Hash: 30a8af65b575c4b32c49ff329ad1760fcc9de2236d179f69995b760978716db4
Instruction Fuzzy Hash: CA21AE7660421DAFDF14DFA8EC88CBB7BACFB0E3647008425BA18DB190D670DC469764

Function 005777FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00577842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00577868
SysAllocString.OLEAUT32(00000000), ref: 0057786B
SysAllocString.OLEAUT32 ref: 0057788C
SysFreeString.OLEAUT32 ref: 00577895
StringFromGUID2.OLE32(?,?,00000028), ref: 005778AF
SysAllocString.OLEAUT32(?), ref: 005778BD

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: cc185604e047de12a57dd6470c16ed096679ee3e92bbbc545b7fb8b96b268a20
Instruction ID: f04f6c16220ee9e93ed60939c5d961383f60e93ca6d7507fa7efb3135eb97a5d
Opcode Fuzzy Hash: cc185604e047de12a57dd6470c16ed096679ee3e92bbbc545b7fb8b96b268a20
Instruction Fuzzy Hash: A0215E31608219AF9F109BA8EC8CDBA7BECFB0D7607108125B919CB2A1DA74DC45DB65

Function 005804D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 005804F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0058052E

Strings

nul, xrefs: 00580567

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 9163fb88ef69ad07d9bcbf2d9abde371c666f0f824b76126871922de985afc78
Instruction ID: 9c7d3147b386a8114e02b5750a2c6f5bd12c813dd4f1ddfa126cea67167ce39d
Opcode Fuzzy Hash: 9163fb88ef69ad07d9bcbf2d9abde371c666f0f824b76126871922de985afc78
Instruction Fuzzy Hash: 90212C75600305AFDF60AF69D844A9A7FE4BF55724F204A19ECA1E62E0E7709948DF30

Function 005805A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 005805C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00580601

Strings

nul, xrefs: 00580639

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 469c7f529e6904b28756ad76fc6052d83c925d50faf29598e57948f3ca456fbc
Instruction ID: e5c723a863d6c6fe7cf82ad9c551b56497688e16fb38169c5e756eea4dd4cab2
Opcode Fuzzy Hash: 469c7f529e6904b28756ad76fc6052d83c925d50faf29598e57948f3ca456fbc
Instruction Fuzzy Hash: AB2153755003059FDB60AF6A9C04A6A7FE4BF95720F205B19FCA1F72E0E7709969CB20

Function 005A40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0051600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0051604C
Part of subcall function 0051600E: GetStockObject.GDI32(00000011), ref: 00516060
Part of subcall function 0051600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0051606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 005A4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 005A411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 005A412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 005A4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 005A4145

Strings

Msctls_Progress32, xrefs: 005A40E3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 12330973ad5a0c88b0ba4e5418dedbe544a927d7a456d07af947f54c5f628b4f
Instruction ID: cb4d0cc8cb859647043195d014e59a02076571dedb0c9a3cb7cb2736a4013ce4
Opcode Fuzzy Hash: 12330973ad5a0c88b0ba4e5418dedbe544a927d7a456d07af947f54c5f628b4f
Instruction Fuzzy Hash: 8311B6B114011D7EEF118FA4CC85EEB7F5DFF59798F004111B618A6150C6729C61DBA4

Function 0054D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0054D7A3: _free.LIBCMT ref: 0054D7CC

_free.LIBCMT ref: 0054D82D

Part of subcall function 005429C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000), ref: 005429DE
Part of subcall function 005429C8: GetLastError.KERNEL32(00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000,00000000), ref: 005429F0

_free.LIBCMT ref: 0054D838
_free.LIBCMT ref: 0054D843
_free.LIBCMT ref: 0054D897
_free.LIBCMT ref: 0054D8A2
_free.LIBCMT ref: 0054D8AD
_free.LIBCMT ref: 0054D8B8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 417ec84ad38db8e74e8797b67926e58fb58d938e5b93832e5d11f6772c22c25f
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 1B114F71540B15ABE921BFB1CC4BFCB7FFCBF80704F800825B29DA6192DA79B5454660

Function 0057DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0057DA74
LoadStringW.USER32(00000000), ref: 0057DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0057DA91
LoadStringW.USER32(00000000), ref: 0057DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0057DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0057DAB9

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: a3e50674b9392eec5578a4a4c1b0e4618bff2f7d6d3b45e7e0f1088cc93f5f71
Instruction ID: 47a6e13620e782190c6b3c9374313eeff20332fda4825a87478aa119a98b56a1
Opcode Fuzzy Hash: a3e50674b9392eec5578a4a4c1b0e4618bff2f7d6d3b45e7e0f1088cc93f5f71
Instruction Fuzzy Hash: 560167F25002087FEB10D7A49D89EEB3BBCFB05301F404456B709E2041E6749E849F74

Function 0058096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00DFE448,00DFE448), ref: 0058097B
EnterCriticalSection.KERNEL32(00DFE428,00000000), ref: 0058098D
TerminateThread.KERNEL32(?,000001F6), ref: 0058099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 005809A9
CloseHandle.KERNEL32(?), ref: 005809B8
InterlockedExchange.KERNEL32(00DFE448,000001F6), ref: 005809C8
LeaveCriticalSection.KERNEL32(00DFE428), ref: 005809CF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 66175c213383191e2dcd659fa7aa0d598061f62dae75511bcaf649f8666eeec4
Instruction ID: 0b7a1e224bf35d8a7f398d5ecd0e6b4f17d5088d86843c90ea5afdf2fb671657
Opcode Fuzzy Hash: 66175c213383191e2dcd659fa7aa0d598061f62dae75511bcaf649f8666eeec4
Instruction Fuzzy Hash: 57F03C32542A02BBD7415FA4EE8CBE6BF39FF12702F402025F202A18A0CB749469DF90

Function 00591C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00591DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00591DE1
WSAGetLastError.WSOCK32 ref: 00591DF2
htons.WSOCK32(?,?,?,?,?), ref: 00591EDB
inet_ntoa.WSOCK32(?), ref: 00591E8C

Part of subcall function 005739E8: _strlen.LIBCMT ref: 005739F2

Part of subcall function 00593224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0058EC0C), ref: 00593240

_strlen.LIBCMT ref: 00591F35

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: cf6577ee4f7a38fff55593b393db931ccfe35cd0f82124800aa7607a20fa64d7
Instruction ID: f6c090ac83c268da4f1ecb23090663e86ae2e228c682cf52d9d3a2e99914afd1
Opcode Fuzzy Hash: cf6577ee4f7a38fff55593b393db931ccfe35cd0f82124800aa7607a20fa64d7
Instruction Fuzzy Hash: 19B1ED31204712AFDB24DF24C889E6A7FA5BF85318F54894CF4564B2E2DB31ED82CB91

Function 00515D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00515D30
GetWindowRect.USER32(?,?), ref: 00515D71
ScreenToClient.USER32(?,?), ref: 00515D99
GetClientRect.USER32(?,?), ref: 00515ED7
GetWindowRect.USER32(?,?), ref: 00515EF8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 55ba09df899d0c638a916fd0e56a3c414496e136664193bddbebce17eb8d1f6b
Instruction ID: c7d7fc1143cd14310f257dc9f45e312d369d90796f03a5c7a261fc8d267bacc6
Opcode Fuzzy Hash: 55ba09df899d0c638a916fd0e56a3c414496e136664193bddbebce17eb8d1f6b
Instruction Fuzzy Hash: 92B17C34A0074ADBDB10CFA8C4807EEBBF5FF58314F14891AE8A9D7250E730AA95DB50

Function 005401B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 005400BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005400D6
__allrem.LIBCMT ref: 005400ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054010B
__allrem.LIBCMT ref: 00540122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00540140

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 8e23473207f57ba74eec83dc3c1ed4eca54db54e1dc9b9ce217cb2f8d7501e95
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: B081F871A007069BE724AE39CC49BAB7FE9BF91328F24553AF951D76C1E770D9008B50

Function 005461FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,005382D9,005382D9,?,?,?,0054644F,00000001,00000001,8BE85006), ref: 00546258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0054644F,00000001,00000001,8BE85006,?,?,?), ref: 005462DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 005463D8
__freea.LIBCMT ref: 005463E5

Part of subcall function 00543820: RtlAllocateHeap.NTDLL(00000000,?,005E1444,?,0052FDF5,?,?,0051A976,00000010,005E1440,005113FC,?,005113C6,?,00511129), ref: 00543852

__freea.LIBCMT ref: 005463EE
__freea.LIBCMT ref: 00546413

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: aaab3657ba961c92df682226c7d01fa4ad07365ca3ccf535e5004d626b7b0eb4
Instruction ID: 3fbf251d5f23bc9fb632ed8b9185025db5f5fafee3f0279a8ec4fe322b68717f
Opcode Fuzzy Hash: aaab3657ba961c92df682226c7d01fa4ad07365ca3ccf535e5004d626b7b0eb4
Instruction Fuzzy Hash: 5751DE72600256ABEB258E64DC85FEF7FA9FB86718F144A29F805D7190DB34DC40C6A1

Function 0059BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 0059C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0059B6AE,?,?), ref: 0059C9B5
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059C9F1
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059CA68
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0059BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0059BD25
RegCloseKey.ADVAPI32(00000000), ref: 0059BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0059BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0059BDF3
RegCloseKey.ADVAPI32(?), ref: 0059BDFF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: dee6fc16c76a1dc00b263237ad1ed706076fb4e4da9cbd0a05baec74b5c1a870
Instruction ID: 2a9319274df48716c95288e4857821f2f203e22104ad1a171ec66022f79a0c6c
Opcode Fuzzy Hash: dee6fc16c76a1dc00b263237ad1ed706076fb4e4da9cbd0a05baec74b5c1a870
Instruction Fuzzy Hash: 7B819D30108242AFE714DF24D995E6ABFE9FF85308F14895CF4594B2A2DB31ED45CB92

Function 0056F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0056F7B9
SysAllocString.OLEAUT32(00000001), ref: 0056F860
VariantCopy.OLEAUT32(0056FA64,00000000), ref: 0056F889
VariantClear.OLEAUT32(0056FA64), ref: 0056F8AD
VariantCopy.OLEAUT32(0056FA64,00000000), ref: 0056F8B1
VariantClear.OLEAUT32(?), ref: 0056F8BB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: f817c579a5261397b4948ee04a2e17cf52ee271edbbce01a0ff72a991b5af2cd
Instruction ID: bd3130b51eb21b362942704d5d13f4857b70a6ea9e97e5f70fdf2f0b091cf2e1
Opcode Fuzzy Hash: f817c579a5261397b4948ee04a2e17cf52ee271edbbce01a0ff72a991b5af2cd
Instruction Fuzzy Hash: AA51C831E00311BBDF20AB65F899B69BFA9FF95310F245866E905DF291DB708C40C766

Function 0058910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00517620: _wcslen.LIBCMT ref: 00517625

Part of subcall function 00516B57: _wcslen.LIBCMT ref: 00516B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 005894E5
_wcslen.LIBCMT ref: 00589506
_wcslen.LIBCMT ref: 0058952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00589585

Strings

X, xrefs: 00589412

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 3c872663824bfd4400dc09ac030b393a0e9e2f6d2ee94d2bb4425de111b9c2d7
Instruction ID: 11df7cf4072da922e408185763d5ec414add65fba783ca5403043dd5de1535b1
Opcode Fuzzy Hash: 3c872663824bfd4400dc09ac030b393a0e9e2f6d2ee94d2bb4425de111b9c2d7
Instruction Fuzzy Hash: 51E1B5315043019FD714EF24C885AAEBBE4BFC5314F18896DF8999B2A2DB31ED45CB92

Function 0052920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00529BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00529BB2

BeginPaint.USER32(?,?,?), ref: 00529241
GetWindowRect.USER32(?,?), ref: 005292A5
ScreenToClient.USER32(?,?), ref: 005292C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 005292D3
EndPaint.USER32(?,?,?,?,?), ref: 00529321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 005671EA

Part of subcall function 00529339: BeginPath.GDI32(00000000), ref: 00529357

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 600491df042dabb187265537b9008f717c858d08481e37eaf564b22aa9983ebe
Instruction ID: 027379cd50156cfc62f615645239b1b77b58bb2120b6ee5cc23bfec4bf28e176
Opcode Fuzzy Hash: 600491df042dabb187265537b9008f717c858d08481e37eaf564b22aa9983ebe
Instruction Fuzzy Hash: C1419F31104255AFD710DF24D884FBA7FA8FFAA724F140629F994CB2E2C7309849EB61

Function 005807EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0058080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00580847
EnterCriticalSection.KERNEL32(?), ref: 00580863
LeaveCriticalSection.KERNEL32(?), ref: 005808DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 005808F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00580921

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 5b3b7a8bcfec88480fe6c2be9df9e9d4d0eb08c86ae5981afdee7790d539bb41
Instruction ID: 4500ba0523c5062cea205dafcd198b214d5d59c943d0a2c7110aba8eaec8f3da
Opcode Fuzzy Hash: 5b3b7a8bcfec88480fe6c2be9df9e9d4d0eb08c86ae5981afdee7790d539bb41
Instruction Fuzzy Hash: 34415B71A00205EBDF55AF54EC85AAA7B78FF45310F1440B9ED00AA297DB30DE69DBA0

Function 005A81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0056F3AB,00000000,?,?,00000000,?,0056682C,00000004,00000000,00000000), ref: 005A824C
EnableWindow.USER32(?,00000000), ref: 005A8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 005A82D1
ShowWindow.USER32(?,00000004), ref: 005A82E5
EnableWindow.USER32(?,00000001), ref: 005A830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 005A832F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 302fec1ea4a281543b8c0a1868243c3f5b1eb525ff7c0e8d4391959ef76cc2c5
Instruction ID: 1e32dd9f8b9f24350eac1461971b1f38191ecfe6c4d8894e7d7143417267ca4d
Opcode Fuzzy Hash: 302fec1ea4a281543b8c0a1868243c3f5b1eb525ff7c0e8d4391959ef76cc2c5
Instruction Fuzzy Hash: BC419F34601A44AFDF25CF14DC99BB87FE0BF5BB14F1851A9E6488F2A2CB31A845DB50

Function 00574C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00574C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00574CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00574CEA
_wcslen.LIBCMT ref: 00574D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00574D10
_wcsstr.LIBVCRUNTIME ref: 00574D1A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: a49d60e4cd63a45b0a780c4355234476869504beadc5f3e67331c6e240159dcd
Instruction ID: ea13f0270ee074d96add9a742b390796300102f201a5ab985024bad39e9a3012
Opcode Fuzzy Hash: a49d60e4cd63a45b0a780c4355234476869504beadc5f3e67331c6e240159dcd
Instruction Fuzzy Hash: BD21DA31204111BBEB269B39BC49E7B7FACEF46750F108079F809CE191EB61DC00ABA0

Function 0058581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00513AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00513A97,?,?,00512E7F,?,?,?,00000000), ref: 00513AC2

_wcslen.LIBCMT ref: 0058587B
CoInitialize.OLE32(00000000), ref: 00585995
CoCreateInstance.OLE32(005AFCF8,00000000,00000001,005AFB68,?), ref: 005859AE
CoUninitialize.OLE32 ref: 005859CC

Strings

.lnk, xrefs: 00585876, 005858C1, 00585985

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 66add4af07420ba6520e94311120401a5537471fe4e827a8e4178f8d80feeec8
Instruction ID: df1f498cf2d8dc26ba8d104b54e7ceb7076030961fc1a982c014677c50aa6180
Opcode Fuzzy Hash: 66add4af07420ba6520e94311120401a5537471fe4e827a8e4178f8d80feeec8
Instruction Fuzzy Hash: 7DD155716046029FC714EF24C484A6ABBF6FF89715F14485DF88AAB361EB31EC45CB92

Function 0057175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00570FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00570FCA
Part of subcall function 00570FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00570FD6
Part of subcall function 00570FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00570FE5
Part of subcall function 00570FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00570FEC
Part of subcall function 00570FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00571002

GetLengthSid.ADVAPI32(?,00000000,00571335), ref: 005717AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 005717BA
HeapAlloc.KERNEL32(00000000), ref: 005717C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 005717DA
GetProcessHeap.KERNEL32(00000000,00000000,00571335), ref: 005717EE
HeapFree.KERNEL32(00000000), ref: 005717F5

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 4da0a6e0e45fd49973f8ec42e1f887c681cf1f5190ee6c258dc5d49234eb325e
Instruction ID: a306c3febc59018670b8c3e746feebefba4651decdf4236d2cc456a286eb8a99
Opcode Fuzzy Hash: 4da0a6e0e45fd49973f8ec42e1f887c681cf1f5190ee6c258dc5d49234eb325e
Instruction Fuzzy Hash: 7111BE71600605FFDB189FA8EC49BAE7FA9FB42355F108018F44597210C735A948EB64

Function 005714CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 005714FF
OpenProcessToken.ADVAPI32(00000000), ref: 00571506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00571515
CloseHandle.KERNEL32(00000004), ref: 00571520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0057154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00571563

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 0c0604779c7198e041c0ac53323d7efa6ea176cf0264872020bb5f81644529f7
Instruction ID: 3de88d6edb35001512216c03d84204cd82d6485c888df2724c75c87a67a78cfc
Opcode Fuzzy Hash: 0c0604779c7198e041c0ac53323d7efa6ea176cf0264872020bb5f81644529f7
Instruction Fuzzy Hash: FF112972500209ABDF118F98ED49FDE7FAAFF49744F048059FA09A2160C3758E68EB64

Function 00533382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00533379,00532FE5), ref: 00533390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0053339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005333B7
SetLastError.KERNEL32(00000000,?,00533379,00532FE5), ref: 00533409

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0814a7d5790b763d352e923930218a73e478aee21eca2a61569909e4f3576635
Instruction ID: f693e8de9a1fddd44ff4ea10a9246f772a41f29b1619651dd54edb8fdbc2cff6
Opcode Fuzzy Hash: 0814a7d5790b763d352e923930218a73e478aee21eca2a61569909e4f3576635
Instruction Fuzzy Hash: 4201243320A313BEAB2527757C8E66B6F94FB65379F20862BF411812F0EF115D09E544

Function 00542D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00545686,00553CD6,?,00000000,?,00545B6A,?,?,?,?,?,0053E6D1,?,005D8A48), ref: 00542D78
_free.LIBCMT ref: 00542DAB
_free.LIBCMT ref: 00542DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0053E6D1,?,005D8A48,00000010,00514F4A,?,?,00000000,00553CD6), ref: 00542DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0053E6D1,?,005D8A48,00000010,00514F4A,?,?,00000000,00553CD6), ref: 00542DEC
_abort.LIBCMT ref: 00542DF2

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 62cfb83b7b5bef5b7d563da29e61da4aeff2f3a90bfebd958c39198c6cdece49
Instruction ID: f5cbab5f9bf341c041b5f3053ea48a15feefdc3825c3808692b893db0908a8b7
Opcode Fuzzy Hash: 62cfb83b7b5bef5b7d563da29e61da4aeff2f3a90bfebd958c39198c6cdece49
Instruction Fuzzy Hash: 02F0F935905A2227C72223356C0EBDA3E65BFD276CF640416F424921D1DE7088065120

Function 005A8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00529639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00529693
Part of subcall function 00529639: SelectObject.GDI32(?,00000000), ref: 005296A2
Part of subcall function 00529639: BeginPath.GDI32(?), ref: 005296B9
Part of subcall function 00529639: SelectObject.GDI32(?,00000000), ref: 005296E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 005A8A4E
LineTo.GDI32(?,00000003,00000000), ref: 005A8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 005A8A70
LineTo.GDI32(?,00000000,00000003), ref: 005A8A80
EndPath.GDI32(?), ref: 005A8A90
StrokePath.GDI32(?), ref: 005A8AA0

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 880811f625384f7cafed96dc88a10d03216ccd5bd4fa63b78743ad497293b7c0
Instruction ID: d6a9bafa926ed9261b32c204509212f39831f4894a095bc47e0e22db3f1a9880
Opcode Fuzzy Hash: 880811f625384f7cafed96dc88a10d03216ccd5bd4fa63b78743ad497293b7c0
Instruction Fuzzy Hash: 12110976000149FFDB129F90DC88EAE7FACFB1A350F008052BA199A1A1C7719D59EBA0

Function 005751FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00575218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00575229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00575230
ReleaseDC.USER32(00000000,00000000), ref: 00575238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0057524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00575261

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: ce413d83f2e67e5c5b2219b6865e6ddd81dea95bc3f1141dc53e6be5b01bbaae
Instruction ID: ad0b1388eaca1b18f430a971a13d0f30a7ef8ad6dc48fd6bf1e412b1780d21bf
Opcode Fuzzy Hash: ce413d83f2e67e5c5b2219b6865e6ddd81dea95bc3f1141dc53e6be5b01bbaae
Instruction Fuzzy Hash: 34014F75E00719BBEB109FA59C49A5EBFB8FB59751F044065FA04A7281D6709C04DBA0

Function 00511BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00511BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00511BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00511C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00511C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00511C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00511C22

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: b6fc38aaa8901985c9f2a787d21690b57a47ac0ad622e25252784ae949c0b537
Instruction ID: 8104bd8a3a16777a0100d31c6e56535fe1fec174e2b76d9ba146ccab654f1ad9
Opcode Fuzzy Hash: b6fc38aaa8901985c9f2a787d21690b57a47ac0ad622e25252784ae949c0b537
Instruction Fuzzy Hash: 56016CB09027597DE3008F5A8C85B52FFE8FF19354F04411B915C4B941C7F5A864CBE5

Function 0057EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0057EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0057EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0057EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0057EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0057EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0057EB75

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: cb8b2c5986061f3ecbe7529d368d2e85f1512affa14f6e349cd04dc55f1f8ae4
Instruction ID: fc39b818e2df40502db5299f8939906dcd16140d734222746a9f8807cb6daf27
Opcode Fuzzy Hash: cb8b2c5986061f3ecbe7529d368d2e85f1512affa14f6e349cd04dc55f1f8ae4
Instruction Fuzzy Hash: E4F05E72240158BFE7219B669C0EEEF3E7CEFDBB11F004159F601D6091EBA05A05E6B5

Function 00567439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00567452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00567469
GetWindowDC.USER32(?), ref: 00567475
GetPixel.GDI32(00000000,?,?), ref: 00567484
ReleaseDC.USER32(?,00000000), ref: 00567496
GetSysColor.USER32(00000005), ref: 005674B0

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 2ded65c8e3c2f113880d184c2ae073f1e8081e6a7966a9bfc89ba16d13495d4a
Instruction ID: d1812f9935a0adfe8a119fd6e5cfcef09dae11d2db8d67be07d1dd61e9215de1
Opcode Fuzzy Hash: 2ded65c8e3c2f113880d184c2ae073f1e8081e6a7966a9bfc89ba16d13495d4a
Instruction Fuzzy Hash: 71018B31400219EFDB109F64DD08BAA7FB5FF19312F1004A0FA16A31A0CF311E45EB50

Function 00571874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0057187F
UnloadUserProfile.USERENV(?,?), ref: 0057188B
CloseHandle.KERNEL32(?), ref: 00571894
CloseHandle.KERNEL32(?), ref: 0057189C
GetProcessHeap.KERNEL32(00000000,?), ref: 005718A5
HeapFree.KERNEL32(00000000), ref: 005718AC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 7b1f133492d5ece76174093fd546ca3583e09e08d24f743fd9ffd3a0e52d2b78
Instruction ID: 53388d2a26a516a9766c5c590047ea269dd84adecef78addd8aa7507263693c6
Opcode Fuzzy Hash: 7b1f133492d5ece76174093fd546ca3583e09e08d24f743fd9ffd3a0e52d2b78
Instruction Fuzzy Hash: 63E0E536204101BBDB015FA1ED0C90ABF79FF6AB22B108625F22581070CB329425EF50

Function 0051BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0051BEB3

Strings

D%^, xrefs: 0051BDED, 0051BD91, 0051BD1B
D%^, xrefs: 0051BCA2
D%^D%^, xrefs: 0051BCA5
D%^, xrefs: 0051BE9A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%^$D%^$D%^$D%^D%^
API String ID: 1385522511-1929028606
Opcode ID: ee0637ec5ae8d1e99c32a99323fdec80142ee181e792a72d4f7fcefe397a9730
Instruction ID: 6f991f027e25756a3003fd0b7dcf529f9e945aea5314bd44430ac6a76bf9f4a1
Opcode Fuzzy Hash: ee0637ec5ae8d1e99c32a99323fdec80142ee181e792a72d4f7fcefe397a9730
Instruction Fuzzy Hash: D6913875A0020ACFEB18CF59C0906EABBF1FF58314F24856AD985AB351E731AD81DBD0

Function 00597B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00530242: EnterCriticalSection.KERNEL32(005E070C,005E1884,?,?,0052198B,005E2518,?,?,?,005112F9,00000000), ref: 0053024D
Part of subcall function 00530242: LeaveCriticalSection.KERNEL32(005E070C,?,0052198B,005E2518,?,?,?,005112F9,00000000), ref: 0053028A

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 005300A3: __onexit.LIBCMT ref: 005300A9

__Init_thread_footer.LIBCMT ref: 00597BFB

Part of subcall function 005301F8: EnterCriticalSection.KERNEL32(005E070C,?,?,00528747,005E2514), ref: 00530202
Part of subcall function 005301F8: LeaveCriticalSection.KERNEL32(005E070C,?,00528747,005E2514), ref: 00530235

Strings

G, xrefs: 00597C7F
Variable must be of type 'Object'., xrefs: 00597C3A
+TV, xrefs: 00597E2E
5, xrefs: 00597C78

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +TV$5$G$Variable must be of type 'Object'.
API String ID: 535116098-200929741
Opcode ID: dd743e6b6e7f38b893b0408a6e180171b09f691def82274124626138dbd991bb
Instruction ID: 5f0fb7d791387c32185073a1c367636e123ab176c65c60e18ac2b4aa22c28088
Opcode Fuzzy Hash: dd743e6b6e7f38b893b0408a6e180171b09f691def82274124626138dbd991bb
Instruction Fuzzy Hash: 8A919D74A1420AEFCF04EF54D8959ADBFB5FF89300F14845AF8469B292DB71AE81CB50

Function 0057C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00517620: _wcslen.LIBCMT ref: 00517625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0057C6EE
_wcslen.LIBCMT ref: 0057C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0057C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0057C7CA

Strings

0, xrefs: 0057C6AF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 1fd072547dfd703c48e03b3ceb279b8f33465d885e4f2eec45220a6a42710356
Instruction ID: a3dda11ab15fac253c6db574705e2fd073e956b4adf7794585aac684035722c4
Opcode Fuzzy Hash: 1fd072547dfd703c48e03b3ceb279b8f33465d885e4f2eec45220a6a42710356
Instruction Fuzzy Hash: 9C51DF716043019BD7199F28E889B6B7FE8FF89310F048A2DF999D31D1DB70D944AB52

Function 0059AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0059AEA3

Part of subcall function 00517620: _wcslen.LIBCMT ref: 00517625

GetProcessId.KERNEL32(00000000), ref: 0059AF38
CloseHandle.KERNEL32(00000000), ref: 0059AF67

Strings

@, xrefs: 0059AE72
<, xrefs: 0059AE6B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: df3c24d522953f29ada620cc846509c2e90526cc4d425526d93c8ec66ad93cb9
Instruction ID: 90671fb062b8a2f915692e78eef52098666e0e30d31774189c009a972bd22642
Opcode Fuzzy Hash: df3c24d522953f29ada620cc846509c2e90526cc4d425526d93c8ec66ad93cb9
Instruction Fuzzy Hash: 55715574A0021A9FDF14DF54C488A9EBBF5FF48300F048499E816AB392DB31ED85CBA1

Function 0057719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00577206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0057723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0057724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 005772CF

Strings

DllGetClassObject, xrefs: 00577242

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 80f6784be5d728d7666e60af358c3003d011ee086498d1c3f4699d5c60d96ee3
Instruction ID: da2a720d7b9e695153c1b04487fd3d582e97116edaf2c8853fbfc902e3e55f44
Opcode Fuzzy Hash: 80f6784be5d728d7666e60af358c3003d011ee086498d1c3f4699d5c60d96ee3
Instruction Fuzzy Hash: BE417F75604208EFDB15CF54E884A9A7FB9FF49310F14C4A9BD199F20AD7B0DA44EBA0

Function 005A3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005A3E35
IsMenu.USER32(?), ref: 005A3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 005A3E92
DrawMenuBar.USER32 ref: 005A3EA5

Strings

0, xrefs: 005A3D89

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 1bceec80553098125193177f9fca3ba96c71b585e905496f9ab3174f2a8371fb
Instruction ID: 6be0cb3900492b489e7d8b38080c9504939d65d214191f6a9dae164730f321f5
Opcode Fuzzy Hash: 1bceec80553098125193177f9fca3ba96c71b585e905496f9ab3174f2a8371fb
Instruction Fuzzy Hash: C3413875A01209EFDB10DF50E884AEEBBB9FF4A359F04412AF905AB250D730AE54DF50

Function 00571DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 00573CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00573CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00571E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00571E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00571EA9

Part of subcall function 00516B57: _wcslen.LIBCMT ref: 00516B6A

Strings

ListBox, xrefs: 00571E25
ComboBox, xrefs: 00571DF0

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: f287664d431fd0abb18ec9700a7f7a8d701f0ba397c8fb942309107aacc1d798
Instruction ID: 892e5f3c202c9373ec246605e7e8a0d623a05e3ad30fdf0578eba26b9ef320ff
Opcode Fuzzy Hash: f287664d431fd0abb18ec9700a7f7a8d701f0ba397c8fb942309107aacc1d798
Instruction Fuzzy Hash: 42210A71900105BAEB149B68EC5ACFF7FBCFF86390B108529FC59A72D1DB344D49A660

Function 005A2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 005A2F8D
LoadLibraryW.KERNEL32(?), ref: 005A2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 005A2FA9
DestroyWindow.USER32(?), ref: 005A2FB1

Strings

SysAnimate32, xrefs: 005A2F68

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 03ab5e489a4027317a90e1f0d6a2ae0bb6f6a0279b32785d7187ffa461151d4c
Instruction ID: 96ab904e3b7256b38d47e8eba9819b34847afc57450e7fba80572e2985b0c4f6
Opcode Fuzzy Hash: 03ab5e489a4027317a90e1f0d6a2ae0bb6f6a0279b32785d7187ffa461151d4c
Instruction Fuzzy Hash: CF219A71204209AFEB108F68DC87EBF3BB9FB5A364F104619FA50D6190D771DC91AB60

Function 00534D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00534D1E,005428E9,?,00534CBE,005428E9,005D88B8,0000000C,00534E15,005428E9,00000002), ref: 00534D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00534DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00534D1E,005428E9,?,00534CBE,005428E9,005D88B8,0000000C,00534E15,005428E9,00000002,00000000), ref: 00534DC3

Strings

mscoree.dll, xrefs: 00534D86
CorExitProcess, xrefs: 00534D98

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 974339bd7cf61aa76d78f159d82908e21f210110e3a7a5bedf94b514405cbfd3
Instruction ID: 692752c2c850a5c8ed03e6f098b84b58c0440c771ae0dc7cf6b7e5924add74c1
Opcode Fuzzy Hash: 974339bd7cf61aa76d78f159d82908e21f210110e3a7a5bedf94b514405cbfd3
Instruction Fuzzy Hash: CDF03C34A40209ABDB119B94DC49BAEBFE5FB54751F0001A5E806A62A0CB70A944DE90

Function 00514E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00514EDD,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00514EAE
FreeLibrary.KERNEL32(00000000,?,?,00514EDD,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00514EA8
kernel32.dll, xrefs: 00514E94

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 5d36be5614eb4e6998002b964ab54e41cd091c887bffed96b6f490ff2449181c
Instruction ID: 16283ffd9647496279248e6936e60fcdeb8308ace92cc0f5365f1196ffeef1e6
Opcode Fuzzy Hash: 5d36be5614eb4e6998002b964ab54e41cd091c887bffed96b6f490ff2449181c
Instruction Fuzzy Hash: 54E08635B016225BE33117257C18B9F7E58BF93B627050215FC04D2200DB60CD4598A2

Function 00514E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00553CDE,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00514E74
FreeLibrary.KERNEL32(00000000,?,?,00553CDE,?,005E1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00514E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00514E6E
kernel32.dll, xrefs: 00514E5B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 8b0b7506932a8cdee092e827fff0d333b0eeb814c379298c8e358e1370f63e03
Instruction ID: c00cc8ec08d002cd9b4a5957fddf67c7e2e60ced3bcc97b4d2ec27bf5b7f19f1
Opcode Fuzzy Hash: 8b0b7506932a8cdee092e827fff0d333b0eeb814c379298c8e358e1370f63e03
Instruction Fuzzy Hash: 17D0123560262257A7321B257C18DCF7E1CBF87B513050715F905A6214DF61CD46D9E1

Function 00582947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00582C05
DeleteFileW.KERNEL32(?), ref: 00582C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00582C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00582CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00582CC0

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: c9265f0dc7b09e6f7b65cdb07604ec9e22f9c21fcc421de5ee2fbd8f50c0f2ff
Instruction ID: d8a466fde6715d192c1b25391eab9c62b1a2b36353e92d2b34031b6139532f0e
Opcode Fuzzy Hash: c9265f0dc7b09e6f7b65cdb07604ec9e22f9c21fcc421de5ee2fbd8f50c0f2ff
Instruction Fuzzy Hash: 99B1417190111AABDF15EBA4CC89EEE7FBDFF89350F1040A6F909F6141EA319A448F61

Function 0059A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0059A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0059A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0059A468
CloseHandle.KERNEL32(?), ref: 0059A63D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 70071c8f94f8d9fdefe7975291c013445fed951f668cd860608ae6e87da2c9fc
Instruction ID: a1d191c2bac256b3c28d0f258f2a557af3329cf0ad95e8c8a8494c0d65edd18f
Opcode Fuzzy Hash: 70071c8f94f8d9fdefe7975291c013445fed951f668cd860608ae6e87da2c9fc
Instruction Fuzzy Hash: BCA160716043019FEB20DF24D88AB2ABBE5BF84714F14885DF55A9B3D2DB71EC418B92

Function 0054BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,005B3700), ref: 0054BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,005E121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0054BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,005E1270,000000FF,?,0000003F,00000000,?), ref: 0054BC36
_free.LIBCMT ref: 0054BB7F

Part of subcall function 005429C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000), ref: 005429DE
Part of subcall function 005429C8: GetLastError.KERNEL32(00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000,00000000), ref: 005429F0

_free.LIBCMT ref: 0054BD4B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 017de7a3d97c3c82398593e4bc13c1b7bb4e02e70dfa46924d1dc0338f07028f
Instruction ID: 6458ec65f0ef44d81316055b1b86e12903526851099121acaf2fa9c6b05f6472
Opcode Fuzzy Hash: 017de7a3d97c3c82398593e4bc13c1b7bb4e02e70dfa46924d1dc0338f07028f
Instruction Fuzzy Hash: D951E47190020AABEB14EF669CC59EEBFB8FB90318B10066AE554D7291EB30DE459B50

Function 0057E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0057CF22,?), ref: 0057DDFD

Part of subcall function 0057DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0057CF22,?), ref: 0057DE16

Part of subcall function 0057E199: GetFileAttributesW.KERNEL32(?,0057CF95), ref: 0057E19A

lstrcmpiW.KERNEL32(?,?), ref: 0057E473
MoveFileW.KERNEL32(?,?), ref: 0057E4AC
_wcslen.LIBCMT ref: 0057E5EB
_wcslen.LIBCMT ref: 0057E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0057E650

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 1ca2ea8168c41e3a96d73ee7f9078b7d37f065beb2141432717f693e3f3fbaa5
Instruction ID: f7b32ffa0406c7e72e17dbb538541a1960531860fa7a35bfe44debbd196d8cad
Opcode Fuzzy Hash: 1ca2ea8168c41e3a96d73ee7f9078b7d37f065beb2141432717f693e3f3fbaa5
Instruction Fuzzy Hash: 125192B24083455BC724DB90E8969DF7BECBFC8340F00492EF689D3151EF75A6889766

Function 0059B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 0059C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0059B6AE,?,?), ref: 0059C9B5
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059C9F1
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059CA68
Part of subcall function 0059C998: _wcslen.LIBCMT ref: 0059CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0059BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0059BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0059BB63
RegCloseKey.ADVAPI32(?,?), ref: 0059BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0059BBB3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: ab358ccb64121e4d00b320407a521ea787e4b4bf072dc6102dfda4396054a205
Instruction ID: cdc935dd82569dc0e844e059fad9d4eec726ddd56382caa8f3be6678c7951da6
Opcode Fuzzy Hash: ab358ccb64121e4d00b320407a521ea787e4b4bf072dc6102dfda4396054a205
Instruction Fuzzy Hash: 8661B031208241AFE714DF24C594E6ABFE5FF84308F14895CF49A8B2A2DB31ED45CB92

Function 00578BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00578BCD
VariantClear.OLEAUT32 ref: 00578C3E
VariantClear.OLEAUT32 ref: 00578C9D
VariantClear.OLEAUT32(?), ref: 00578D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00578D3B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 281ad127c6f5b488f41dd9095753c0cfa24943926c3d3f92b3153a99f55794ce
Instruction ID: 7c80970e1213464221eb4496de8c75ebeb80294f245bfc2cd8b3f89fe0b275e7
Opcode Fuzzy Hash: 281ad127c6f5b488f41dd9095753c0cfa24943926c3d3f92b3153a99f55794ce
Instruction Fuzzy Hash: 415159B5A00219EFCB14CF68D894AAABBF8FF8D310B158559E909DB350E730E911CF90

Function 00588AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00588BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00588BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00588C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00588C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00588C5F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: bc5073d9dcf1f591bae4ac1b0e64fad05ea0508653aa4614ab250d7019c84637
Instruction ID: a19e350f6f286658c5e9b15f55307042e586999b4f5f3ad6ce430dbebeefcec4
Opcode Fuzzy Hash: bc5073d9dcf1f591bae4ac1b0e64fad05ea0508653aa4614ab250d7019c84637
Instruction Fuzzy Hash: 3D514C35A002199FDB05EF64C885AA9BFF5FF89314F098458E849AB362DB31ED51CB90

Function 00598EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00598F40
GetProcAddress.KERNEL32(00000000,?), ref: 00598FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00598FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00599032
FreeLibrary.KERNEL32(00000000), ref: 00599052

Part of subcall function 0052F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00581043,?,7644E610), ref: 0052F6E6
Part of subcall function 0052F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0056FA64,00000000,00000000,?,?,00581043,?,7644E610,?,0056FA64), ref: 0052F70D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 30bd0609d7893bdcba96d7795368c2ecc48da038254d8f637e30759a0fe88f98
Instruction ID: fbbef9e352b1613c8fa91f9117b92fae8a2c555a3f6b240144b2c7ccdc133f01
Opcode Fuzzy Hash: 30bd0609d7893bdcba96d7795368c2ecc48da038254d8f637e30759a0fe88f98
Instruction Fuzzy Hash: F9511735600205DFDB11DF58C4988A9BFF1FF8A314F0980A8E81A9B362DB31ED85CB90

Function 005A6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 005A6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 005A6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 005A6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0058AB79,00000000,00000000), ref: 005A6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 005A6CC7

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 0e697621d9952cc67840213a7c0c9299afe9c12277914fe7d495b2076fc54496
Instruction ID: 3b39315b6169eefebab93b79cc03f7a843ee7e4f72620e3c0e304cce5329afcd
Opcode Fuzzy Hash: 0e697621d9952cc67840213a7c0c9299afe9c12277914fe7d495b2076fc54496
Instruction Fuzzy Hash: CF418035A04104AFD724DF28CC68BAD7FA5FB0B360F190268F995AB2A1C771AD41DA50

Function 00542051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005420C3
_free.LIBCMT ref: 005420E3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 40dac34452c29d3d285367ec9e7711878103222d4d833ecea8f4a32398d386d7
Instruction ID: 183b748e96f74ac567f286ee50b1371f51938626959f1d6d97846b07228f91e5
Opcode Fuzzy Hash: 40dac34452c29d3d285367ec9e7711878103222d4d833ecea8f4a32398d386d7
Instruction Fuzzy Hash: 5E41E432A002109FCB24DF78C884A9EBBF5FF89318F554569F515EB396D631AD01DB80

Function 0052912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00529141
ScreenToClient.USER32(00000000,?), ref: 0052915E
GetAsyncKeyState.USER32(00000001), ref: 00529183
GetAsyncKeyState.USER32(00000002), ref: 0052919D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 9265c970efff0707028236a189c98b5f60c89f4a6111d25c2623092567dad064
Instruction ID: 9d2a1fbd3cd9d4703fec7a0be231ebe00589e17911c06a0eb440ed85d9f8d19a
Opcode Fuzzy Hash: 9265c970efff0707028236a189c98b5f60c89f4a6111d25c2623092567dad064
Instruction Fuzzy Hash: 1D415F7190861BBBDF159F69D848BEEBB74FF4A324F20421AE425A32D0C7305D54DB91

Function 00583874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 005838CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00583922
TranslateMessage.USER32(?), ref: 0058394B
DispatchMessageW.USER32(?), ref: 00583955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00583966

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 4503aef7a4387d5955e546e11e77a2924c56c79e8e0bc290dd450717327f6e5b
Instruction ID: 4f7c704a049fd1d16365d79e5dc282e96174174b464351dbbf9ba9575ee632fa
Opcode Fuzzy Hash: 4503aef7a4387d5955e546e11e77a2924c56c79e8e0bc290dd450717327f6e5b
Instruction Fuzzy Hash: 5931EB709057819EEB39EF34D849BB63FA8FB15700F04056DECA6E60A0E7F49689DB11

Function 0058CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0058CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0058CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0058C21E,00000000), ref: 0058CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0058C21E,00000000), ref: 0058CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0058C21E,00000000), ref: 0058CFF2

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 8734661e5c085aaa1932168fdee93733a9fceec672983265a51ab994de73f67a
Instruction ID: 8ef22b1384aa3925981837eb9b4bbcd1e2dfa31eb94be813000d1238b4842efa
Opcode Fuzzy Hash: 8734661e5c085aaa1932168fdee93733a9fceec672983265a51ab994de73f67a
Instruction Fuzzy Hash: 55314C71604205AFEB20EFA5D884AABBFF9FF15354B10442EFA06E2141DB30AE44DB70

Function 00571901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00571915
PostMessageW.USER32(00000001,00000201,00000001), ref: 005719C1
Sleep.KERNEL32(00000000,?,?,?), ref: 005719C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 005719DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 005719E2

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 4690d1f04d452f7130f5e8eda3d6dce698ed176c45c72cb382b4a5dfd1410890
Instruction ID: 3486ec42c9f545e93dc0979e5a5cae22f7656c2c3d0fa965b371baba725cc6ab
Opcode Fuzzy Hash: 4690d1f04d452f7130f5e8eda3d6dce698ed176c45c72cb382b4a5dfd1410890
Instruction Fuzzy Hash: 1A31CD71A00219EFCB00CFACD998ADE3FB5FB55314F108229FA25AB2D0C7709945EB90

Function 005A5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 005A5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 005A579D
_wcslen.LIBCMT ref: 005A57AF
_wcslen.LIBCMT ref: 005A57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 005A5816

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 56df450c6b26b099d33aa84421eb53186bcf6070b79e5e17adef38816cd82d0d
Instruction ID: a4284232c3d5620534d9205d8c27ffa105127e8976dad31e93bdc0d7ede0f324
Opcode Fuzzy Hash: 56df450c6b26b099d33aa84421eb53186bcf6070b79e5e17adef38816cd82d0d
Instruction Fuzzy Hash: EF219331904618DADB208F64DC84EEE7FB8FF56320F108616F919EB180E7709985CF50

Function 00590930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00590951
GetForegroundWindow.USER32 ref: 00590968
GetDC.USER32(00000000), ref: 005909A4
GetPixel.GDI32(00000000,?,00000003), ref: 005909B0
ReleaseDC.USER32(00000000,00000003), ref: 005909E8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 04ef9c01de7544c68aa15d2e3ad33063e8de2b277dcde7cc869954cf848ff025
Instruction ID: 5b628a112ce0d0d5a01c5e1db127711a9e8f6c3e44d1a8b7dd4bb2a884670cdb
Opcode Fuzzy Hash: 04ef9c01de7544c68aa15d2e3ad33063e8de2b277dcde7cc869954cf848ff025
Instruction Fuzzy Hash: 8C218435600204AFEB04EF69C949AAEBFF9FF85700F048468E84AA7352DB30EC44DB50

Function 0054CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0054CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0054CDE9

Part of subcall function 00543820: RtlAllocateHeap.NTDLL(00000000,?,005E1444,?,0052FDF5,?,?,0051A976,00000010,005E1440,005113FC,?,005113C6,?,00511129), ref: 00543852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0054CE0F
_free.LIBCMT ref: 0054CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0054CE31

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 7959bd8c376b5cce12c976a6576b44b613f91bd1c97f61c912111dcd1c1dd492
Instruction ID: ff3b122b98d15f41fd89ee0a481dabfdb451f0f5dca1c607a42411067adcf822
Opcode Fuzzy Hash: 7959bd8c376b5cce12c976a6576b44b613f91bd1c97f61c912111dcd1c1dd492
Instruction Fuzzy Hash: 3E0184726032157F276216B66C8CDBB7D6DFEC7BA93150129F905C7201EF618D1291B0

Function 00529639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00529693
SelectObject.GDI32(?,00000000), ref: 005296A2
BeginPath.GDI32(?), ref: 005296B9
SelectObject.GDI32(?,00000000), ref: 005296E2

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 700be6cb469864f891a56b2127dd2869d07d1816ded742b45bc34b87be9aa036
Instruction ID: 9deb3f3eb4187ff1688620d40598047957678a1737c4e9376a05da9ae058af06
Opcode Fuzzy Hash: 700be6cb469864f891a56b2127dd2869d07d1816ded742b45bc34b87be9aa036
Instruction Fuzzy Hash: 7D21B331901759EBDB118F64EC48BAD3FA4BF22315F100215F450DA2F1D3706889EF98

Function 00575711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00575726
_memcmp.LIBVCRUNTIME ref: 00575744
_memcmp.LIBVCRUNTIME ref: 00575757
_memcmp.LIBVCRUNTIME ref: 0057576F
_memcmp.LIBVCRUNTIME ref: 00575787

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: c18d710ded64dc96bc542cf3b5c065ebfa722cd7cb7082d48ba48316ec425213
Instruction ID: fcb6afef9bf14232aed0a2565e7e3c0099bc22d36e1514db90967f5f2333a981
Opcode Fuzzy Hash: c18d710ded64dc96bc542cf3b5c065ebfa722cd7cb7082d48ba48316ec425213
Instruction Fuzzy Hash: F001B5A1645A0ABBE20C5521AD86FBF7B5CFB613E4F008420FE0D9A241F7A1ED1093B4

Function 00542DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0053F2DE,00543863,005E1444,?,0052FDF5,?,?,0051A976,00000010,005E1440,005113FC,?,005113C6), ref: 00542DFD
_free.LIBCMT ref: 00542E32
_free.LIBCMT ref: 00542E59
SetLastError.KERNEL32(00000000,00511129), ref: 00542E66
SetLastError.KERNEL32(00000000,00511129), ref: 00542E6F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 76c2689cfbad3c8a1f9cb3947a359a94b925a4d4da3c3d8d4333b21a5c38109b
Instruction ID: 7094b51df13324a460dbb4d6c166e14bc6fde269b9d143d75abd364b87b12f74
Opcode Fuzzy Hash: 76c2689cfbad3c8a1f9cb3947a359a94b925a4d4da3c3d8d4333b21a5c38109b
Instruction Fuzzy Hash: 9A01263210562267871263752C49DFB3E6DBBE13ACFA04426F41593192EE708C149020

Function 0057000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0056FF41,80070057,?,?,?,0057035E), ref: 0057002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0056FF41,80070057,?,?), ref: 00570046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0056FF41,80070057,?,?), ref: 00570054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0056FF41,80070057,?), ref: 00570064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0056FF41,80070057,?,?), ref: 00570070

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 6537f40b0cda1fb16244e354d73a21bc9fd15649829f3c76dd819279baac11ba
Instruction ID: 693e5b2af9e0729885dc1859e284c5da0ef7a492c6ca17c16235ec61ae867d90
Opcode Fuzzy Hash: 6537f40b0cda1fb16244e354d73a21bc9fd15649829f3c76dd819279baac11ba
Instruction Fuzzy Hash: 46018B72600205FFDB104F69EC08BAA7EEDFB547A2F14A124F909D2250EB75DD44BBA0

Function 005710F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00571114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00570B9B,?,?,?), ref: 00571120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00570B9B,?,?,?), ref: 0057112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00570B9B,?,?,?), ref: 00571136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0057114D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: f6a2cf74d7a01e6596447bdf6e8af8dfe1c6b489c74989028028e8569a8ae2f5
Instruction ID: c6136f9fc9b8287e4255750945e0d6448a2bf261b42c9600f0abccdcd726c832
Opcode Fuzzy Hash: f6a2cf74d7a01e6596447bdf6e8af8dfe1c6b489c74989028028e8569a8ae2f5
Instruction Fuzzy Hash: 08011975200605BFDB114FA9EC49A6A3F6EFF8A3A0B604419FA45D7360DA31DD04EA60

Function 00570FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00570FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00570FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00570FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00570FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00571002

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c45069ca284d4fd7f6399ac621f8fbb70e8bc9340150943286064622f09ba86d
Instruction ID: fb6028b963192fc27c0e25af8a7c0bd5262cba8585d98445d484def58dba836d
Opcode Fuzzy Hash: c45069ca284d4fd7f6399ac621f8fbb70e8bc9340150943286064622f09ba86d
Instruction Fuzzy Hash: 7CF04935200701ABDB214FA9AC4DF5A3FADFF9A762F104415FA49C6251EE70DC54AA60

Function 00571014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0057102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00571036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00571045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0057104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00571062

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d5f4b3ebc07cdc12eb6636ac184be9f7786526de063174e18f9b7b78d1e892d5
Instruction ID: 2fa8470c3eb9a693007dc5b96c8b49590f76c8b5d46856077688edcdbde6c1f6
Opcode Fuzzy Hash: d5f4b3ebc07cdc12eb6636ac184be9f7786526de063174e18f9b7b78d1e892d5
Instruction Fuzzy Hash: 9DF04935200701ABDB215FAAEC4DF5A3FADFF9A761F104415FA49C6250DE70D854AA60

Function 0058030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0058017D,?,005832FC,?,00000001,00552592,?), ref: 00580324
CloseHandle.KERNEL32(?,?,?,?,0058017D,?,005832FC,?,00000001,00552592,?), ref: 00580331
CloseHandle.KERNEL32(?,?,?,?,0058017D,?,005832FC,?,00000001,00552592,?), ref: 0058033E
CloseHandle.KERNEL32(?,?,?,?,0058017D,?,005832FC,?,00000001,00552592,?), ref: 0058034B
CloseHandle.KERNEL32(?,?,?,?,0058017D,?,005832FC,?,00000001,00552592,?), ref: 00580358
CloseHandle.KERNEL32(?,?,?,?,0058017D,?,005832FC,?,00000001,00552592,?), ref: 00580365

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7834c3ed929462e4082d5966cb35c3af576849a463b1935eef56009c7957ac67
Instruction ID: 63279650871853044fdf335bb996c966c14b476cf46726462eed549cd631cf13
Opcode Fuzzy Hash: 7834c3ed929462e4082d5966cb35c3af576849a463b1935eef56009c7957ac67
Instruction Fuzzy Hash: 10019C72801B159FCB30AF66D880816FBF9BE602163159E3FD19662971CBB1A958DF80

Function 0054D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0054D752

Part of subcall function 005429C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000), ref: 005429DE
Part of subcall function 005429C8: GetLastError.KERNEL32(00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000,00000000), ref: 005429F0

_free.LIBCMT ref: 0054D764
_free.LIBCMT ref: 0054D776
_free.LIBCMT ref: 0054D788
_free.LIBCMT ref: 0054D79A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0e09515219e6085af8511fe0c43ee2f152e8a18f32f9bde6045214b719798093
Instruction ID: 13e23af86243c5d14f9ed30e9a6b8df4a749c514032d72bdaff7f8b76eb33a5f
Opcode Fuzzy Hash: 0e09515219e6085af8511fe0c43ee2f152e8a18f32f9bde6045214b719798093
Instruction Fuzzy Hash: 46F04F32541216AB8621EB65F9C5D967FFDFB44318BD40806F049D7502C734FC809670

Function 00575C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00575C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00575C6F
MessageBeep.USER32(00000000), ref: 00575C87
KillTimer.USER32(?,0000040A), ref: 00575CA3
EndDialog.USER32(?,00000001), ref: 00575CBD

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: ac88b2363bdaaa7499b7834fec45fe70df19d3109fe8213ee3b6bd6814aee176
Instruction ID: fb1d42a86d788f89ca4a9de9a2f5bc9cf14a09e9d727cd8c61a7b81790096234
Opcode Fuzzy Hash: ac88b2363bdaaa7499b7834fec45fe70df19d3109fe8213ee3b6bd6814aee176
Instruction Fuzzy Hash: 88018630500B04ABEB215B14ED4EFA67FFCBB11B05F044559A587A20E1EBF0AD88AA90

Function 005422A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005422BE

Part of subcall function 005429C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000), ref: 005429DE
Part of subcall function 005429C8: GetLastError.KERNEL32(00000000,?,0054D7D1,00000000,00000000,00000000,00000000,?,0054D7F8,00000000,00000007,00000000,?,0054DBF5,00000000,00000000), ref: 005429F0

_free.LIBCMT ref: 005422D0
_free.LIBCMT ref: 005422E3
_free.LIBCMT ref: 005422F4
_free.LIBCMT ref: 00542305

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6a2b031925cebc4a2d359f9b5ac1a6920efaee68420e7bb23758ae22cf4c424d
Instruction ID: 6e6b9053c052ea30b8df7a7fa076dd89f6a959f781c5bc0cc975154efe4965d6
Opcode Fuzzy Hash: 6a2b031925cebc4a2d359f9b5ac1a6920efaee68420e7bb23758ae22cf4c424d
Instruction Fuzzy Hash: 66F0B4784015B29B8A26AF56BC8188C3F74F738764F801107F058DA2B1C7710496FFE8

Function 005295C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 005295D4
StrokeAndFillPath.GDI32(?,?,005671F7,00000000,?,?,?), ref: 005295F0
SelectObject.GDI32(?,00000000), ref: 00529603
DeleteObject.GDI32 ref: 00529616
StrokePath.GDI32(?), ref: 00529631

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 1de2066f372abafc33b299c12c1ac75a756c330819fcff9d7bc5cd86e80e004b
Instruction ID: 200df3aa9b78b2f16348f5e6e0a2d62ff1a6f020dfa8d45f27de7e33c17c2d95
Opcode Fuzzy Hash: 1de2066f372abafc33b299c12c1ac75a756c330819fcff9d7bc5cd86e80e004b
Instruction Fuzzy Hash: 11F04F31105A48EBDB1A5F65ED5C7683FA1BF22322F048214F4A5991F2CB348999FF28

Function 00540F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 005410F9
__freea.LIBCMT ref: 00541117

Part of subcall function 00541537: _free.LIBCMT ref: 0054154F

Strings

a/p, xrefs: 005411DE
am/pm, xrefs: 0054117A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 80df0facff56a307b35277d354b267233c5c8cfe930299b035d27d01bf7ca494
Instruction ID: b3fb87df8b0c21aec00abaf69fc268ed9dd220c54b0c1d378f7e8fd52fd1d0f7
Opcode Fuzzy Hash: 80df0facff56a307b35277d354b267233c5c8cfe930299b035d27d01bf7ca494
Instruction Fuzzy Hash: 40D14835900A06DBCB288F68C859BFEBFB1FF05708F244919E9169B650D3759DC0CB99

Function 005961D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00530242: EnterCriticalSection.KERNEL32(005E070C,005E1884,?,?,0052198B,005E2518,?,?,?,005112F9,00000000), ref: 0053024D
Part of subcall function 00530242: LeaveCriticalSection.KERNEL32(005E070C,?,0052198B,005E2518,?,?,?,005112F9,00000000), ref: 0053028A

Part of subcall function 005300A3: __onexit.LIBCMT ref: 005300A9

__Init_thread_footer.LIBCMT ref: 00596238

Part of subcall function 005301F8: EnterCriticalSection.KERNEL32(005E070C,?,?,00528747,005E2514), ref: 00530202
Part of subcall function 005301F8: LeaveCriticalSection.KERNEL32(005E070C,?,00528747,005E2514), ref: 00530235

Part of subcall function 0058359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 005835E4
Part of subcall function 0058359C: LoadStringW.USER32(005E2390,?,00000FFF,?), ref: 0058360A

Strings

x#^, xrefs: 00596353
x#^, xrefs: 0059633A
x#^, xrefs: 0059636F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#^$x#^$x#^
API String ID: 1072379062-3539263148
Opcode ID: 7f30a58532a9af227a8637a5dc975ce0fee0b30ca24a73455946fdd059b08346
Instruction ID: b7042cb355b1f99f464c70204d58ead184cd3a5e64363a337f8234473ba18ccd
Opcode Fuzzy Hash: 7f30a58532a9af227a8637a5dc975ce0fee0b30ca24a73455946fdd059b08346
Instruction Fuzzy Hash: 11C17B71A00106AFDF14DF98C895EAEBBB9FF48300F118469F945AB291DB70ED49CB90

Function 00545AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JOQ, xrefs: 00545BA8, 00545C6C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: JOQ
API String ID: 0-3921798060
Opcode ID: 406b47cefafd532f179173fe4036eb942f9cb2223270f1b6d72f8732076f18dd
Instruction ID: 6a2e05dfffb8997bfcb0bbf0ecc67ba69fdb86b8c7cd3d9f2bc7bf9880926ced
Opcode Fuzzy Hash: 406b47cefafd532f179173fe4036eb942f9cb2223270f1b6d72f8732076f18dd
Instruction Fuzzy Hash: CE51BE75D0060A9BCB259FA4CC89FEEBFB8FF45318F14045AF405A7292E6319D01DB61

Function 00548A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00548B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00548B7A
__dosmaperr.LIBCMT ref: 00548B81

Strings

.S, xrefs: 00548A63

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .S
API String ID: 2434981716-1539595904
Opcode ID: b00082088acc37bbf87162f7e33cde85b6b5a706494779aad554395f90418ada
Instruction ID: 61160430dc0af42a2c6ce47f131ebf2d9356acf99187ec2df56aaa95f0567b98
Opcode Fuzzy Hash: b00082088acc37bbf87162f7e33cde85b6b5a706494779aad554395f90418ada
Instruction Fuzzy Hash: 40419D70604045AFCB249F25CC84AFD7FE5FB8631CF2885AAF8958B242DE71CC429790

Function 00572716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0057B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005721D0,?,?,00000034,00000800,?,00000034), ref: 0057B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00572760

Part of subcall function 0057B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005721FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0057B3F8

Part of subcall function 0057B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0057B355
Part of subcall function 0057B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00572194,00000034,?,?,00001004,00000000,00000000), ref: 0057B365
Part of subcall function 0057B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00572194,00000034,?,?,00001004,00000000,00000000), ref: 0057B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005727CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0057281A

Strings

@, xrefs: 00572832

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 064dbbebfd5c402402e3f11513dd621facdad38784f15445ffb929dc226f0c2f
Instruction ID: b7b3cf812bcab17bab430310755f0f5b6b993fc0ed95593300527fad4b2626ab
Opcode Fuzzy Hash: 064dbbebfd5c402402e3f11513dd621facdad38784f15445ffb929dc226f0c2f
Instruction Fuzzy Hash: 9A416D72900219AFDB10DBA4DD45BDEBBB8FF45300F108099FA59B7181DB706E85DBA1

Function 0054172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00541769
_free.LIBCMT ref: 00541834
_free.LIBCMT ref: 0054183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00541760, 00541767, 00541796, 005417CE

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-3695852857
Opcode ID: 85266c84dfedaa20b5a7290546344e0bfc9e02bd7658e47d04f4e2feb068dd38
Instruction ID: eeee8538d5b81146783530cfec5b4309f3ba51fceb5c8e64b119fbbb5fd5db2b
Opcode Fuzzy Hash: 85266c84dfedaa20b5a7290546344e0bfc9e02bd7658e47d04f4e2feb068dd38
Instruction Fuzzy Hash: 5331BC75A00A58ABDB25DB9A9C84DDEBFFCFB95314F104166F8049B211D6708A80DB98

Function 0057C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0057C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0057C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,005E1990,00E04CC0), ref: 0057C395

Strings

0, xrefs: 0057C2DF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 03565f18d6f4bf437eb29874ece6787541dfd90247eec257be14d44aeb22ef59
Instruction ID: 82bc2f369544b9245633c3bd4eff52f0b4197526ff05008ff2d93bf76aac84ee
Opcode Fuzzy Hash: 03565f18d6f4bf437eb29874ece6787541dfd90247eec257be14d44aeb22ef59
Instruction Fuzzy Hash: A1418E712043029FD720DF25E884B5ABFE4BF85320F14CA1DF9A9972D1D730A904EB62

Function 005A4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,005ACC08,00000000,?,?,?,?), ref: 005A44AA
GetWindowLongW.USER32 ref: 005A44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005A44D7

Strings

SysTreeView32, xrefs: 005A447C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 7d29528cef674264b84be62b0e111c28e55fdb622321f230796781f3db644e79
Instruction ID: 4873749e4507687ffc0272da20159f5b84f6073fe35ad84ddef6095fe723cada
Opcode Fuzzy Hash: 7d29528cef674264b84be62b0e111c28e55fdb622321f230796781f3db644e79
Instruction Fuzzy Hash: B9315C31210606AFDF219EB8DC45BEA7FA9FB8A334F204725F975921D0D7B0AC519B50

Function 00576E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00576EED
VariantCopyInd.OLEAUT32(?,?), ref: 00576F08
VariantClear.OLEAUT32(?), ref: 00576F12

Strings

*jW, xrefs: 00576E8B, 00576E90, 00576EF8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *jW
API String ID: 2173805711-2693160286
Opcode ID: e222dacec7af85bcd0789438c73db7ac1fa2fcd13b4296e363e227b78d300cf1
Instruction ID: 44ee51ad280366b0a565b4ed83e78f19bbb2caa039ebc39a47f9f52f1951dfdd
Opcode Fuzzy Hash: e222dacec7af85bcd0789438c73db7ac1fa2fcd13b4296e363e227b78d300cf1
Instruction Fuzzy Hash: BB31B371604606DFDB04AF64F8949BD3F76FF85300B104898F9064B2A1D7309D91EBA4

Function 0059304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0059335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00593077,?,?), ref: 00593378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0059307A
_wcslen.LIBCMT ref: 0059309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00593106

Strings

255.255.255.255, xrefs: 00593095, 0059309A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 78dd40aee28c6856205b5010857949670ddff2b7c8a1631a27753eb08665188b
Instruction ID: b7988a32a94d354688cc7802369c09e2f709e1e9885909f3bd948fcabf683d35
Opcode Fuzzy Hash: 78dd40aee28c6856205b5010857949670ddff2b7c8a1631a27753eb08665188b
Instruction Fuzzy Hash: 2A31B039600202DFCB20CF68C589AAA7FE0FF55318F248459E9158B3A2DB32EE45D760

Function 005A3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 005A3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 005A3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 005A3F78

Strings

SysMonthCal32, xrefs: 005A3F0B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 2db68bca5e85e011ed30beace7a4883aba6c94eb163cba0bbcd0c4bf80321056
Instruction ID: e7ee3663323e87410043af921f0bd097f3c6a28c7a2e337e57ddaf431d6ceaab
Opcode Fuzzy Hash: 2db68bca5e85e011ed30beace7a4883aba6c94eb163cba0bbcd0c4bf80321056
Instruction Fuzzy Hash: A821AD32610219BFDF218E54CC46FEE3F79FB89718F110215FA156B190D6B5A894DB90

Function 005A4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 005A4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 005A4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 005A471A

Strings

msctls_updown32, xrefs: 005A4684

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: b97b30fca7c9fa717f541dffe9d8cca0d32186fd61603e6af52a40dd884655f9
Instruction ID: c91d114d8811ffbe7e007e7097770fd6d48f963bac30f61831a6da48671c38db
Opcode Fuzzy Hash: b97b30fca7c9fa717f541dffe9d8cca0d32186fd61603e6af52a40dd884655f9
Instruction Fuzzy Hash: E72151B5600249AFDB10DF68DCC5DBB3BADFB9B394B040459FA019B261DB70EC51DA60

Function 005795AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0057961D

Strings

#OnAutoItStartRegister, xrefs: 005795F3
#requireadmin, xrefs: 005795D9
#notrayicon, xrefs: 005795B7

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 3e55d52ba33bbedbd9d4ca7f71ee8d94e6a06e8ccc80092ef12fc9aaf2b1f241
Instruction ID: cd10c6d01f152332f5155d5cf581eff24f34541b12618ff2b35ce0a908ff0897
Opcode Fuzzy Hash: 3e55d52ba33bbedbd9d4ca7f71ee8d94e6a06e8ccc80092ef12fc9aaf2b1f241
Instruction Fuzzy Hash: 9921087210462266D331AA29AC06FBB7FACBFD5310F148426F94D97181EB51AD81E3F5

Function 005A37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 005A3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 005A3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 005A3876

Strings

Listbox, xrefs: 005A380F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: ac3c9b42013912ca22de0ad213a1a1cf7f631d677117bae5d8fa9a5fb8b1e451
Instruction ID: 16ab0d73d7ec5fdddcefd8e1ad1e02aa67a76108507ea7a7b151b4ba6b84a5f6
Opcode Fuzzy Hash: ac3c9b42013912ca22de0ad213a1a1cf7f631d677117bae5d8fa9a5fb8b1e451
Instruction Fuzzy Hash: 3521BE72600219BBEB218F64CC85EBF3B6EFF8A754F108125F9009B190CA75DD528BA0

Function 005849F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00584A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00584A5C
SetErrorMode.KERNEL32(00000000,?,?,005ACC08), ref: 00584AD0

Strings

%lu, xrefs: 00584A6F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 68cff9678ffcb0c9caef91b0f2b0e22263f4b529ac0c212f710bf53590214787
Instruction ID: 0037eeb0ff125ed1899e4654c4d0db9e6e06dd6a80b791260e61ed13296bf692
Opcode Fuzzy Hash: 68cff9678ffcb0c9caef91b0f2b0e22263f4b529ac0c212f710bf53590214787
Instruction Fuzzy Hash: C7314B75A00209AFDB10DF54C885EAA7FF9FF49308F1480A5E909EB252DB71EE45CB61

Function 005A41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 005A424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 005A4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 005A4271

Strings

msctls_trackbar32, xrefs: 005A4226

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 8d912a7132a55813900e5a631ffeac11ee593ad80096fec63b8d9d7627b5ce59
Instruction ID: 641ec9e6f322ed538e558a8222291f584a4bb7f2c0851ce90431f072bffea93b
Opcode Fuzzy Hash: 8d912a7132a55813900e5a631ffeac11ee593ad80096fec63b8d9d7627b5ce59
Instruction Fuzzy Hash: 8011A331240248BEEF205E69CC46FAB3FACFFD6B54F110525FA55E6090D6B1DC519B50

Function 00572F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00516B57: _wcslen.LIBCMT ref: 00516B6A

Part of subcall function 00572DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00572DC5
Part of subcall function 00572DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00572DD6
Part of subcall function 00572DA7: GetCurrentThreadId.KERNEL32 ref: 00572DDD
Part of subcall function 00572DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00572DE4

GetFocus.USER32 ref: 00572F78

Part of subcall function 00572DEE: GetParent.USER32(00000000), ref: 00572DF9

GetClassNameW.USER32(?,?,00000100), ref: 00572FC3
EnumChildWindows.USER32(?,0057303B), ref: 00572FEB

Strings

%s%d, xrefs: 00572FFF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 7e13d4eee0aeb51ca3cd6c13c07e89be3ce19a6521083f4445ffc6e30d7a030b
Instruction ID: 0284a40ecf1a234bd9a447240347ce344aa19da3ef18e3bce9d07fb704a45c16
Opcode Fuzzy Hash: 7e13d4eee0aeb51ca3cd6c13c07e89be3ce19a6521083f4445ffc6e30d7a030b
Instruction Fuzzy Hash: 9D11A2716002066BDF14BF74AC89EED3F6ABFD5314F048075B90D9B292DE30994AAB60

Function 005A5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 005A58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 005A58EE
DrawMenuBar.USER32(?), ref: 005A58FD

Strings

0, xrefs: 005A588F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 6bcd8ea499c392a5edc5726ee8ca194be9d52e9e116e645ad74ebc1620751f33
Instruction ID: c7d871573c25bb420818d4a14f52760362fc881f762fb8be5d11e86f48b69884
Opcode Fuzzy Hash: 6bcd8ea499c392a5edc5726ee8ca194be9d52e9e116e645ad74ebc1620751f33
Instruction Fuzzy Hash: FD010C31500219EEDB619F11E844FAFBFB8BF46361F1484A9F849DA151EB308A94EF21

Function 0056D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0056D3BF
FreeLibrary.KERNEL32 ref: 0056D3E5

Strings

X64, xrefs: 0056D2A8
GetSystemWow64DirectoryW, xrefs: 0056D3B9

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: e9d0d174f390c45b71d9cd920f70244f378d3083ec3cd8479706207018db8902
Instruction ID: 0b90b13ec85af04db34f9c90fd8d29fe54aa680639c52263857bdf243e7d459b
Opcode Fuzzy Hash: e9d0d174f390c45b71d9cd920f70244f378d3083ec3cd8479706207018db8902
Instruction Fuzzy Hash: CDF055B5F05A208BC77102115C2896D3FB0BF12701BA88D26E802EB244EB20CC44C2B2

Function 0057007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8578f3d0aac6b0e00a43cb10c0aa0e71d98254ee7c952f1ab8b223c4d1836df
Instruction ID: a66f30f55023ea489b0ddf1a63732a3597511ff16080eb6116a363c08c1efad8
Opcode Fuzzy Hash: e8578f3d0aac6b0e00a43cb10c0aa0e71d98254ee7c952f1ab8b223c4d1836df
Instruction Fuzzy Hash: 29C16D75A00216EFCB14CF94D898AAEBBF5FF48314F209598E509EB291D731DD41EB90

Function 0059342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00593459
CoUninitialize.OLE32 ref: 00593463
VariantInit.OLEAUT32(?), ref: 0059346E
VariantClear.OLEAUT32(?), ref: 0059371B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 60f024b417318b33880e3f4025eafc44358c8a7a8db3dd3ca70887c17f494415
Instruction ID: 668b0a821a1b4d8ff13a3f0aec4b6cc11244cac9605a81a188f9f9832a3beae0
Opcode Fuzzy Hash: 60f024b417318b33880e3f4025eafc44358c8a7a8db3dd3ca70887c17f494415
Instruction Fuzzy Hash: DFA14975204201DFDB10DF28C489A6ABBE5FF8D714F058859F98A9B362DB30EE45CB91

Function 00570436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,005AFC08,?), ref: 005705F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,005AFC08,?), ref: 00570608
CLSIDFromProgID.OLE32(?,?,00000000,005ACC40,000000FF,?,00000000,00000800,00000000,?,005AFC08,?), ref: 0057062D
_memcmp.LIBVCRUNTIME ref: 0057064E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: cad1f59382c62924ea53cf19128c96f0ab7c43fe6dfb078b7315cadeade281ed
Instruction ID: 853643bb8abe0d859517d7a55ba91d36adbb0d36eb3dce13e5160036971bdeca
Opcode Fuzzy Hash: cad1f59382c62924ea53cf19128c96f0ab7c43fe6dfb078b7315cadeade281ed
Instruction Fuzzy Hash: 27811C71A00109EFCB04DF94C988DEEBBF9FF89315F108558E506AB290DB71AE06DB60

Function 00551391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005514C0

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 26761c60a35de7da804ddc60fd3569eb2d525dcb7c1e48995331b88ae76008bc
Instruction ID: 45c1923008adaf492b3dc735f0795fb6801f190f85a5fd9c959c5b60691cc93d
Opcode Fuzzy Hash: 26761c60a35de7da804ddc60fd3569eb2d525dcb7c1e48995331b88ae76008bc
Instruction Fuzzy Hash: 1B416935A00902EBDF216BB98C5ABAF3FA4FF81371F140627FC19C6192F67448495765

Function 005A6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 005A62E2
ScreenToClient.USER32(?,?), ref: 005A6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 005A6382

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 52ec338d578cd0c20444c3495194bd77716a393a8eaf88a09e74580a5eab00b8
Instruction ID: 1750203f7b1eaf19aaf35c07f46c79752b1c70fb1ba27bb79646e6d86bf0eadb
Opcode Fuzzy Hash: 52ec338d578cd0c20444c3495194bd77716a393a8eaf88a09e74580a5eab00b8
Instruction Fuzzy Hash: 2D514A74A00249EFCF14DF68D880AAE7BB5FF96360F14856AF8159B290D730ED81DB90

Function 00591AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00591AFD
WSAGetLastError.WSOCK32 ref: 00591B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00591B8A
WSAGetLastError.WSOCK32 ref: 00591B94

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: d386b4f7722a9fc0b3e674156dc7e61f4f639ac5e84bb701d39eff38a64f1088
Instruction ID: ed1b5fd3ae5a4b8d786e99ed45286a4aa5f3ed9e37243dcd300ca3a35e9a8f94
Opcode Fuzzy Hash: d386b4f7722a9fc0b3e674156dc7e61f4f639ac5e84bb701d39eff38a64f1088
Instruction Fuzzy Hash: 2441A1346406126FEB20AF24C88AF657BE6BF85718F548448F5169F3D2D772ED828B90

Function 0054B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7603d5051b786705936bdacf40334e1075eeceb1d4241edf7a44a93e8efea392
Instruction ID: f48dd1b68af5ac0b5d65c0a7d208a9d4479702f63bf4235af218ce3b1c1782fe
Opcode Fuzzy Hash: 7603d5051b786705936bdacf40334e1075eeceb1d4241edf7a44a93e8efea392
Instruction Fuzzy Hash: 2A41E675A00705AFEB249F38CC46BEABFA9FBC8714F10452AF555DB682D771D9018780

Function 005856D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00585783
GetLastError.KERNEL32(?,00000000), ref: 005857A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 005857CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 005857FA

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: b56dcd06be71e784add282c570a71e1f1363500182236f832993702df914d5a6
Instruction ID: 97622cd1184923acccc44fbc011619ff12179e0308cad823a8e074549deb3814
Opcode Fuzzy Hash: b56dcd06be71e784add282c570a71e1f1363500182236f832993702df914d5a6
Instruction Fuzzy Hash: 5C410839600611DFDB11EF15C449A5EBFF2BF89320B198488E84AAB362DB30FD41DB91

Function 0054D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00536D71,00000000,00000000,005382D9,?,005382D9,?,00000001,00536D71,?,00000001,005382D9,005382D9), ref: 0054D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0054D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0054D9AB
__freea.LIBCMT ref: 0054D9B4

Part of subcall function 00543820: RtlAllocateHeap.NTDLL(00000000,?,005E1444,?,0052FDF5,?,?,0051A976,00000010,005E1440,005113FC,?,005113C6,?,00511129), ref: 00543852

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 580bf88760472203997ed1162c675482d3fdf208579fbfb91a578e2191407046
Instruction ID: dc9ba10fea6b5aaf33a3f7abd3d426312178b81510ae4826cd85b99abcd707ec
Opcode Fuzzy Hash: 580bf88760472203997ed1162c675482d3fdf208579fbfb91a578e2191407046
Instruction Fuzzy Hash: 6E31A872A0020AABDF248F64DC49AEE7FB5FB41354F050169EC04D62A0EB358D54CBA0

Function 005A52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 005A5352
GetWindowLongW.USER32(?,000000F0), ref: 005A5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005A5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 005A53A8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 74731ac663ca00aec47cdf147cc1082140f03bd06720b5b4c25fdb16dda904ee
Instruction ID: 25cbc3b5dc07b2c93bd2823fcccbc58678022017fe9f4e6f55f5a47f6e17b9a6
Opcode Fuzzy Hash: 74731ac663ca00aec47cdf147cc1082140f03bd06720b5b4c25fdb16dda904ee
Instruction Fuzzy Hash: 3331C134A55A08EFEF249E14CC45FEC3F65BB96390F984803FA11961E1E7B09940AB41

Function 0057AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 0057ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0057AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0057AC74
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 0057ACC6

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 70d1605154a81490c527c4639d5994a4193afb5e76bfdd890b407a326cd9d707
Instruction ID: 48b198dd83313fb857cdd5a0f827b44f9b8d15db2bf5d32bf5664fbce874f750
Opcode Fuzzy Hash: 70d1605154a81490c527c4639d5994a4193afb5e76bfdd890b407a326cd9d707
Instruction Fuzzy Hash: A631E730A00618BFFF26CB65A809BFE7EA9BBC5310F04C61AF489561D1C3758D85A752

Function 005A7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 005A769A
GetWindowRect.USER32(?,?), ref: 005A7710
PtInRect.USER32(?,?,005A8B89), ref: 005A7720
MessageBeep.USER32(00000000), ref: 005A778C

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: bca1ddb3d3754f72d57eb063424e8c0488189e73f960527e9d4657b79a9a7384
Instruction ID: 027ccd4b9684eaa5016031f3e9ebcee76028b9eb94039745946855cd2a3821d0
Opcode Fuzzy Hash: bca1ddb3d3754f72d57eb063424e8c0488189e73f960527e9d4657b79a9a7384
Instruction Fuzzy Hash: 3E418738A096599FCB01CF58CC94EADBFF4FB9E300F1940A8E854DB261C730A985DB90

Function 005A16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 005A16EB

Part of subcall function 00573A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00573A57
Part of subcall function 00573A3D: GetCurrentThreadId.KERNEL32 ref: 00573A5E
Part of subcall function 00573A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005725B3), ref: 00573A65

GetCaretPos.USER32(?), ref: 005A16FF
ClientToScreen.USER32(00000000,?), ref: 005A174C
GetForegroundWindow.USER32 ref: 005A1752

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 5391be74a83a66b3b512acd3c74d2ba2f998e340167ace881ce08b96ff4f5cc6
Instruction ID: 697dcada456007c4ff9dd02e4da64457bfeb40fe9f98f048e87ef06e840727e9
Opcode Fuzzy Hash: 5391be74a83a66b3b512acd3c74d2ba2f998e340167ace881ce08b96ff4f5cc6
Instruction Fuzzy Hash: 50310C75D00249AFDB04EFA9C8858EEBBF9FF89304B5480A9E415A7211D6319E45CBA0

Function 0057D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0057D501
Process32FirstW.KERNEL32(00000000,?), ref: 0057D50F
Process32NextW.KERNEL32(00000000,?), ref: 0057D52F
CloseHandle.KERNEL32(00000000), ref: 0057D5DC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 48295adde6f564ff33f5dd67e6fe03865055bdf0c57b277dc5e1292b29985055
Instruction ID: 0cbd07d4ea5bc414d7b2edae0afe1046bfdd6431b579897f7af5bc7426a4cc97
Opcode Fuzzy Hash: 48295adde6f564ff33f5dd67e6fe03865055bdf0c57b277dc5e1292b29985055
Instruction Fuzzy Hash: 2D318D71108301AFD301EF54D885AAFBFF8BFD9344F10492DF585821A1EB719988DBA2

Function 005A8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00529BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00529BB2

GetCursorPos.USER32(?), ref: 005A9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00567711,?,?,?,?,?), ref: 005A9016
GetCursorPos.USER32(?), ref: 005A905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00567711,?,?,?), ref: 005A9094

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b27de6c6acbec6156de4e9a1ab71f2b631d74f07c9319cb743fd2d600a2bce84
Instruction ID: 78e1e6217114ea4b349123317358e3a9b9251f61f825ac4805193c2b6f17d459
Opcode Fuzzy Hash: b27de6c6acbec6156de4e9a1ab71f2b631d74f07c9319cb743fd2d600a2bce84
Instruction Fuzzy Hash: FB217F35600128EFDB298F94D898EEE7FB9FF8B390F144055F9058B2A1C7319990EB60

Function 0057D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,005ACB68), ref: 0057D2FB
GetLastError.KERNEL32 ref: 0057D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0057D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,005ACB68), ref: 0057D376

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 76388cb94e18f9081e65437e31167cb6815e4a75b097ef71fbd79a80eea411c8
Instruction ID: dd30ee54f9184e214da932fee3480280e124b6e1bb3a7ee98d63dbb2bdbe9ca2
Opcode Fuzzy Hash: 76388cb94e18f9081e65437e31167cb6815e4a75b097ef71fbd79a80eea411c8
Instruction Fuzzy Hash: AF2180745042029FC700DF28D8858AA7FF4BE96324F508E1DF499C32A1DB319949DBA3

Function 00571571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00571014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0057102A
Part of subcall function 00571014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00571036
Part of subcall function 00571014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00571045
Part of subcall function 00571014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0057104C
Part of subcall function 00571014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00571062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 005715BE
_memcmp.LIBVCRUNTIME ref: 005715E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00571617
HeapFree.KERNEL32(00000000), ref: 0057161E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 3debf4159c497cb798911d18c69181ca6e1f79f5b250571d347ac980f4d9a70e
Instruction ID: d5148ed50c7442a1c90b073f158862b54e62c827c84e81460b17fbc756df0d60
Opcode Fuzzy Hash: 3debf4159c497cb798911d18c69181ca6e1f79f5b250571d347ac980f4d9a70e
Instruction Fuzzy Hash: 9D219C31E00509AFDF14DFA8D948BEEBBB8FF40344F188459E445AB241E730AA04EB54

Function 005A2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 005A280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005A2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005A2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 005A2840

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 2910eab8c3f8af1f4d9edd1473d9eba17f13f3f450725d5f5bf37c8fd7806e8e
Instruction ID: 529f2b07e0fae0fc4c9482cf087dd956be51e61ec344ad3607c5499105e7dddb
Opcode Fuzzy Hash: 2910eab8c3f8af1f4d9edd1473d9eba17f13f3f450725d5f5bf37c8fd7806e8e
Instruction Fuzzy Hash: AA21A435604512AFE7149B28C846FAA7F95FF86324F148158F4268B6D2CB75FD82CB90

Function 005778F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00578D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0057790A,?,000000FF,?,00578754,00000000,?,0000001C,?,?), ref: 00578D8C
Part of subcall function 00578D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00578DB2
Part of subcall function 00578D7D: lstrcmpiW.KERNEL32(00000000,?,0057790A,?,000000FF,?,00578754,00000000,?,0000001C,?,?), ref: 00578DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00578754,00000000,?,0000001C,?,?,00000000), ref: 00577923
lstrcpyW.KERNEL32(00000000,?), ref: 00577949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00578754,00000000,?,0000001C,?,?,00000000), ref: 00577984

Strings

cdecl, xrefs: 0057797B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: e23b12a75f9845e3deaed9b515920361954fe29019ab30bdba5a485bd0c2166a
Instruction ID: c69ba510e992c9c8427f7d54099250042fd95d3cfc8c97201ea3779e63ac3bd1
Opcode Fuzzy Hash: e23b12a75f9845e3deaed9b515920361954fe29019ab30bdba5a485bd0c2166a
Instruction Fuzzy Hash: E011EC3A201706AFCB155F34F849D7B7BA9FF99350B50802AF946C72A4EF319811E791

Function 005A7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 005A7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 005A7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 005A7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0058B7AD,00000000), ref: 005A7D6B

Part of subcall function 00529BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00529BB2

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 86bcf2e8cfd4c51e5233cfbd640f5c5ac2670f4a353a542956bdc9cb07b2583f
Instruction ID: 672f9737c3e61cf425cb86d38485de579685e2f804bc9b47d9c63c41427d65e7
Opcode Fuzzy Hash: 86bcf2e8cfd4c51e5233cfbd640f5c5ac2670f4a353a542956bdc9cb07b2583f
Instruction Fuzzy Hash: 7611AF32604669AFCB149F28CC04AAA3FA5BF4B360B154724F839DB2F0E7309D55DB90

Function 005A5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 005A56BB
_wcslen.LIBCMT ref: 005A56CD
_wcslen.LIBCMT ref: 005A56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 005A5816

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: e992f3e23b6a9c6ffbb7e171d4bece51ceea896cc28284fccf73fd481f471708
Instruction ID: 4bcfde3f289dc3d914e2ea0f8c620b45377d4e0ceca0dd4ffae8d9c544bfb49c
Opcode Fuzzy Hash: e992f3e23b6a9c6ffbb7e171d4bece51ceea896cc28284fccf73fd481f471708
Instruction Fuzzy Hash: F611B1716006099ADF20DF658C85EEE7FACFF56760F104426F915DA081FB709A84CBA0

Function 00541D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1bc1c197c729dd8964e18859e761d5dc2e2d846ec02048a7e35ec4825bf3e45
Instruction ID: 25ddca58d5f73cbe4e0f60a765f8d1d94f8bdab3b11431305e66d46c9fb772a6
Opcode Fuzzy Hash: e1bc1c197c729dd8964e18859e761d5dc2e2d846ec02048a7e35ec4825bf3e45
Instruction Fuzzy Hash: BF017CF2A05A167EF61116786CC4FA76E2DFF913BCB341325B531511D2DB608C809164

Function 00571A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00571A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00571A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00571A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00571A8A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0e31a196838b77742f68b178ae0ac22c09f554d10720ad6bf42074adf9516f73
Instruction ID: 0577911197ff0d9eda2f5f1547808625cc7fdeb60b4ac0123afe4dfc1f0706d7
Opcode Fuzzy Hash: 0e31a196838b77742f68b178ae0ac22c09f554d10720ad6bf42074adf9516f73
Instruction Fuzzy Hash: 5D113C3AD01219FFEB10DBA8CD85FADBB78FB04750F204091E605B7290D6716E50EB94

Function 0057E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0057E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0057E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0057E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0057E24D

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 44bb02ebff3f51d0f81813ce3abf94dedf1ecfccc55a93e6e85c111484fe78b0
Instruction ID: 7a3988581c14abb129092fbf58bd38d92f583a2ca32feb2387fa17234d5a64a6
Opcode Fuzzy Hash: 44bb02ebff3f51d0f81813ce3abf94dedf1ecfccc55a93e6e85c111484fe78b0
Instruction Fuzzy Hash: 2F112B76A04354BBC7059FA8EC4AA9F7FADEB5A310F008655F819D7291D670CD0897A0

Function 0053D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0053CFF9,00000000,00000004,00000000), ref: 0053D218
GetLastError.KERNEL32 ref: 0053D224
__dosmaperr.LIBCMT ref: 0053D22B
ResumeThread.KERNEL32(00000000), ref: 0053D249

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 4a4ffae62088c53692ce58d9f1487e89508639edc2905e7017118c0ec1cd82db
Instruction ID: d45ad4c648fb10770a3f34014536dc83df1b13599ed28869aad4c22a23baeec2
Opcode Fuzzy Hash: 4a4ffae62088c53692ce58d9f1487e89508639edc2905e7017118c0ec1cd82db
Instruction Fuzzy Hash: 8B01C03A805205BBCB215BA5EC09AAB7F79FF82731F100219F925921D0DF718905D7B0

Function 005A9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00529BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00529BB2

GetClientRect.USER32(?,?), ref: 005A9F31
GetCursorPos.USER32(?), ref: 005A9F3B
ScreenToClient.USER32(?,?), ref: 005A9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 005A9F7A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 5578a038687e2f0bff2ea6d5d4f21dc66948c0897484569aacecb09d2e02025b
Instruction ID: a50df258e063769a48acc863b38afd84b48810f2e0fc5f85807bdbf2e47dc4d0
Opcode Fuzzy Hash: 5578a038687e2f0bff2ea6d5d4f21dc66948c0897484569aacecb09d2e02025b
Instruction Fuzzy Hash: 9711333290026AAFDF15DFA8D8899EE7BB9FB46311F000455FA02E3140D330BA85DBA1

Function 0051600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0051604C
GetStockObject.GDI32(00000011), ref: 00516060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0051606A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 30323eebe2589afb3f6ad0efc8e340db9e3cd52195892856385bb894bc6ba083
Instruction ID: b107be61bab182dbec4d44bf95da99212bad452a61abb8ec84958de889274cc6
Opcode Fuzzy Hash: 30323eebe2589afb3f6ad0efc8e340db9e3cd52195892856385bb894bc6ba083
Instruction Fuzzy Hash: A611AD72501508BFEF129FA48C48EEABFA9FF1D3A4F000206FA0556110C7329CA0EBA1

Function 00533B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00533B56

Part of subcall function 00533AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00533AD2
Part of subcall function 00533AA3: ___AdjustPointer.LIBCMT ref: 00533AED

_UnwindNestedFrames.LIBCMT ref: 00533B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00533B7C
CallCatchBlock.LIBVCRUNTIME ref: 00533BA4

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: f06acc09e4593976fed23c5dc7da80649af29af9ef4ed75e1183013d4221a169
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: CC01E932100149BBDF125E95CC4AEEB7F69FF98754F044014FE4866121C736E961DBA0

Function 00543073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,005113C6,00000000,00000000,?,0054301A,005113C6,00000000,00000000,00000000,?,0054328B,00000006,FlsSetValue), ref: 005430A5
GetLastError.KERNEL32(?,0054301A,005113C6,00000000,00000000,00000000,?,0054328B,00000006,FlsSetValue,005B2290,FlsSetValue,00000000,00000364,?,00542E46), ref: 005430B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0054301A,005113C6,00000000,00000000,00000000,?,0054328B,00000006,FlsSetValue,005B2290,FlsSetValue,00000000), ref: 005430BF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 44481e7845afbf6406d13e7582b9270bbef0e4905ff1adf5a953710904a22a5a
Instruction ID: f2fed4ac56fc8efa5cff5c1b14f288658ecd53835b938a4d63b369a4f0a037f9
Opcode Fuzzy Hash: 44481e7845afbf6406d13e7582b9270bbef0e4905ff1adf5a953710904a22a5a
Instruction Fuzzy Hash: B4012B36301622ABCB314B789C4CA977FD8BF16B65B200720F90DE7160D721DD09C6E0

Function 00577464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0057747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00577497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 005774AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 005774CA

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 2196ade24e098f3051b76bb2e59be5ba11d3f95ddb171f1d1f0995e41220346c
Instruction ID: b428db24a8e2cfd7b177b09b814ab7e5dd40fe082681dfb19efc57fad476ba2b
Opcode Fuzzy Hash: 2196ade24e098f3051b76bb2e59be5ba11d3f95ddb171f1d1f0995e41220346c
Instruction Fuzzy Hash: 2D115EB52053199BEB208F24FC09F927FFDFB08B04F10C969A66AD6151D7B0E908EB50

Function 0057B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0057ACD3,?,00008000), ref: 0057B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0057ACD3,?,00008000), ref: 0057B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0057ACD3,?,00008000), ref: 0057B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0057ACD3,?,00008000), ref: 0057B126

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: b169ba9a6fa6bb47b6f596badd9c1977d522f5af8ac7ca63f8567c3d9dd268cc
Instruction ID: 526469fef58ce4f13997d9a2c1d5ba6b1fd7f46e53ea40b979a20e7d06872028
Opcode Fuzzy Hash: b169ba9a6fa6bb47b6f596badd9c1977d522f5af8ac7ca63f8567c3d9dd268cc
Instruction Fuzzy Hash: 75117930E01529E7DF00AFE4E9A8BEEBF78FF5A311F008486D945B2181CB305655EB51

Function 005A7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 005A7E33
ScreenToClient.USER32(?,?), ref: 005A7E4B
ScreenToClient.USER32(?,?), ref: 005A7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A7E8A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 1e280e3c56aff32b69bdec5bdec9877c5820dc004cf936003eb9f78ae03001e2
Instruction ID: 60e71a56bc2d3062af58670129db9526be670adbc4404685b15ec6916335ba2f
Opcode Fuzzy Hash: 1e280e3c56aff32b69bdec5bdec9877c5820dc004cf936003eb9f78ae03001e2
Instruction Fuzzy Hash: 7D1143B9D0020AAFDB41CFA8C8849EEBBF9FB19310F505056E915E3210D735AA54DF90

Function 00572DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00572DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00572DD6
GetCurrentThreadId.KERNEL32 ref: 00572DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00572DE4

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 344b7d775e18aee94c14438d19be04ade4602f15936627034996f612069c5f11
Instruction ID: 95905d093804b29c87b2925ec2f55ab28fb7749f35a8b20dd49f0099a903da29
Opcode Fuzzy Hash: 344b7d775e18aee94c14438d19be04ade4602f15936627034996f612069c5f11
Instruction Fuzzy Hash: 38E092B16012347BD7305B76AC0DFEB3E6CFF63BA1F004015F109D20809AA0C845E6B0

Function 005A8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00529639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00529693
Part of subcall function 00529639: SelectObject.GDI32(?,00000000), ref: 005296A2
Part of subcall function 00529639: BeginPath.GDI32(?), ref: 005296B9
Part of subcall function 00529639: SelectObject.GDI32(?,00000000), ref: 005296E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 005A8887
LineTo.GDI32(?,?,?), ref: 005A8894
EndPath.GDI32(?), ref: 005A88A4
StrokePath.GDI32(?), ref: 005A88B2

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 86e18fa264ac55a03956f98fa905e907e81f48d66c16808471dbced522369982
Instruction ID: 90fb1ba7bc6ae5c7aaccbfeb9de6460cc5d76bdcd182896492d68d60d2a58c1b
Opcode Fuzzy Hash: 86e18fa264ac55a03956f98fa905e907e81f48d66c16808471dbced522369982
Instruction Fuzzy Hash: ABF03A36045659BADB125F94AC0DFDE3E59BF27310F448000FA11650E2CB795515EBA9

Function 005298B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 005298CC
SetTextColor.GDI32(?,?), ref: 005298D6
SetBkMode.GDI32(?,00000001), ref: 005298E9
GetStockObject.GDI32(00000005), ref: 005298F1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: fdf6603537d52c9d4adb0155221fe6a5cb8cc3c0d570d87573f395080bf49304
Instruction ID: babda23092f530fcf023f160b2149b06ff6ffa12fd385980bdd04a0b603c7173
Opcode Fuzzy Hash: fdf6603537d52c9d4adb0155221fe6a5cb8cc3c0d570d87573f395080bf49304
Instruction Fuzzy Hash: 77E06D31644284ABDB215B74BC09BE83F60FB27336F048219F6FA581E1C7724684EB10

Function 0057162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00571634
OpenThreadToken.ADVAPI32(00000000,?,?,?,005711D9), ref: 0057163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,005711D9), ref: 00571648
OpenProcessToken.ADVAPI32(00000000,?,?,?,005711D9), ref: 0057164F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 6d78daf8af01a9f0b2d155c7cc239e2065791bb06a459dc144e30e1677b3d84a
Instruction ID: 9fd6a7abfb0923c10368a160921ec55014196553daf74aa5e51fb240e99b5b65
Opcode Fuzzy Hash: 6d78daf8af01a9f0b2d155c7cc239e2065791bb06a459dc144e30e1677b3d84a
Instruction Fuzzy Hash: 70E08635601211DBD7201FA5AD0DB4B3F7CBF66791F148808F245C9080D6344548E754

Function 0056D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0056D858
GetDC.USER32(00000000), ref: 0056D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0056D882
ReleaseDC.USER32(?), ref: 0056D8A3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: fe3f31decb965d1eff72b2794d78ec19c2547cf145b65ae4249fd8c78f015923
Instruction ID: ca8919bc23010366900ac9e3378c651b0e0ab707e0499b170370e9ed39fb7596
Opcode Fuzzy Hash: fe3f31decb965d1eff72b2794d78ec19c2547cf145b65ae4249fd8c78f015923
Instruction Fuzzy Hash: 69E01AB4800205DFCB419FA4D80C66DBFB1FB19310F108409E806E7350CB388945AF50

Function 0056D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0056D86C
GetDC.USER32(00000000), ref: 0056D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0056D882
ReleaseDC.USER32(?), ref: 0056D8A3

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 587933b3dbc702fa7ea6e77ed2ba42330fd5dfb5924db8b132cafcaaa00c6018
Instruction ID: 967b2f4171f1099f455d179a3d3f2215e27ba0317e127c4cc6dd779dd11b1383
Opcode Fuzzy Hash: 587933b3dbc702fa7ea6e77ed2ba42330fd5dfb5924db8b132cafcaaa00c6018
Instruction Fuzzy Hash: 78E012B4800204EFCB41AFA4D80C66EBFB1BB19310B108408E80AE7360CB38990AAF50

Function 00584D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00517620: _wcslen.LIBCMT ref: 00517625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00584ED4

Strings

*, xrefs: 00584E10
LPT, xrefs: 00584DFB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 31dac028967185e3ec218c0345fa40a42418559712cfc114a86243a03fe5c98f
Instruction ID: ec4d1fe4e7100715e07138861d22498cf32366a0cc2e57413c7249f885553b84
Opcode Fuzzy Hash: 31dac028967185e3ec218c0345fa40a42418559712cfc114a86243a03fe5c98f
Instruction Fuzzy Hash: BB914A75A002059FDB14EF58C484AAABFB5BF48304F198099ED0AAB362D731ED85CF91

Function 00597771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0056569E,00000000,?,005ACC08,?,00000000,00000000), ref: 005978DD

Part of subcall function 00516B57: _wcslen.LIBCMT ref: 00516B6A

CharUpperBuffW.USER32(0056569E,00000000,?,005ACC08,00000000,?,00000000,00000000), ref: 0059783B

Strings

<s], xrefs: 005977C8

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <s]
API String ID: 3544283678-3287859866
Opcode ID: 6182392611b613d64539e4d75c28e1b8f7fd0a17099e032b753739e8bd8e7c2a
Instruction ID: f78ab4f2a3c13ab3eb41a6b18f90cb29e4d93f20758be01d84cf36e5052db489
Opcode Fuzzy Hash: 6182392611b613d64539e4d75c28e1b8f7fd0a17099e032b753739e8bd8e7c2a
Instruction Fuzzy Hash: C9616B7292411AAADF04EBA4CC95DFDBB78FF58300F540926E542A3191EF306A85DBA0

Function 0052E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0052E1B1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: ebd096cdad5b00089a014a309f1720a9cd61dbfbeafd85f61edb94e74676f74a
Instruction ID: 66adfff15f52614cec2f1f134505b049b2068563e8ecacdaee075e01aa8943b8
Opcode Fuzzy Hash: ebd096cdad5b00089a014a309f1720a9cd61dbfbeafd85f61edb94e74676f74a
Instruction Fuzzy Hash: A1513339502296DFDF15DF28D086AFA7FA8FF66310F644055E8929B2C0D6349D82CBA0

Function 0052F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0052F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0052F2BB

Strings

@, xrefs: 0052F2AF

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: c74dde67e1f6d21e205f5e19fd96fb59d69fa193dacbb454621c85b518957ae6
Instruction ID: c7a2995c9ab9ec5f6a5ad5f1cdfd9c427da7dc9de0f0fd6f0e4bc561255378ce
Opcode Fuzzy Hash: c74dde67e1f6d21e205f5e19fd96fb59d69fa193dacbb454621c85b518957ae6
Instruction Fuzzy Hash: 95514971408B499BE320AF14DC8ABABBBF8FFD9300F81485DF1D941195EB318569CB66

Function 00595745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 005957E0
_wcslen.LIBCMT ref: 005957EC

Strings

CALLARGARRAY, xrefs: 005957E6, 005957EB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 542c1432e0951ba05dcc4fb301acbd54f41edbbbf92c58c95735c4e1b51b50d2
Instruction ID: 1c137534ec4c76d0c473b9da2367f8f55f118cdcbbcc352f0b521fcfa437f5d1
Opcode Fuzzy Hash: 542c1432e0951ba05dcc4fb301acbd54f41edbbbf92c58c95735c4e1b51b50d2
Instruction Fuzzy Hash: 42418071A0010A9FCF15DFA9D8899EEBFF5FF99320F244069E505A7291E7309D91CB90

Function 0058D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0058D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0058D13A

Strings

|, xrefs: 0058D10B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 8dc1b1c69ce2af2d77bf59b796b38f88908ad9efa361b3b3ab525f61b27950a0
Instruction ID: 20de1884158e0cb95b0cdf2d8ee3d4ff1b41bc96ce37ac12595cdfae6ab8a7f9
Opcode Fuzzy Hash: 8dc1b1c69ce2af2d77bf59b796b38f88908ad9efa361b3b3ab525f61b27950a0
Instruction Fuzzy Hash: 91311A71D0020AABDF15EFA4CC89AEFBFB9FF44300F000119F815A6165DB31AA56DB60

Function 005A356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 005A3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 005A365C

Strings

static, xrefs: 005A35BC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 99cf8721bbbf0af5fb9d03e06293ab2ddf1a5e7f8a35beab55d70fb5d3a8ec86
Instruction ID: ec25a2110fa329503b0883681e4de8e28bc733ad666cfcda874b9030258fb835
Opcode Fuzzy Hash: 99cf8721bbbf0af5fb9d03e06293ab2ddf1a5e7f8a35beab55d70fb5d3a8ec86
Instruction Fuzzy Hash: 2231AD71500204AEEB109F68DC84EFF7BA9FF89724F008619F8A597280DA31AD81D760

Function 005A4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 005A461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 005A4634

Strings

', xrefs: 005A458E

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: b4c3178dca700e86665d0cc00e29ceb6bbc411a83cd23056dbacc146c5d51745
Instruction ID: cf6a83b4df17a8db4cdfa2242298cf86384d68b0ab00f160ebbea7432901c601
Opcode Fuzzy Hash: b4c3178dca700e86665d0cc00e29ceb6bbc411a83cd23056dbacc146c5d51745
Instruction Fuzzy Hash: 11310774A0120A9FDB14CFA9C990BEE7BB5FF8A300F14446AE905AB351D7B0A941DF90

Function 005A31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 005A327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005A3287

Strings

Combobox, xrefs: 005A3249

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 15a5f86fe614abad92210b838aafd138aa582b47e32194301fab63345ff049fc
Instruction ID: 2066e20eb525f80fa94064adbde64d5f5ed8f3dafd71121173266e5b07c47926
Opcode Fuzzy Hash: 15a5f86fe614abad92210b838aafd138aa582b47e32194301fab63345ff049fc
Instruction Fuzzy Hash: CF11D0752002086FEF219E94DC84FBF3F6AFF9A3A8F100125F9189B290D6319D5197A0

Function 005A3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0051600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0051604C
Part of subcall function 0051600E: GetStockObject.GDI32(00000011), ref: 00516060
Part of subcall function 0051600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0051606A

GetWindowRect.USER32(00000000,?), ref: 005A377A
GetSysColor.USER32(00000012), ref: 005A3794

Strings

static, xrefs: 005A3757

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 43475b6a7eb57b70b17046f5870abbcdfba026bbd09eba550e85b5845f200ab2
Instruction ID: 134114b73b3ec6008c4fdbef1b1a556f0835499b4b2661c04ee85addd2195076
Opcode Fuzzy Hash: 43475b6a7eb57b70b17046f5870abbcdfba026bbd09eba550e85b5845f200ab2
Instruction Fuzzy Hash: 7B1129B261020AAFDB00DFA8CC45EFE7BF8FB09354F004914F955E2250E735E9559B60

Function 0058CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0058CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0058CDA6

Strings

<local>, xrefs: 0058CD66

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: cf2ae006d965c32106c1efc617839c36901c7fc09f0c90bbf92d7c5d563d3e4c
Instruction ID: fb1ba8f2978b495ded9addbb0a05f2c7d65b8cdca9bcddf79a4e286ef4275730
Opcode Fuzzy Hash: cf2ae006d965c32106c1efc617839c36901c7fc09f0c90bbf92d7c5d563d3e4c
Instruction Fuzzy Hash: A811C671206671BAD7347B668C45EE7BEACFF127A4F00462AB909A3180D7709845D7F0

Function 005A3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 005A34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 005A34BA

Strings

edit, xrefs: 005A348F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 32e96a35f1f56fee2827c0d10b76a75478074af331fc01c2f331f47d7758c70d
Instruction ID: 9d9a95a7db6a4abb988c022aa4904b02f30f53cebd6b163eaa9ec8997abdc26b
Opcode Fuzzy Hash: 32e96a35f1f56fee2827c0d10b76a75478074af331fc01c2f331f47d7758c70d
Instruction Fuzzy Hash: 52116D71500208AFEF118E64DC48AAF3F6AFB5A378F504724FA61971D0C771DC959B60

Function 00576C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

CharUpperBuffW.USER32(?,?,?), ref: 00576CB6
_wcslen.LIBCMT ref: 00576CC2

Strings

STOP, xrefs: 00576CBC, 00576CC1

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 48ef831d5bccab33e5c52a4888385ecd87bd05b936b692faa66cfa2d71c84213
Instruction ID: 3d49b2ca4b2bfd66e2ba967bda0ef6c6f227092774e8f1505fe71e82b8efa2d0
Opcode Fuzzy Hash: 48ef831d5bccab33e5c52a4888385ecd87bd05b936b692faa66cfa2d71c84213
Instruction Fuzzy Hash: C30104326109278ACB219FBDEC849FF3FA8FAA1710B504924E85697190EB31DD40D650

Function 00571CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 00573CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00573CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00571D4C

Strings

ListBox, xrefs: 00571D16
ComboBox, xrefs: 00571CEB

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 61515f577900a0b1658e153a8864883cc219f3891f7cfca2c53f4e1eb5d5e1b2
Instruction ID: 56c65606ad72fa43332b8947cc37f72f61f05648d94eab46ad98a48e6579370e
Opcode Fuzzy Hash: 61515f577900a0b1658e153a8864883cc219f3891f7cfca2c53f4e1eb5d5e1b2
Instruction Fuzzy Hash: 06012831600215ABDB24EFA8DC55CFE7F68FF82390F00491AF866573C1EA305908AA60

Function 00571BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 00573CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00573CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00571C46

Strings

ListBox, xrefs: 00571C10
ComboBox, xrefs: 00571BE5

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: efe651c9493d0f528e7c4a7d4f627ef353659f84160671756b816cbee4653579
Instruction ID: 1ed53540a4fb225e058c0ca27bc0fbcb6ae22f75b40d3c3dadd142d70f95ccc8
Opcode Fuzzy Hash: efe651c9493d0f528e7c4a7d4f627ef353659f84160671756b816cbee4653579
Instruction Fuzzy Hash: 1401FC7164010566DB15E7D4D95A9FF7FACBF51340F200016A80A672C1EA209E08A6B5

Function 00571C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 00573CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00573CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00571CC8

Strings

ListBox, xrefs: 00571C94
ComboBox, xrefs: 00571C69

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 5236eee65be101673e819480d9aa51cae9b5e414ae6b3e37adac3c6d15ee0cc8
Instruction ID: 8e6eb290ae1d6c6b4aab50148884e3fb06073902ca1ef74948d86ff6d13b0da8
Opcode Fuzzy Hash: 5236eee65be101673e819480d9aa51cae9b5e414ae6b3e37adac3c6d15ee0cc8
Instruction Fuzzy Hash: CC012B7164051567DB15EBD8DA16AFE7FACBF51380F104016B84677281EA208F08E2B5

Function 0052A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0052A529

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Strings

,%^, xrefs: 0052A509
3yV, xrefs: 0052A545, 0052A54D, 0052A552

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%^$3yV
API String ID: 2551934079-817577063
Opcode ID: 3d492e377663612434aeece31e17e115a4dd26e799b10a603d7cd03b3f516d98
Instruction ID: 7c970d733234b0c6971b9745d9ffd2b6b1bc791d4476596c126bdaaeb97af815
Opcode Fuzzy Hash: 3d492e377663612434aeece31e17e115a4dd26e799b10a603d7cd03b3f516d98
Instruction Fuzzy Hash: 6401F73270066197CE08F768E86FA9E7F68BF86710F401425F9025B1C2DE509D458AD7

Function 00571D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00519CB3: _wcslen.LIBCMT ref: 00519CBD

Part of subcall function 00573CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00573CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00571DD3

Strings

ListBox, xrefs: 00571DA0
ComboBox, xrefs: 00571D75

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: c1906120f15ece6188a70272699d37bdf878a5bdd94cb6e4fbb33a2b7b03104e
Instruction ID: 71db3bd30f6f6bb1b2676e8472bfb60ce74419c7ba3cd27692c5cc23827dc00c
Opcode Fuzzy Hash: c1906120f15ece6188a70272699d37bdf878a5bdd94cb6e4fbb33a2b7b03104e
Instruction Fuzzy Hash: DCF04970A0021566E714E7A8DC56BFE7F6CBF42390F040816B866632C1EA205D0896A0

Function 005A8172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,005E3018,005E305C), ref: 005A81BF
CloseHandle.KERNEL32 ref: 005A81D1

Strings

\0^, xrefs: 005A818A

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0^
API String ID: 3712363035-3379709126
Opcode ID: 32db07969f3fce4702b68c3c4357e8697df40c1f1b821e513b0bd5300fc3f239
Instruction ID: 199575348d26d12ddfc890ce9e6295e2c54b067e2b0307b05e0c5fef0570b743
Opcode Fuzzy Hash: 32db07969f3fce4702b68c3c4357e8697df40c1f1b821e513b0bd5300fc3f239
Instruction Fuzzy Hash: AAF089B1640340BEE7246761AC4DFB73E9CEB15750F000461FB48DB1A1D6758E14A3F4

Function 0059747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00597493
_wcslen.LIBCMT ref: 005974B9

Strings

3, 3, 16, 1, xrefs: 00597483

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: b97c82e97b9f76108d7faa4ffa72d9c8ab74e129d18355eba94377ff6c9fba8e
Instruction ID: 0dbe8ab5f30028e2020a1f2af57ed84f5bd2056c98449352165aaefa24bcd8b5
Opcode Fuzzy Hash: b97c82e97b9f76108d7faa4ffa72d9c8ab74e129d18355eba94377ff6c9fba8e
Instruction Fuzzy Hash: 5FE02B03225321109B3112799CC5B7F5F8DFFCD760B14182BF989C2267EAA49D9193A0

Function 00570B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00570B23

Strings

Error allocating memory., xrefs: 00570B1C
AutoIt, xrefs: 00570B17

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 47f77a3db29c393022b32a0e9ffa64ebb20c4000b6e52fc7574fff76f6c69393
Instruction ID: 7e4c69ad8a3154ecb3eab911f476bee69323bb0faac76fd07e8a519cd20152dc
Opcode Fuzzy Hash: 47f77a3db29c393022b32a0e9ffa64ebb20c4000b6e52fc7574fff76f6c69393
Instruction Fuzzy Hash: 8AE0D8322443192AD31437547C07F8D7FC8FF06B20F10042BF758555C38EE1689056A9

Function 00530D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0052F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00530D71,?,?,?,0051100A), ref: 0052F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0051100A), ref: 00530D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0051100A), ref: 00530D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00530D7F

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: aea7f27dbaea130a961ef3b5b8875058a0ec245fa07bdaa42d00e76bec545277
Instruction ID: 928c34918856d7bb29dd197693750a8d2d268d4c437d567f50edcac5761334f2
Opcode Fuzzy Hash: aea7f27dbaea130a961ef3b5b8875058a0ec245fa07bdaa42d00e76bec545277
Instruction Fuzzy Hash: A8E06D742007518BD7609FB8E41834A7FE4BF15744F004D2DE4C2C6691DBB0E4889B91

Function 0052E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0052E3D5

Strings

8%^, xrefs: 0052E3CA
0%^, xrefs: 0052E3B5

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%^$8%^
API String ID: 1385522511-2219163478
Opcode ID: 9d555d80d306128dcd2a2438f01b95a601c879dab61278852ec3b23f3fed72d9
Instruction ID: 109e54cbb7a2779ec71da4751c73cd58f25d60cdef7062a304f4a2b57a14564b
Opcode Fuzzy Hash: 9d555d80d306128dcd2a2438f01b95a601c879dab61278852ec3b23f3fed72d9
Instruction Fuzzy Hash: E9E02631400BB4CBC60CD718FAAAA8C3B99BF66321F1019AAE0828F1DDDBB038419654

Function 00583017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0058302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00583044

Strings

aut, xrefs: 00583038

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 038fd748eb899c10e404d46cb98af4203e423808cc145bea8e3fd1be1bbd4c8d
Instruction ID: 6349e2c1f7829ac0352a18ac60e74142055a2daec3e7fff74015cc1ae81553e9
Opcode Fuzzy Hash: 038fd748eb899c10e404d46cb98af4203e423808cc145bea8e3fd1be1bbd4c8d
Instruction Fuzzy Hash: 27D05B7550031467DB3097949D0DFC73F6CDB05750F0001927795D2091DAB09544CAD0

Function 0056D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0056D220

Strings

X64, xrefs: 0056D2A8
%.3d, xrefs: 0056D22B

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: b8409e17d4200147f0b9e367c3f296fab4efbdfc5dee24edf01ed9c74ccb4cf2
Instruction ID: 729f93c779faf7c5fefaa4e5baeb76e7960134e890187afc99c36b062005929c
Opcode Fuzzy Hash: b8409e17d4200147f0b9e367c3f296fab4efbdfc5dee24edf01ed9c74ccb4cf2
Instruction Fuzzy Hash: 08D012B9D08119EACB9096D0DC599B9BF7CBF19301F508C63F80693040E728C5086771

Function 005A2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005A236C
PostMessageW.USER32(00000000), ref: 005A2373

Part of subcall function 0057E97B: Sleep.KERNELBASE ref: 0057E9F3

Strings

Shell_TrayWnd, xrefs: 005A2365

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ef8ce8b7263ef2e9b347cce515b7206e9270bdb19736ddad507828988d45336c
Instruction ID: ec4612f7faff35dbf9ca8e59b975b5bf59650b54b771ba011fdf326b28704b8e
Opcode Fuzzy Hash: ef8ce8b7263ef2e9b347cce515b7206e9270bdb19736ddad507828988d45336c
Instruction Fuzzy Hash: 6DD0C9327813147AE674A774AC0FFC67E14AB6AB10F0049167755AA1D0C9A0A8059A54

Function 005A2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005A232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 005A233F

Part of subcall function 0057E97B: Sleep.KERNELBASE ref: 0057E9F3

Strings

Shell_TrayWnd, xrefs: 005A2325

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: b882b64230f2ef6580c231a04d653a9ed3fda31972be08b0d73096505933e10e
Instruction ID: 8de9d5149be15e572fdd04aa17f7a7b24b8beb12ead648874b83316531c9eaa7
Opcode Fuzzy Hash: b882b64230f2ef6580c231a04d653a9ed3fda31972be08b0d73096505933e10e
Instruction Fuzzy Hash: E8D0C936794314BAE674A774AC0FFC67E14AB66B10F0049167759AA1D0C9A0A8059A54

Function 0054BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0054BE93
GetLastError.KERNEL32 ref: 0054BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0054BEFC

Memory Dump Source

Source File: 00000000.00000002.3411807371.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.3411758295.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3411935546.00000000005D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412059080.00000000005DC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412083806.00000000005E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 7aadc3fd7e1c94f39ff6b3d1abf2761b74e65f37c85b50beb53bc8cc30d48b33
Instruction ID: d452c11331f3303bf01371c9cfd767e24b744700ee79f0f7602882199bd2f8ef
Opcode Fuzzy Hash: 7aadc3fd7e1c94f39ff6b3d1abf2761b74e65f37c85b50beb53bc8cc30d48b33
Instruction Fuzzy Hash: A141C234604206BBEF258F65CC88AEA7FA9BF82314F144169F95D971A2DB31CD05DB50

Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.55"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.55", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.55"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.55", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hFOnaDtDOSe559r&MD=bZDha1yM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hFOnaDtDOSe559r&MD=bZDha1yM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.4
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.4
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.4
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: unknown	DoH DNS queries detected: name: bzib.nelreports.net
Source: unknown	DoH DNS queries detected: name: bzib.nelreports.net

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\03497265-2cb6-40d8-8cf5-efa866ab974a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\09ce9a8f-749d-4880-88b8-2b2b3a7087c6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\15596517-d84e-4e1c-8d08-3016344b1277.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\429af133-5d07-4235-bfb0-a4790ecb5912.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6aed8b19-eb55-47bd-8c62-e3b284954e79.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\71c16708-7c4e-45d2-a503-3807da81b561.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\dee2992e-9977-4b4e-b2d2-6d30f964ed6a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D37771-1468.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D37771-D64.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\2abdf889-49cf-4a5a-8b00-4c09dbe79a8f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\2d6d805d-f483-4ac7-a834-bab1b01cd13f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\403624e5-0169-46b9-8b2d-285da359ec36.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\413ddbed-6b1a-44df-8605-a5a57788fcfe.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre