Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Wave Browser.exe

Overview

General Information

Sample name:Wave Browser.exe
Analysis ID:1468666
MD5:938c6a14b9132727c3d29951610100d0
SHA1:189056824936b67d9bc96586f26975af0b351b27
SHA256:7a14127890cc5f7c0d6746a55dce214c701ee111224a065ad332bd2182106c02
Infos:

Detection

Score:45
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:32
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Creates multiple autostart registry keys
Found evasive API chain checking for user administrative privileges
Maps a DLL or memory area into another process
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Potential browser exploit detected (process start blacklist hit)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Use Short Name Path in Command Line
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • Wave Browser.exe (PID: 6632 cmdline: "C:\Users\user\Desktop\Wave Browser.exe" MD5: 938C6A14B9132727C3D29951610100D0)
    • SWUpdaterSetup.exe (PID: 908 cmdline: "C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" MD5: 18693249F3A283E83B8179E692FFBBA9)
      • SWUpdater.exe (PID: 1900 cmdline: "C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" MD5: 57428456C6E6C2EA328C864681DB5DF3)
        • SWUpdater.exe (PID: 6388 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /regserver MD5: 57428456C6E6C2EA328C864681DB5DF3)
          • SWUpdaterComRegisterShell64.exe (PID: 7108 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user MD5: 10B82DC9D9A29BC4AF224981F0E1C6FE)
          • SWUpdaterComRegisterShell64.exe (PID: 4076 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user MD5: 10B82DC9D9A29BC4AF224981F0E1C6FE)
          • SWUpdaterComRegisterShell64.exe (PID: 6576 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user MD5: 10B82DC9D9A29BC4AF224981F0E1C6FE)
        • SWUpdater.exe (PID: 7328 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9Ins1RjRENDdGRS1CNDQ4LTQzNDAtQjY1Qi03QUYyNDVFRTc5MEN9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezVEOUEyNUNELTJDQkQtNDIxMS1CM0MzLTIxMEREQzcxNjk4MH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjEzMy4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTAxNiIvPjwvYXBwPjwvcmVxdWVzdD4 MD5: 57428456C6E6C2EA328C864681DB5DF3)
        • SWUpdater.exe (PID: 7344 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /handoff "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{5F4D47FE-B448-4340-B65B-7AF245EE790C}" MD5: 57428456C6E6C2EA328C864681DB5DF3)
          • iexplore.exe (PID: 7944 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
            • iexplore.exe (PID: 8000 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
              • ie_to_edge_stub.exe (PID: 8072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2 MD5: 89CF8972D683795DAB6901BC9456675D)
                • msedge.exe (PID: 8124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2 MD5: 69222B8101B0601CC6663F8381E7E00F)
                  • msedge.exe (PID: 6580 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=2004,i,3718953657744578865,13232452162775934316,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
              • ssvagent.exe (PID: 8108 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)
            • iexplore.exe (PID: 8428 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17414 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
            • iexplore.exe (PID: 1364 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:82952 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
            • iexplore.exe (PID: 8132 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17420 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
            • iexplore.exe (PID: 3428 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:82962 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)
          • iexplore.exe (PID: 8360 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
          • iexplore.exe (PID: 7360 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
          • iexplore.exe (PID: 2172 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
          • iexplore.exe (PID: 7292 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
          • iexplore.exe (PID: 9176 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" MD5: CFE2E6942AC1B72981B3105E22D3224E)
  • SWUpdater.exe (PID: 6748 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /c MD5: 57428456C6E6C2EA328C864681DB5DF3)
    • SWUpdater.exe (PID: 6752 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /cr MD5: 57428456C6E6C2EA328C864681DB5DF3)
    • SWUpdater.exe (PID: 5744 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource core MD5: 57428456C6E6C2EA328C864681DB5DF3)
  • SWUpdater.exe (PID: 7084 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource scheduler MD5: 57428456C6E6C2EA328C864681DB5DF3)
    • SWUpdater.exe (PID: 7260 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /registermsihelper MD5: 57428456C6E6C2EA328C864681DB5DF3)
    • SWUpdater.exe (PID: 7412 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /uninstall MD5: 57428456C6E6C2EA328C864681DB5DF3)
      • SWUpdater.exe (PID: 7592 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0ie0IwNEYxMzYzLTQxQTgtNDg2RS1BOTU4LTEzMUZDNTcwRTEwOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RUIxNDlBRDItQ0U0RS00RjUxLUI3RkMtQTE0OUZBQTRDQ0FGfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg MD5: 57428456C6E6C2EA328C864681DB5DF3)
      • SWUpdater.exe (PID: 5764 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0iezMyNzQ0Q0IzLUQ3M0EtNEQ5NC1BMkIyLUM1ODIwNUE0NDJBQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iMS4zLjEzMy4wIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg MD5: 57428456C6E6C2EA328C864681DB5DF3)
      • SWUpdater.exe (PID: 8760 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /unregserver MD5: 57428456C6E6C2EA328C864681DB5DF3)
        • SWUpdaterComRegisterShell64.exe (PID: 7212 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user /unregister MD5: 10B82DC9D9A29BC4AF224981F0E1C6FE)
        • SWUpdaterComRegisterShell64.exe (PID: 6912 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user /unregister MD5: 10B82DC9D9A29BC4AF224981F0E1C6FE)
  • SWUpdaterCore.exe (PID: 7716 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe" MD5: D40BD627BFB2BA39C5452A71A450EABD)
    • SWUpdater.exe (PID: 7756 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /c MD5: 57428456C6E6C2EA328C864681DB5DF3)
  • SWUpdaterCore.exe (PID: 7928 cmdline: "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe" MD5: D40BD627BFB2BA39C5452A71A450EABD)
  • msedge.exe (PID: 6988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5880 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • identity_helper.exe (PID: 8700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
    • identity_helper.exe (PID: 8720 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
  • msedge.exe (PID: 9152 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8556 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2040,i,9846940053479223879,3976424785995044148,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 8160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 9036 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2004,i,761526046158747839,15104522579484344094,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe", EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe, ProcessId: 1900, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wavesor SWUpdater
Sigma detected: Use Short Name Path in Command Line
Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17410 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 8000, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 8108, ProcessName: ssvagent.exe
Sigma detected: Modification of IE Registry Settings
Source: Registry Key setAuthor: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 7944, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: Wave Browser.exeVirustotal: Detection: 10%Perma Link
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterSetup.exeJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeEXE: SWUpdater.exe
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdater.exeJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\Download\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}\1.3.16.5\WaveInstaller-v1.3.16.5.exe
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterBroker.exeJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\Install\{DF7E1C1A-4867-4899-A0E8-C8CB671FD3D1}\WaveInstaller-v1.3.16.5.exe
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterOnDemand.exeJump to behavior

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterSetup.exeJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeEXE: SWUpdater.exe
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdater.exeJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\Download\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}\1.3.16.5\WaveInstaller-v1.3.16.5.exe
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterBroker.exeJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\Install\{DF7E1C1A-4867-4899-A0E8-C8CB671FD3D1}\WaveInstaller-v1.3.16.5.exe
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeEXE: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterOnDemand.exeJump to behavior
Uses 32bit PE files
Source: Wave Browser.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
PE / OLE file has a valid certificate
Source: Wave Browser.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: Wave Browser.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: SWUpdaterComRegisterShell64_unsigned.pdbP source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738588150.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000000.1741960503.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000000.1742955987.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000002.1743564119.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000000.1743802096.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000002.1744612123.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000002.2489252047.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000000.2487737954.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000000.2489781316.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000002.2494623269.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: psmachine_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: SWUpdaterCore_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738388621.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738545852.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterCore.exe, 00000012.00000000.1865393070.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000000.1946044712.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000002.1946622318.000000000089D000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: SWUpdaterComRegisterShell64_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738588150.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000000.1741960503.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000000.1742955987.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000002.1743564119.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000000.1743802096.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000002.1744612123.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000002.2489252047.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000000.2487737954.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000000.2489781316.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000002.2494623269.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\code\test\Plugins\inetc.pdb source: Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739055852.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, psuser.dll.2.dr
Source: Binary string: SWUpdater_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000000.1736030007.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, SWUpdater.exe, 00000002.00000003.1737496383.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739671737.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000007.00000000.1745569954.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000008.00000002.1779830130.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000009.00000002.1806143853.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 0000000A.00000002.1755368191.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 0000000C.00000002.1759430979.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 0000000D.00000002.2087500459.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 0000000E.00000002.3098537873.0000000000C31000.00000020.00000001.01000000.00000022.sdmp, SWUpdater.exe, 0000000F.00000000.1778826031.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000010.00000002.2157396726.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000013.00000002.1872396760.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000027.00000002.2482941996.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000031.00000000.2486646354.0000000000C31000.00000020.00000001.01000000.00000012.sdmp
Source: Binary string: goopdate_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737926668.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, swupdater.dll.2.dr
Source: Binary string: goopdate_unsigned.pdbq source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737926668.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, swupdater.dll.2.dr
Source: Binary string: SWUpdaterBroker_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: SWUpdaterCore_unsigned.pdbT source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738388621.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738545852.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterCore.exe, 00000012.00000000.1865393070.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000000.1946044712.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000002.1946622318.000000000089D000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: psmachine_unsigned.pdbI source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_64.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739466166.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdbI source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739055852.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, psuser.dll.2.dr
Source: Binary string: mi_exe_stub.pdb source: SWUpdaterSetup.exe, 00000001.00000000.1732568290.0000000000D87000.00000002.00000001.01000000.0000000E.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: SWUpdaterOnDemand_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740605908.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned_64.pdbE source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_64.pdbE source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739466166.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: swupdaterres_unsigned_en.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004BF000.00000004.00000010.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F30000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1738879717.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000008.00000002.1780255860.0000000001250000.00000002.00000001.00040000.00000019.sdmp, SWUpdater.exe, 0000000A.00000002.1755764745.0000000000C80000.00000002.00000001.00040000.00000019.sdmp, SWUpdater.exe, 0000000E.00000002.3098905569.00000000011F0000.00000002.00000001.00040000.00000023.sdmp, swupdaterres_en.dll.2.dr
Source: Binary string: psuser_unsigned_64.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServerJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ElevationJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandlerJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServerJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServerJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ElevationJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ElevationJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAsJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_0040626D FindFirstFileA,FindClose,0_2_0040626D
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405732
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_004026FE FindFirstFileA,0_2_004026FE
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B35404CC FindFirstFileExW,4_2_00007FF6B35404CC
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Source: Joe Sandbox ViewIP Address: 2.23.209.149 2.23.209.149
Source: Joe Sandbox ViewIP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox ViewIP Address: 151.101.129.108 151.101.129.108
Source: Joe Sandbox ViewIP Address: 152.195.19.97 152.195.19.97
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: SWUpdater.exe, 0000000E.00000003.2798252352.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <data name="install" status="ok" index="1">{"homepage":"","homepage_is_newtabpage":true,"browser":{"show_home_button":true,"default_browser_setting_enabled":true},"distribution":{"suppress_first_run_bubble":true,"suppress_first_run_default_browser_prompt":true,"welcome_page_on_os_upgrade_enabled":false,"do_not_register_for_update_launch":true},"first_run_tabs":["chrome://newtab/"],"default_search_provider_data":{"template_url_data":{"created_by_policy":false,"favicon_url":"http://www.yahoo.com/favicon.ico","id":"26","input_encodings":["UTF-8"],"keyword":"WaveBrowser search","prepopulate_id":26,"safe_for_autoreplace":true,"search_terms_replacement_key":"","short_name":"WaveBrowser","suggestions_url":"https://ff.search.yahoo.com/gossip?output=fxjson&amp;command={searchTerms}","suggestions_url_post_params":"","url":"https://api.wavebrowserbase.com/search/yhs","usage_count":0}},"default_apps":"install","variations_compressed_seed":"H4sIAAAAAAAA/32QwUrDQBCGEz1Upi0tC1KbWimiWC/FBE3j1baKORrQq5vuhC6kG91sqn0Er4LvK1WDiZg9LvPN/t/8MBife7bHIhw7NkWbRpHHQgfdueOe2ZcOUvJuQn/2qlAKGgcoVyg3L5HyRKSBytjaM/0TqM0EDWNkbRZasFfF+0PYmfL0mzRCi1STdahNMaJZrNrGXZPU7JEzckfOYHtoPJpfUrfLp0Sq/AOtlLGRquJLUmwjVUnqpd5MsK5k8pKivMmoZJyKYMExZrnRUbGmDuz+C/vHpY46pALTu3yYcPCzd41UZRLTe57ykMdcrXOfYbGhHnQrF/zTUkU9okHrWq9nIJNEKJnEExQKZa6yX6ymBc0S5PdLlbTIn7E+cgGtB7rCYL7AJeZ53eLpDYBfwrdKtzZIcaZNOtyyLz4Bwrb761EDAAA=","variations_seed_signature":"MEQCIExuFpavgcP2hwxz4h9WJErAMdcZNc+bwhNirHP+6Kp/AiBaxCcxY9FATvg/MH6P21S90qm equals www.yahoo.com (Yahoo)
Source: SWUpdater.exe, 0000000E.00000003.2793395202.0000000001339000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <data name="install" status="ok" index="1">{"homepage":"","homepage_is_newtabpage":true,"browser":{"show_home_button":true,"default_browser_setting_enabled":true},"distribution":{"suppress_first_run_bubble":true,"suppress_first_run_default_browser_prompt":true,"welcome_page_on_os_upgrade_enabled":false,"do_not_register_for_update_launch":true},"first_run_tabs":["chrome://newtab/"],"default_search_provider_data":{"template_url_data":{"created_by_policy":false,"favicon_url":"http://www.yahoo.com/favicon.ico","id":"26","input_encodings":["UTF-8"],"keyword":"WaveBrowser search","prepopulate_id":26,"safe_for_autoreplace":true,"search_terms_replacement_key":"","short_name":"WaveBrowser","suggestions_url":"https://ff.search.yahoo.com/gossip?output=fxjson&amp;command={searchTerms}","suggestions_url_post_params":"","url":"https://api.wavebrowserbase.com/search/yhs","usage_count":0}},"default_apps":"install","variations_compressed_seed":"H4sIAAAAAAAA/32QwUrDQBCGEz1Upi0tC1KbWimiWC/FBE3j1baKORrQq5vuhC6kG91sqn0Er4LvK1WDiZg9LvPN/t/8MBife7bHIhw7NkWbRpHHQgfdueOe2ZcOUvJuQn/2qlAKGgcoVyg3L5HyRKSBytjaM/0TqM0EDWNkbRZasFfF+0PYmfL0mzRCi1STdahNMaJZrNrGXZPU7JEzckfOYHtoPJpfUrfLp0Sq/AOtlLGRquJLUmwjVUnqpd5MsK5k8pKivMmoZJyKYMExZrnRUbGmDuz+C/vHpY46pALTu3yYcPCzd41UZRLTe57ykMdcrXOfYbGhHnQrF/zTUkU9okHrWq9nIJNEKJnEExQKZa6yX6ymBc0S5PdLlbTIn7E+cgGtB7rCYL7AJeZ53eLpDYBfwrdKtzZIcaZNOtyyLz4Bwrb761EDAAA=","variations_seed_signature":"MEQCIExuFpavgcP2hwxz4h9WJErAMdcZNc+bwhNirHP+6Kp/AiBaxCcxY9FATvg/MH6P21S90qmc3+rldyGha6/pPEGC+g=="}</data> equals www.yahoo.com (Yahoo)
Source: me[1].json.48.drString found in binary or memory: My New Book! How to Draw Fun Stuff! https://amzn.to/3EEIx8F Drawing lifelike portraits with precision (Elvis Presley). Satsifying technique with a 4B pencil on 110lb cardstock. Like and Subscribe if you enjoyed this drawing video: https://www.youtube.com/@JonathanStephenHarris As always thank you for watching and make sure you are notified for future updates by ringing that bell next to the subscribe button! :) ---------------------------------------------------------------------------------------------------------- Other ways to support this channel: equals www.youtube.com (Youtube)
Source: iexplore.exe, 00000017.00000002.3522431981.000001A0A6120000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522431981.000001A0A6129000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x4e7a20c1,0x01dad04b</date><accdate>0x4e7a20c1,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: me[1].json.48.drString found in binary or memory: FACEBOOK: https://www.facebook.com/JonathanStephenHarrisOfficial/ equals www.facebook.com (Facebook)
Source: me[1].json.48.drString found in binary or memory: MY WEBSITE: http://www.jshcreates.com #PortraitArt #PortraitDrawing #PencilDrawing","url":"https://www.youtube.com/watch?v=u74qDcpxXk0","locale":"en-us","videoMetadata":{"playTime":658,"viewCount":1,"motionThumbnailUrl":"https://th.bing.com/th?id=OMB1.u27aIbbdK5um4w_1710590836&pid=2.1","channelPageUrl":"https://www.youtube.com/channel/UCp4ScbYr7qCOFpXwa6VaAkw","channelTitle":"Jon Harris","domain":"youtube.com","mediaUniqueId":"E3A69B2BDDB621DA6EBBE3A69B2BDDB621DA6EBB","allowEmbed":true,"allowHttpsEmbed":true,"allowMobileEmbed":true},"externalVideoFiles":[{"url":"","width":1920,"height":1080}],"publishedDateTime":"1/31/2024 4:00:39 PM","isFeatured":false,"images":[{"width":1920,"height":1080,"url":"https://th.bing.com/th?id=OVP.9A-pFe7yeEbzBXpRLwSfygEsDh","title":"Drawing Lifelike Portraits with Precision | Elvis Presley","caption":"Drawing Lifelike Portraits with Precision | Elvis Presley","source":"bing"}],"colorSamples":[{"isDarkMode":true,"hexColor":"#253D3B"},{"isDarkMode":false,"hexColor":"#EAF5F5"}],"provider":{"id":"vid-26mmg0by88bgjh5nyy22imrjtv6hq9gv0qhak46vshvxxnc98tka","name":"Jon Harris","logoUrl":"https://www.bing.com/th?id=AR_e1aad59e9b84f32b322c4036057c9f3d"},"category":"news","reactionSummary":{"totalCount":105,"subReactionSummaries":[{"totalCount":58,"type":"downvote"},{"totalCount":47,"type":"upvote"}]},"reactionStatus":"on","commentSummary":{"totalCount":0},"commentStatus":"on","subscriptionProductType":"undefined","feed":{"feedName":"news"},"topics":[],"isWorkNewsContent":false,"reasons":[{"type":"followTopic","follow":{"id":"Y_414a7c40-a373-4025-b4ce-e9502e9e17ed","name":"Entertainment","time":"2022-02-23T21:08:20Z"}},{"type":"explore","rank":1,"follow":{"id":"","name":"entertainment","time":""}}],"ri":"313","recoId":"qV4Rh_Owcb2kkWNG4kwNoU3rQm","source":"WebVideo"},{"id":"AA1fu1yB","type":"article","title":"10 Hard Anime That Are Worth Getting Into","abstract":"From complex titles like LOTGH to long-running series like One Piece, many anime are difficult to get into equals www.youtube.com (Youtube)
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: URLhttp://www.facebook.com/ equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: URLhttp://www.twitter.com/ equals www.twitter.com (Twitter)
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: URLhttp://www.youtube.com/ equals www.youtube.com (Youtube)
Source: SWUpdater.exe, 0000000E.00000002.3099783546.0000000001363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: _for_update_launch":true},"first_run_tabs":["chrome://newtab/"],"default_search_provider_data":{"template_url_data":{"created_by_policy":false,"favicon_url":"http://www.yahoo.com/favicon.ico","id":"26","input_encodings":["UTF-8"],"keyword":"WaveBrowser search","prepopulate_id":26,"safe_for_autoreplace":true,"search_terms_replacement_key":"","short_name":"WaveBrowser","suggestions_url":"https://ff.search.yahoo.com/gossip?output=fxjson&amp;command={searchTerms}","suggestions_ur equals www.yahoo.com (Yahoo)
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.facebook.com/; equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.facebook.com/favicon.ico equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.myspace.com/favicon.ico& equals www.myspace.com (Myspace)
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/favicon.ico equals www.rambler.ru (Rambler)
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/m equals www.rambler.ru (Rambler)
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: SWUpdater.exe, 0000000E.00000003.2795246763.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099433056.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798459692.0000000001301000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yahoo.com/favicon.ico","id":"26","input_encodings":["UTF-8"], equals www.yahoo.com (Yahoo)
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: iexplore.exe, 00000017.00000002.3522761477.000001A0A64C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/p equals www.youtube.com (Youtube)
Source: SWUpdater.exe, 0000000E.00000003.2790429232.0000000004340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: {"homepage":"","homepage_is_newtabpage":true,"browser":{"show_home_button":true,"default_browser_setting_enabled":true},"distribution":{"suppress_first_run_bubble":true,"suppress_first_run_default_browser_prompt":true,"welcome_page_on_os_upgrade_enabled":false,"do_not_register_for_update_launch":true},"first_run_tabs":["chrome://newtab/"],"default_search_provider_data":{"template_url_data":{"created_by_policy":false,"favicon_url":"http://www.yahoo.com/favicon.ico","id":"26","input_encodings":["UTF-8"],"keyword":"WaveBrowser search","prepopulate_id":26,"safe_for_autoreplace":true,"search_terms_replacement_key":"","short_name":"WaveBrowser","suggestions_url":"https://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}","suggestions_url_post_params":"","url":"https://api.wavebrowserbase.co equals www.yahoo.com (Yahoo)
Source: SWUpdater.exe, 0000000E.00000003.2790429232.0000000004340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: {"homepage":"","homepage_is_newtabpage":true,"browser":{"show_home_button":true,"default_browser_setting_enabled":true},"distribution":{"suppress_first_run_bubble":true,"suppress_first_run_default_browser_prompt":true,"welcome_page_on_os_upgrade_enabled":false,"do_not_register_for_update_launch":true},"first_run_tabs":["chrome://newtab/"],"default_search_provider_data":{"template_url_data":{"created_by_policy":false,"favicon_url":"http://www.yahoo.com/favicon.ico","id":"26","input_encodings":["UTF-8"],"keyword":"WaveBrowser search","prepopulate_id":26,"safe_for_autoreplace":true,"search_terms_replacement_key":"","short_name":"WaveBrowser","suggestions_url":"https://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}","suggestions_url_post_params":"","url":"https://api.wavebrowserbase.com/search/yhs","usage_count":0}},"default_apps":"install","variations_compressed_seed":"H4sIAAAAAAAA/32QwUrDQBCGEz1Upi0tC1KbWimiWC/FBE3j1baKORrQq5vuhC6kG91sqn0Er4LvK1WDiZg9LvPN/t/8MBife7bHIhw7NkWbRpHHQgfdueOe2ZcOUvJuQn/2qlAKGgcoVyg3L5HyRKSBytjaM/0TqM0EDWNkbRZasFfF+0PYmfL0mzRCi1STdahNMaJZrNrGXZPU7JEzckfOYHtoPJpfUrfLp0Sq/AOtlLGRquJLUmwjVUnqpd5MsK5k8pKivMmoZJyKYMExZrnRUbGmDuz+C/vHpY46pALTu3yYcPCzd41UZRLTe57ykMdcrXOfYbGhHnQrF/zTUkU9okHrWq9nIJNEKJnEExQKZa6yX6ymBc0S5PdLlbTIn7E+cgGtB7rCYL7AJeZ53eLpDYBfwrdKtzZIcaZNOtyyLz4Bwrb761EDAAA=","variations_seed_signature":"MEQCIExuFpavgcP2hwxz4h9WJErAMdcZNc+bwhNirHP+6Kp/AiBaxCcxY9FATvg/MH6P21S90qmc3+rldyGha6/pPEGC+g=="}t equals www.yahoo.com (Yahoo)
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amazon.fr/&
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ariadna.elmundo.es/5
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arianna.libero.it/d
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arianna.libero.it/favicon.icoW
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://asp.usatoday.com/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://asp.usatoday.com/favicon.ico&
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://auone.jp/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://br.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browse.guardian.co.uk/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://browse.guardian.co.uk/favicon.icog
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.buscape.com.br/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.igbusca.com.br/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.icou
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.orange.es/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.uol.com.br/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.uol.com.br/H
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.lycos.es/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com.br/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com/
Source: iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com/favicon.icod
Source: iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.com/favicon.icok
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscador.terra.es/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscar.ozu.es/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://buscar.ya.com/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://busqueda.aol.com.mx/
Source: Wave Browser.exe, 00000000.00000002.3120195749.0000000002818000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740172913.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740136023.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737789046.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740569385.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739259584.0000000000FD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1735930762.0000000000882000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740099786.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Wave Browser.exe, 00000000.00000002.3120195749.0000000002818000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740172913.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740136023.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737789046.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740569385.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739259584.0000000000FD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3120195749.0000000002818000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1735930762.0000000000882000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740099786.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740172913.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cerca.lycos.it/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015469461.000001A0A3156000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cnet.search.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015574156.000001A0A3175000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3176000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://corp.naukri.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://corp.naukri.com/favicon.ico
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: Wave Browser.exe, 00000000.00000002.3120195749.0000000002818000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740172913.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740136023.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737789046.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740569385.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739259584.0000000000FD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1735930762.0000000000882000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740099786.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Wave Browser.exe, 00000000.00000002.3120195749.0000000002818000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740172913.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740136023.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737789046.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740569385.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739259584.0000000000FD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SWUpdater.exe, 0000000E.00000002.3098905569.00000000011F5000.00000002.00000001.00040000.00000023.sdmp, Wave Browser.exe, psuser.dll.2.dr, swupdaterres_en.dll.2.dr, swupdater.dll.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1735930762.0000000000882000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740099786.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://de.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://es.ask.com/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://es.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://es.search.yahoo.com/B
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://esearch.rakuten.co.jp/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://espanol.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://espn.go.com/favicon.icoE
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://find.joins.com/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fr.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fr.search.yahoo.com/f
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.pchome.com.tw/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.pchome.com.tw/L
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.altervista.org/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.altervista.org/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ie8.ebay.com/open
Source: iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico1
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://images.monster.com/favicon.icoO
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.atlas.cz/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015469461.000001A0A3156000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://in.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://it.search.dada.net/-
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://it.search.dada.net/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://it.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jobsearch.monster.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://kr.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/
Source: iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://msk.afisha.ru/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://msk.afisha.ru/9
Source: Wave Browser.exe, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000000.1662723487.0000000000409000.00000008.00000001.01000000.00000003.sdmp, WaveInstaller-v1.3.16.5.exe0.14.drString found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000000.1662723487.0000000000409000.00000008.00000001.01000000.00000003.sdmp, WaveInstaller-v1.3.16.5.exe0.14.drString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocnsearch.goo.ne.jp/E
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1735930762.0000000000882000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740099786.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3120195749.0000000002818000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1735930762.0000000000882000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740099786.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740172913.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: Wave Browser.exe, 00000000.00000002.3120195749.0000000002818000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740172913.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740136023.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737789046.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740569385.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739259584.0000000000FD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: Wave Browser.exe, 00000000.00000002.3120195749.0000000002818000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740172913.0000000000FDB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740136023.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737789046.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740569385.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739259584.0000000000FD7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p.zhongsou.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://price.ru/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://price.ru/H
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://price.ru/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://price.ru/favicon.icoY
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.linternaute.com/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.tf1.fr/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.tf1.fr/0
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://rover.ebay.comw
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ru.search.yahoo.com
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sads.myspace.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search-dyn.tiscali.it/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.about.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.alice.it/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.alice.it/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.aol.co.uk/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.aol.com/M
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.aol.in/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.atlas.cz/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.auction.co.kr/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.auone.jp/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.auone.jp/2
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.books.com.tw/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.books.com.tw/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.centrum.cz/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.centrum.cz/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.chol.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.chol.com/favicon.ico
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.cn.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.cn.yahoo.com/t
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.daum.net/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.daum.net/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.daum.net/u
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.dreamwiz.com/v
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.co.uk/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/favicon.icoJ
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.com/favicon.icot
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.de/G
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.es/A
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.fr/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.in/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ebay.it/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.empas.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.empas.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.empas.com/favicon.icoL
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.espn.go.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gamer.com.tw/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gismeteo.ru/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.gismeteo.ru/g
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.goo.ne.jp/
Source: iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.goo.ne.jp/favicon.icou
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.hanafos.com/
Source: iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.hanafos.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.interpark.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.interpark.com/t
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ipop.co.kr/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ipop.co.kr/K
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3140000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&q=
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&q=
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&q=
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C1E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015574156.000001A0A3175000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3176000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3164000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS5eCX
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=IE7BOX&src=%7Breferrer:source?%7D
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&FORM=IE7RE&src=%7Breferrer:source?%7D
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&Form=IE8SRC&src=%7Breferrer:source%7D
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2BBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=%7Breferrer:source?%7D
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2BBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.live.com/results.aspx?q=%7BsearchTerms%7D&src=IE-SearchBox&Form=IE8SRC%
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.livedoor.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.livedoor.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.lycos.co.uk/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.lycos.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.lycos.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3516401707.000001A0A0472000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3164000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS5
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=CBPWd
Source: iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=%7BsearchTerms%7D&FORM=AS5
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.co.uk/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2BBC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3164000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS5
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=%7BsearchTerms%7D&FORM=AS6
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.msn.com/results.aspx?q=%7BsearchTerms%7D&FORM=CBPW
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.nate.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.naver.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.naver.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.nifty.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.orange.co.uk/V
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.rediff.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.rediff.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.seznam.cz/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.seznam.cz/favicon.ico
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.sify.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.sify.com/B
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.co.jp
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahoo.com/favicon.icot
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&p=
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search.yam.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search1.taobao.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://search2.estadao.com.br/l
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://searchresults.news.com.au/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://service2.bfast.com/P
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://so-net.search.goo.ne.jp/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.aol.de/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.freenet.de/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.freenet.de/favicon.icoC
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.lycos.de/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.t-online.de/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.web.de/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.web.de/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://suche.web.de/l
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tw.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://udn.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://udn.com/K
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://udn.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://udn.com/favicon.ico?
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://uk.ask.com/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://uk.ask.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://uk.search.yahoo.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vachercher.lycos.fr/(
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://video.globo.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://video.globo.com/favicon.icog
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.ask.com/
Source: iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/U
Source: iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.abril.com.br/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alarabiya.net/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alarabiya.net/a
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.co.jp/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.co.uk/i
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2BBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&tag=ie8search-20&index=blended&linkCode=qs&camp=1789&creativ
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.de/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aol.com/favicon.icoi
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.arrakis.com/favicon.icon
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.arrakis.com/q
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.asharqalawsat.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.asharqalawsat.com/G
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ask.com/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.auction.co.kr/auction.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.auction.co.kr/auction.ico?
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.baidu.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cdiscount.com/o
Source: iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/
Source: iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/favicon.icok
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ceneo.pl/s
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico##2
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cjmall.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cjmall.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.clarin.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cnet.co.uk/c
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cnet.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dailymail.co.uk/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dailymail.co.uk/favicon.ico_
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1735930762.0000000000882000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.000000000328B000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734132508.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740099786.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740355639.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739620214.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F35000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1739797957.0000000000FE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.etmall.com.tw/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.etmall.com.tw/favicon.icoY
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.excite.co.jp/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.expedia.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.expedia.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gmarket.co.kr/
Source: iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.co.in/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.co.jp/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.co.uk/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.br/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.sa/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com.tw/
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/favicon.ico~
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.cz/
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.de/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.es/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.fr/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.it/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.pl/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.ru/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.si/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iask.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iask.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kkbox.com.tw/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.linternaute.com/favicon.ico
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.live.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.maktoob.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolibre.com.mx/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolibre.com.mx/favicon.icoo
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mercadolivre.com.br/p
Source: iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.merlin.com.pl/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.merlin.com.pl/8
Source: iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mtv.com/favicon.ico/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mtv.com/j?L
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.myspace.com/favicon.ico&
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.najdi.si/favicon.ico3
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.najdi.si/x
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nate.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.neckermann.de/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.neckermann.de/j
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.news.com.au/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nifty.com/favicon.ico
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmp, msapplication.xml4.23.drString found in binary or memory: http://www.nytimes.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.orange.fr/r
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.otto.de/favicon.icop
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ozon.ru/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ozon.ru/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ozu.es/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.paginasamarillas.es/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.priceminister.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.priceminister.com/favicon.icow
Source: iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rambler.ru/m
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.recherche.aol.fr/
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.reddit.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rtl.de/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rtl.de/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rtl.de/favicon.icol
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.servicios.clarin.com/W
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.shopzilla.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sify.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sogou.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sogou.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sogou.com/favicon.icob
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.soso.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.soso.com/favicon.ico
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.t-online.de/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.t-online.de/favicon.icoU
Source: iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taobao.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taobao.com/_
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taobao.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.target.com/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.target.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.target.com/favicon.icoZ
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tchibo.de/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tchibo.de/.
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tchibo.de/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tchibo.de/favicon.icog
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tesco.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tesco.com/6
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tesco.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tesco.com/favicon.ico/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tiscali.it/favicon.ico
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.twitter.com/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.univision.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.univision.com/N
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.univision.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.univision.com/favicon.icoG
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.walmart.com/
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.walmart.com/favicon.ico
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmp, msapplication.xml7.23.drString found in binary or memory: http://www.wikipedia.com/
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ya.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ya.com/favicon.icoy
Source: SWUpdater.exe, 0000000E.00000003.2790429232.0000000004340000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2793395202.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798343506.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2795246763.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099575406.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099433056.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798541430.0000000001360000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798252352.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798459692.0000000001301000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099783546.0000000001363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yahoo.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yam.com/favicon.ico
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522431981.000001A0A6120000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522431981.000001A0A6129000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/
Source: iexplore.exe, 00000017.00000002.3522761477.000001A0A64C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/p
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www3.fnac.com/
Source: iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www3.fnac.com/favicon.ico
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015469461.000001A0A3156000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSea
Source: iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://z.about.com/m/a08.ico
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp3c
Source: iexplore.exe, 00000017.00000003.2014518017.000001A0A332C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3391000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3391000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSX
Source: SWUpdater.exe, 0000000E.00000003.2790429232.0000000004340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.co
Source: Wave Browser.exe, 00000000.00000003.3118311906.00000000005B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/
Source: Wave Browser.exe, 00000000.00000003.1675108308.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674919621.0000000000563000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675803860.0000000000563000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676677141.0000000000563000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674014008.0000000000563000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.000000000055F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/0
Source: Wave Browser.exe, 00000000.00000003.1967217955.00000000005B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/K
Source: Wave Browser.exe, 00000000.00000003.1663580891.0000000002755000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/
Source: Wave Browser.exe, 00000000.00000003.1674014008.0000000000593000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674014008.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.0000000000518000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675085711.0000000000594000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674919621.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675803860.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676677141.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675803860.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676677141.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.000000000059D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/0/status/chr_stub_started?id=&v=1.4.16.2
Source: Wave Browser.exe, 00000000.00000003.1724071507.0000000000600000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3118311906.0000000000601000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1967300453.0000000000600000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1967217955.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119600983.0000000000601000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_offer_accepted?id=&v=1.4.16.2&format=ini
Source: Wave Browser.exe, 00000000.00000002.3119234785.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.0000000000588000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_offer_accepted?id=&v=1.4.16.2&format=ini1
Source: Wave Browser.exe, 00000000.00000003.3118311906.0000000000601000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1967300453.0000000000600000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1967217955.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119600983.0000000000601000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_offer_accepted?id=&v=1.4.16.2&format=iniR
Source: Wave Browser.exe, 00000000.00000002.3119234785.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.0000000000588000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_offer_accepted?id=&v=1.4.16.2&format=inir
Source: Wave Browser.exe, 00000000.00000003.3117920074.00000000005AC000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3120881782.000000000470C000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119600983.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3118311906.00000000005B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=0
Source: Wave Browser.exe, 00000000.00000003.3117920074.00000000005AC000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119600983.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3118311906.00000000005B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=0.tmp
Source: Wave Browser.exe, 00000000.00000002.3120881782.000000000470C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=07/&
Source: Wave Browser.exe, 00000000.00000002.3119234785.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.000000000059D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=0C
Source: Wave Browser.exe, 00000000.00000003.3117920074.00000000005AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=0D
Source: Wave Browser.exe, 00000000.00000002.3119234785.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.0000000000588000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=0er
Source: Wave Browser.exe, 00000000.00000002.3119234785.0000000000588000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.0000000000588000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=0iH-
Source: Wave Browser.exe, 00000000.00000002.3119234785.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1967217955.00000000005B6000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3118311906.0000000000601000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1967300453.0000000000600000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1967217955.00000000005FC000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119600983.0000000000601000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_swupd_started?id=&v=1.4.16.2
Source: Wave Browser.exe, 00000000.00000002.3119234785.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3117920074.000000000055F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/inst/15/status/chr_swupd_started?id=&v=1.4.16.2E.tmp
Source: Wave Browser.exe, 00000000.00000003.1663580891.0000000002755000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/log/imp/e/chr_offer_accepted/d/
Source: Wave Browser.exe, 00000000.00000003.1663580891.0000000002755000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/log/imp/e/chr_offer_declined/d/
Source: Wave Browser.exe, 00000000.00000003.1663580891.0000000002755000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/log/imp/e/chr_stub_started/d/
Source: Wave Browser.exe, 00000000.00000003.1967217955.00000000005B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/pData
Source: SWUpdater.exe, 0000000E.00000003.2795658632.000000000135E000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2790429232.0000000004340000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2793395202.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798343506.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099575406.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798541430.0000000001360000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798252352.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099783546.0000000001363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.wavebrowserbase.com/search/yhs
Source: SWUpdater.exe, 0000000E.00000003.2795246763.00000000012E8000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798459692.0000000001301000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.swupdater.com/build/WaveBrowser/stable/win/1112397578245/64/WaveInstaller-v1.3.16.5.exe
Source: SWUpdater.exe, 0000000E.00000002.3101123818.0000000005F40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.swupdater.com/build/WaveBrowser/stable/win/1112397578245/64/WaveInstaller-v1.3.16.5.exe3
Source: SWUpdater.exe, 0000000E.00000003.2795658632.000000000135E000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2790429232.0000000004340000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2793395202.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2795658632.0000000001346000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798541430.0000000001360000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2788997737.0000000005A48000.00000004.00000800.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099783546.0000000001363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.swupdater.com:443/build/WaveBrowser/stable/win/1112397578245/64/
Source: SWUpdater.exe, 00000009.00000002.1805756226.0000000000833000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000009.00000002.1805756226.0000000000878000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.swupdater.com/
Source: SWUpdater.exe, 00000009.00000002.1805756226.0000000000854000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.swupdater.com/service/check2?Z
Source: SWUpdater.exe, 00000009.00000002.1805756226.0000000000878000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.swupdater.com/service/check2?crx3=true&appid=%7BF6F60ACE-71AD-4610-80D4-9253729FB4B
Source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737926668.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, swupdater.dll.2.drString found in binary or memory: https://clients2.swupdater.com/service/check2?crx3=trueCodeRedUrlRecovery&appid=%s&appversion=%s&app
Source: SWUpdater.exe, 00000009.00000002.1805756226.000000000086E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.swupdater.com/tN
Source: SWUpdater.exe, 00000009.00000002.1805756226.0000000000808000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.swupdater.com:443
Source: SWUpdater.exe, 00000009.00000002.1805756226.0000000000808000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.swupdater.com:443=
Source: SWUpdater.exe, 0000000E.00000003.2790429232.0000000004340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ff.search.yahoo.com/gossip?output=fxjson&
Source: SWUpdater.exe, 0000000E.00000003.2795658632.000000000135E000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2793395202.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798343506.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099575406.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798541430.0000000001360000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798252352.0000000001339000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099783546.0000000001363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ff.search.yahoo.com/gossip?output=fxjson&amp;command=
Source: SWUpdater.exe, 0000000E.00000003.2790429232.0000000004340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ff.search.yahoo.com/gossip?output=fxjson&command=
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.1949649966.000001A0A04E2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2014518017.000001A0A32B0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676787979.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675148752.0000000002755000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
Source: SWUpdater.exe, 00000008.00000002.1780415358.0000000001396000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000D.00000002.2086509736.0000000000B67000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000D.00000003.1785870253.0000000000B66000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2793395202.00000000013A2000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099845355.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000010.00000003.1855365325.0000000000867000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000010.00000003.1855023922.0000000000867000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000010.00000002.2156455802.0000000000867000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000027.00000003.2180999883.0000000001389000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000027.00000002.2483840326.0000000001389000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com/
Source: SWUpdater.exe, 0000000E.00000002.3099647848.0000000001350000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2795658632.0000000001350000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com/.
Source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737926668.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, swupdater.dll.2.drString found in binary or memory: https://swupdater.com/cr/reportWavesor
Source: SWUpdater.exe, 00000010.00000003.1855365325.0000000000887000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000010.00000002.2156036458.0000000000829000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000027.00000002.2484009312.00000000013AB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000027.00000002.2483612485.0000000001349000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000027.00000003.2180999883.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000027.00000003.2181492818.00000000013A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com/service/update2
Source: SWUpdater.exe, 00000008.00000002.1780415358.000000000134E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com/service/update24N
Source: SWUpdater.exe, 0000000E.00000003.2798459692.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099433056.00000000012EB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2795246763.00000000012E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com/service/update26
Source: SWUpdater.exe, 0000000E.00000003.2795658632.000000000135E000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000003.2798541430.0000000001360000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099166175.00000000012B8000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000E.00000002.3099783546.0000000001363000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com/service/update2?cup2key=1:3380864876&cup2hreq=a93ee16ccc7d14a5611ee654664949ea
Source: SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739466166.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737926668.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738588150.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738388621.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738545852.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000000.1741960503.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000000.1742955987.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000002.1743564119.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000000.1743802096.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000002.1744612123.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterCore.exe, 00000012.00000000.1865393070.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000000.1946044712.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000002.1946622318.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000002.2489252047.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000000.2487737954.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000000.2489781316.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000002.2494623269.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://swupdater.com/service/update2Global
Source: SWUpdater.exe, 00000008.00000002.1780415358.000000000134E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com/service/update2IO)
Source: SWUpdater.exe, 0000000D.00000002.2086509736.0000000000B20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com/service/update2Ii
Source: SWUpdater.exe, 0000000E.00000002.3099166175.00000000012B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com:443
Source: SWUpdater.exe, 00000008.00000002.1780415358.0000000001323000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 0000000D.00000002.2086509736.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000010.00000002.2156036458.0000000000843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com:443/service/update2
Source: SWUpdater.exe, 0000000E.00000002.3099166175.00000000012B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swupdater.com:443/service/update2Z
Source: Wave Browser.exe, 00000000.00000003.3117920074.00000000005AC000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.00000000005AC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/ab
Source: Wave Browser.exe, 00000000.00000003.1714139207.0000000002750000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/about/
Source: Wave Browser.exe, 00000000.00000003.1677542513.0000000000605000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/about/.
Source: Wave Browser.exe, 00000000.00000002.3119234785.0000000000518000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1663580891.0000000002755000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/changelog
Source: Wave Browser.exe, 00000000.00000002.3119234785.0000000000518000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1663580891.0000000002755000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/privacy
Source: Wave Browser.exe, 00000000.00000002.3119234785.0000000000518000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1663580891.0000000002755000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/terms
Source: Wave Browser.exe, 00000000.00000002.3119234785.0000000000518000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1663580891.0000000002755000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/termshttps://wavebrowser.co/privacyhttps://wavebrowser.co/changelog
Source: Wave Browser.exe, 00000000.00000003.1714139207.0000000002750000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/uninstall/
Source: Wave Browser.exe, 00000000.00000003.1713903897.0000000000606000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1677542513.0000000000605000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowser.co/uninstall/.
Source: Wave Browser.exe, 00000000.00000003.1714139207.0000000002750000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1677542513.0000000000605000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowserpro.com/pro_privacy.
Source: Wave Browser.exe, 00000000.00000003.1714139207.0000000002750000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1677542513.0000000000605000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wavebrowserpro.com/pro_terms
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A33DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6CA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.co
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A3391000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3527204355.000001A0A94A2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A33DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/
Source: iexplore.exe, 00000017.00000002.3527204355.000001A0A94A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=8bJ
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A33DB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A68F2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3514919841.0000000B981F0000.00000004.00000010.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517342084.000001A0A2220000.00000004.08000000.00040000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A332C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3518204730.000001A0A2E08000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3518204730.000001A0A2E13000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A344E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6B77000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6B89000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6A69000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6AD6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3516153306.0000000B99AF1000.00000004.00000010.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3527204355.000001A0A94BE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C94000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3518204730.000001A0A2DC4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3518204730.000001A0A2DB0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A68D0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A33FD000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3521834668.000001A0A5640000.00000004.08000000.00040000.00000000.sdmp, iexplore.exe, 00000017.00000002.3515818948.0000000B993F1000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A32F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/?LinkID=403856&language=
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A0472000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/fwlink/p/?LinkId=255141m/fwlink/p/?LinkId=255141p
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A32AF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3516401707.000001A0A0472000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6B99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/p/?LinkId=255141
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A0472000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/p/?LinkId=255141H
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A0472000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp/p/?LinkId=255141X
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6CA4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp1
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp72M
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp8B2E3A
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp;3Q
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A335B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehp=
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpB2E3A
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6911000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpM=
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpMicrosoft
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A33DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpT
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6C47000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A3384000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A69D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpTerms
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6911000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A69A7000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6BAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpX
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehparchTerms
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A335B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpd%h
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6911000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpico
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6911000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpico2
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpiehpTerms
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A33DB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A68D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpj
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6911000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehplJ
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A33DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpm
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C67000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A332C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A69D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehposoft
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6AF4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6911000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3527204355.000001A0A94BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6AF4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141ist
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6C47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141q
Source: iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpp/?LinkId=255141se
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A33DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpw.msn.com/?ocid=iehp
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6B87000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3527204355.000001A0A94BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpx
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6CA4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C94000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/?ocid=iehpy
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A33DB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6B99000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A332C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3518204730.000001A0A2E08000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A344E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6C25000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6A69000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6AD6000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3527204355.000001A0A94BE000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C94000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3518204730.000001A0A2DC4000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6BAB000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A68D0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A33FD000.00000004.00000020.00020000.00000000.sdmp, imagestore.dat.33.drString found in binary or memory: https://www.msn.com/favicon.ico
Source: iexplore.exe, 00000017.00000002.3522815682.000001A0A6911000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6A69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/favicon.ico:Sat:Saturday
Source: iexplore.exe, 00000017.00000002.3520085326.000001A0A32F3000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6CA0000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6AD2000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6B74000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6C21000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6A1E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C36000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3520085326.000001A0A32EF000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/spartan/ientp?locale=en-CH&market=CH&enableregulatorypsm=0&enablecpsm=0&NTLogo=0
Source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737926668.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, swupdater.dll.2.drString found in binary or memory: https://www.swupdater.com/support/installer/?Device
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_004051CF GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_004051CF
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B3534968 lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,4_2_00007FF6B3534968
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0088770F lstrlenW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,18_2_0088770F
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031D6
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_00404A0E0_2_00404A0E
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_004065F60_2_004065F6
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D82C881_2_00D82C88
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D7413B1_2_00D7413B
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D78D391_2_00D78D39
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D83EDD1_2_00D83EDD
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D806701_2_00D80670
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D82B681_2_00D82B68
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D80B081_2_00D80B08
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCode function: 2_2_006525BD2_2_006525BD
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C425BD3_2_00C425BD
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B353B9304_2_00007FF6B353B930
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B3543D144_2_00007FF6B3543D14
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B353FCE44_2_00007FF6B353FCE4
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B35404CC4_2_00007FF6B35404CC
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B353BFEC4_2_00007FF6B353BFEC
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B35402C04_2_00007FF6B35402C0
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0089C0D918_2_0089C0D9
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0089628818_2_00896288
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_008983C618_2_008983C6
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0089BB6018_2_0089BB60
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_008984E618_2_008984E6
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0088ED9018_2_0088ED90
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_00895DF018_2_00895DF0
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0089973D18_2_0089973D
Source: Joe Sandbox ViewDropped File: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe EE87747102EBA8844939352740D0BB6C4A67F10C2656961CB2722CD42BA99F40
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: String function: 00889E80 appears 40 times
Source: Wave Browser.exe, 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameWave Browser8 vs Wave Browser.exe
Source: Wave Browser.exe, 00000000.00000003.1724192151.0000000002753000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamensArray.dllJ vs Wave Browser.exe
Source: Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameSWUpdaterSetup.exeD vs Wave Browser.exe
Source: Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameinetc.dllF vs Wave Browser.exe
Source: Wave Browser.exe, 00000000.00000003.1675908086.0000000002754000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamensResize.dllL vs Wave Browser.exe
Source: Wave Browser.exeBinary or memory string: OriginalFilenameWave Browser8 vs Wave Browser.exe
Source: Wave Browser.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: WaveInstaller-v1.3.16.5.exe0.14.drBinary or memory string: g.sln;V
Source: classification engineClassification label: mal45.evad.winEXE@121/503@0/35
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D72D52 GetLastError,GetLastError,SetLastError,SetLastError,FormatMessageW,GetLastError,SetLastError,LocalFree,1_2_00D72D52
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031D6
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_0040449B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,0_2_0040449B
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_004020D1 CoCreateInstance,MultiByteToWideChar,0_2_004020D1
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D71E65 GetTempFileNameW,FindResourceW,LoadResource,LockResource,CreateFileW,SizeofResource,SetFilePointerEx,CloseHandle,1_2_00D71E65
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\WavesorJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeFile created: C:\Users\user\Wavesor SoftwareJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeMutant created: \Sessions\1\BaseNamedObjects\Global\SWUpdaterS-1-5-21-2246122658-3693405117-2476756634-1002{0FD58F4B-4CDF-4F83-924A-ADD9B61507E8}
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeMutant created: \Sessions\1\BaseNamedObjects\Global\SWUpdaterS-1-5-21-2246122658-3693405117-2476756634-1002{2B637868-842E-4542-88EE-18FD04ACE853}
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeMutant created: \Sessions\1\BaseNamedObjects\Global\SWUpdaterS-1-5-21-2246122658-3693405117-2476756634-1002{606BC4F3-1FF7-40D4-A06E-931682CA20C0}
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeMutant created: \Sessions\1\BaseNamedObjects\Global\SWUpdaterS-1-5-21-2246122658-3693405117-2476756634-1002{F1AF7D1D-31D2-42E8-91B9-63C20107AFBB}
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeMutant created: \Sessions\1\BaseNamedObjects\Global\SWUpdaterS-1-5-21-2246122658-3693405117-2476756634-1002{C226E7AE-5ADE-4596-BD39-56D84ED23288}
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeMutant created: \Sessions\1\BaseNamedObjects\Global\SWUpdaterS-1-5-21-2246122658-3693405117-2476756634-1002{C7AE82B6-C983-4F6C-A60D-762D8C9FABF0}
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeMutant created: \Sessions\1\BaseNamedObjects\Global\SWUpdaterS-1-5-21-2246122658-3693405117-2476756634-1002{3BDDC0BC-A609-4E60-9E9A-35BC0CD05029}
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeMutant created: \Sessions\1\BaseNamedObjects\Global\SWUpdater{0FD58F4B-4CDF-4F83-924A-ADD9B61507E8}
Source: C:\Users\user\Desktop\Wave Browser.exeFile created: C:\Users\user\AppData\Local\Temp\nsdDC8D.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCommand line argument: kernel32.dll1_2_00D72445
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCommand line argument: kernel32.dll2_2_006469C8
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCommand line argument: DllEntry2_2_006469C8
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCommand line argument: >,e2_2_00652B90
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCommand line argument: kernel32.dll3_2_00C369C8
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCommand line argument: DllEntry3_2_00C369C8
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCommand line argument: kernel32.dll18_2_00881586
Source: Wave Browser.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Wave Browser.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Wave Browser.exeVirustotal: Detection: 10%
Source: C:\Users\user\Desktop\Wave Browser.exeFile read: C:\Users\user\Desktop\Wave Browser.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Wave Browser.exe "C:\Users\user\Desktop\Wave Browser.exe"
Source: C:\Users\user\Desktop\Wave Browser.exeProcess created: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe "C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeProcess created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe "C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /regserver
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user
Source: unknownProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /c
Source: unknownProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource scheduler
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /cr
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource core
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /registermsihelper
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9Ins1RjRENDdGRS1CNDQ4LTQzNDAtQjY1Qi03QUYyNDVFRTc5MEN9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezVEOUEyNUNELTJDQkQtNDIxMS1CM0MzLTIxMEREQzcxNjk4MH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjEzMy4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTAxNiIvPjwvYXBwPjwvcmVxdWVzdD4
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /handoff "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{5F4D47FE-B448-4340-B65B-7AF245EE790C}"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /uninstall
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0ie0IwNEYxMzYzLTQxQTgtNDg2RS1BOTU4LTEzMUZDNTcwRTEwOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RUIxNDlBRDItQ0U0RS00RjUxLUI3RkMtQTE0OUZBQTRDQ0FGfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
Source: unknownProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe"
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /c
Source: unknownProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=2004,i,3718953657744578865,13232452162775934316,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:3
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17414 /prefetch:2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5880 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2040,i,9846940053479223879,3976424785995044148,262144 /prefetch:3
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0iezMyNzQ0Q0IzLUQ3M0EtNEQ5NC1BMkIyLUM1ODIwNUE0NDJBQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iMS4zLjEzMy4wIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2004,i,761526046158747839,15104522579484344094,262144 /prefetch:3
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:82952 /prefetch:2
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17420 /prefetch:2
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:82962 /prefetch:2
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /unregserver
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user /unregister
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user /unregister
Source: C:\Users\user\Desktop\Wave Browser.exeProcess created: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe "C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeProcess created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe "C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /regserverJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9Ins1RjRENDdGRS1CNDQ4LTQzNDAtQjY1Qi03QUYyNDVFRTc5MEN9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezVEOUEyNUNELTJDQkQtNDIxMS1CM0MzLTIxMEREQzcxNjk4MH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjEzMy4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTAxNiIvPjwvYXBwPjwvcmVxdWVzdD4Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /handoff "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{5F4D47FE-B448-4340-B65B-7AF245EE790C}"Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /crJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource coreJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /registermsihelperJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /uninstallJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: unknown unknown
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: unknown unknown
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: unknown unknown
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0ie0IwNEYxMzYzLTQxQTgtNDg2RS1BOTU4LTEzMUZDNTcwRTEwOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RUIxNDlBRDItQ0U0RS00RjUxLUI3RkMtQTE0OUZBQTRDQ0FGfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0iezMyNzQ0Q0IzLUQ3M0EtNEQ5NC1BMkIyLUM1ODIwNUE0NDJBQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iMS4zLjEzMy4wIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /unregserver
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: unknown unknown
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /c
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17410 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17414 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:82952 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17420 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:82962 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeProcess created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=2004,i,3718953657744578865,13232452162775934316,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5880 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2040,i,9846940053479223879,3976424785995044148,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2004,i,761526046158747839,15104522579484344094,262144 /prefetch:3
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user /unregister
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user /unregister
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: msi.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: iri.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: propsys.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: edputil.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: slc.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: sppc.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wldp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: version.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: userenv.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msimg32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wininet.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wkscli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netutils.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptbase.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msasn1.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: profapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cscapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winhttp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winsta.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: bitsproxy.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: webio.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: mswsock.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winnsi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: sspicli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dnsapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iertutil.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wldp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: version.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: userenv.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msimg32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wininet.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wkscli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netutils.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptbase.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msasn1.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: profapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cscapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iertutil.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wldp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: version.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: userenv.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msimg32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wininet.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wkscli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netutils.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptbase.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msasn1.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: profapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cscapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iertutil.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wldp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: version.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: userenv.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msimg32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wininet.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wkscli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netutils.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptbase.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msasn1.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: profapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cscapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winhttp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: webio.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: mswsock.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winnsi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: sspicli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dnsapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: schannel.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ntasn1.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ncrypt.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptsp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: rsaenh.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: gpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msxml3.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iertutil.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wldp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: version.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: userenv.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msimg32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wininet.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wkscli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netutils.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptbase.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msasn1.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: profapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cscapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: atlthunk.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: textinputframework.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: coremessaging.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ntmarta.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wintypes.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wintypes.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wintypes.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: textshaping.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: mdmregistration.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: omadmapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: powrprof.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptsp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dmcmnutils.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iri.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: umpdc.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dsreg.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptsp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msxml3.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winhttp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: webio.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: mswsock.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winnsi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: sspicli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dnsapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: schannel.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ntasn1.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ncrypt.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: rsaenh.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: gpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: winsta.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: bitsproxy.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: apphelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iertutil.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wldp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: version.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: userenv.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msimg32.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: uxtheme.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wininet.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wkscli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: netutils.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptbase.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msasn1.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: profapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cscapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbghelp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dbgcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: mdmregistration.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: omadmapi.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: powrprof.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptsp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dmcmnutils.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iri.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: umpdc.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: dsreg.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: cryptsp.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: msxml3.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: textinputframework.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: coremessaging.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: ntmarta.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: coremessaging.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wintypes.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wintypes.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: wintypes.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: propsys.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: edputil.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: urlmon.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: iertutil.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: srvcli.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: appresolver.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: slc.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: sppc.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\Wave Browser.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Wave Browser.exeWindow detected: Number of UI elements: 12
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Lync
Source: Wave Browser.exeStatic PE information: certificate valid
Source: Wave Browser.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: SWUpdaterComRegisterShell64_unsigned.pdbP source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738588150.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000000.1741960503.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000000.1742955987.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000002.1743564119.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000000.1743802096.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000002.1744612123.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000002.2489252047.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000000.2487737954.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000000.2489781316.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000002.2494623269.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: psmachine_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: SWUpdaterCore_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738388621.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738545852.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterCore.exe, 00000012.00000000.1865393070.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000000.1946044712.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000002.1946622318.000000000089D000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: SWUpdaterComRegisterShell64_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738746082.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738588150.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000000.1741960503.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000000.1742955987.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000005.00000002.1743564119.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000000.1743802096.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000006.00000002.1744612123.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000002.2489252047.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000032.00000000.2487737954.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000000.2489781316.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp, SWUpdaterComRegisterShell64.exe, 00000033.00000002.2494623269.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: D:\code\test\Plugins\inetc.pdb source: Wave Browser.exe, 00000000.00000003.1674117356.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739055852.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, psuser.dll.2.dr
Source: Binary string: SWUpdater_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000000.1736030007.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, SWUpdater.exe, 00000002.00000003.1737496383.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739671737.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000007.00000000.1745569954.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000008.00000002.1779830130.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000009.00000002.1806143853.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 0000000A.00000002.1755368191.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 0000000C.00000002.1759430979.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 0000000D.00000002.2087500459.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 0000000E.00000002.3098537873.0000000000C31000.00000020.00000001.01000000.00000022.sdmp, SWUpdater.exe, 0000000F.00000000.1778826031.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000010.00000002.2157396726.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000013.00000002.1872396760.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000027.00000002.2482941996.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, SWUpdater.exe, 00000031.00000000.2486646354.0000000000C31000.00000020.00000001.01000000.00000012.sdmp
Source: Binary string: goopdate_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737926668.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, swupdater.dll.2.dr
Source: Binary string: goopdate_unsigned.pdbq source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737926668.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, swupdater.dll.2.dr
Source: Binary string: SWUpdaterBroker_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740392071.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: SWUpdaterCore_unsigned.pdbT source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004C5000.00000004.00000010.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738388621.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1738545852.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterCore.exe, 00000012.00000000.1865393070.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000000.1946044712.000000000089D000.00000002.00000001.01000000.0000001A.sdmp, SWUpdaterCore.exe, 00000016.00000002.1946622318.000000000089D000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: psmachine_unsigned.pdbI source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739399445.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739428499.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_64.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739466166.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned.pdbI source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739055852.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, psuser.dll.2.dr
Source: Binary string: mi_exe_stub.pdb source: SWUpdaterSetup.exe, 00000001.00000000.1732568290.0000000000D87000.00000002.00000001.01000000.0000000E.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: SWUpdaterOnDemand_unsigned.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1740605908.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psuser_unsigned_64.pdbE source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: psmachine_unsigned_64.pdbE source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1739466166.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: swupdaterres_unsigned_en.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000002.3110112651.00000000004BF000.00000004.00000010.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000002.3107996370.0000000000F30000.00000002.00000001.00040000.00000024.sdmp, SWUpdater.exe, 00000002.00000003.1738879717.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000008.00000002.1780255860.0000000001250000.00000002.00000001.00040000.00000019.sdmp, SWUpdater.exe, 0000000A.00000002.1755764745.0000000000C80000.00000002.00000001.00040000.00000019.sdmp, SWUpdater.exe, 0000000E.00000002.3098905569.00000000011F0000.00000002.00000001.00040000.00000023.sdmp, swupdaterres_en.dll.2.dr
Source: Binary string: psuser_unsigned_64.pdb source: SWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B353397C LoadLibraryW,GetProcAddress,FreeLibrary,4_2_00007FF6B353397C
Source: SWUpdaterSetup.exe.1.drStatic PE information: real checksum: 0xc58bd should be: 0xd217b
Source: SWUpdaterSetup.exe.2.drStatic PE information: real checksum: 0xc58bd should be: 0xd217b
Source: SWUpdaterSetup.exe.0.drStatic PE information: real checksum: 0xc58bd should be: 0xd217b
Source: SWUpdaterComRegisterShell64.exe.1.drStatic PE information: section name: _RDATA
Source: psmachine.dll.1.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.1.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.1.drStatic PE information: section name: _RDATA
Source: psuser.dll.1.drStatic PE information: section name: .orpc
Source: psuser_64.dll.1.drStatic PE information: section name: .orpc
Source: psuser_64.dll.1.drStatic PE information: section name: _RDATA
Source: SWUpdaterComRegisterShell64.exe.2.drStatic PE information: section name: _RDATA
Source: psuser.dll.2.drStatic PE information: section name: .orpc
Source: psuser_64.dll.2.drStatic PE information: section name: .orpc
Source: psuser_64.dll.2.drStatic PE information: section name: _RDATA
Source: psmachine.dll.2.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.2.drStatic PE information: section name: .orpc
Source: psmachine_64.dll.2.drStatic PE information: section name: _RDATA
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D75624 push ecx; ret 1_2_00D75636
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCode function: 2_2_00647D84 push ecx; ret 2_2_00647D96
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C338C3 push edi; ret 3_2_00C338CA
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C338CC push edi; ret 3_2_00C3392A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C338E1 push edi; ret 3_2_00C338E2
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C338FC push edi; ret 3_2_00C33902
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33899 push edi; ret 3_2_00C3389A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C338B3 push edi; ret 3_2_00C338BA
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33843 push esi; ret 3_2_00C3384A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33879 push edi; ret 3_2_00C3387A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33803 push esi; ret 3_2_00C3382A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C3382B push esi; ret 3_2_00C33832
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33833 push esi; ret 3_2_00C3383A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C3383B push esi; ret 3_2_00C33842
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33947 push edi; ret 3_2_00C3394A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33954 push edi; ret 3_2_00C3395A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33964 push edi; ret 3_2_00C3396A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33977 push edi; ret 3_2_00C3397A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33934 push edi; ret 3_2_00C3393A
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C333D0 push eax; ret 3_2_00C333EE
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C333FB push eax; ret 3_2_00C333FE
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C3339D push eax; ret 3_2_00C3339E
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C333B1 push eax; ret 3_2_00C333BE
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C334C0 push edx; ret 3_2_00C334C6
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C334C8 push edx; ret 3_2_00C334CE
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C334D5 push edx; ret 3_2_00C334D6
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C334DC push edx; ret 3_2_00C334DE
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C334E0 push edx; ret 3_2_00C334E6
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C334E8 push edx; ret 3_2_00C334EE
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C33484 push ecx; ret 3_2_00C3349E
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C334A0 push ecx; ret 3_2_00C334AE
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psmachine.dllJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeFile created: C:\Users\user\AppData\Local\Temp\SWUpdater.exe59227b (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psuser_64.dllJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterSetup.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterSetup.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\swupdater.dllJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\Download\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}\1.3.16.5\WaveInstaller-v1.3.16.5.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterBroker.exeJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeFile created: C:\Users\user\AppData\Local\Temp\swupdater.dll59227b (copy)Jump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeFile created: C:\Users\user\AppData\Local\Temp\swupdaterres_en.dll59227b (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterBroker.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\swupdaterres_en.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\swupdater.dllJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeFile created: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsArray.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\swupdaterres_en.dllJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psuser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterCore.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeFile created: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeFile created: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsDialogs.dllJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psmachine.dllJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeFile created: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\Install\{DF7E1C1A-4867-4899-A0E8-C8CB671FD3D1}\WaveInstaller-v1.3.16.5.exeJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeFile created: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsResize.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterComRegisterShell64.exeJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeFile created: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterOnDemand.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterOnDemand.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeFile created: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psuser.dllJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeFile created: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psuser_64.dllJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B3534434 GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,4_2_00007FF6B3534434
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0088548F GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,18_2_0088548F

Boot Survival

barindex
Creates multiple autostart registry keys
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Wavesor SWUpdaterJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Wavesor SWUpdaterJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Wavesor SWUpdaterJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B3536138 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,4_2_00007FF6B3536138
Source: C:\Users\user\Desktop\Wave Browser.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\Wave Browser.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Wave Browser.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Found evasive API chain checking for user administrative privileges
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCheck user administrative privileges: IsUserAndAdmin, DecisionNodegraph_1-10941
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psmachine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psuser_64.dllJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\swupdater.dllJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\Download\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}\1.3.16.5\WaveInstaller-v1.3.16.5.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterBroker.exeJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\swupdater.dll59227b (copy)Jump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\swupdaterres_en.dll59227b (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterBroker.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\swupdaterres_en.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\swupdater.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\swupdaterres_en.dllJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsArray.dllJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psuser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psmachine_64.dllJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsDialogs.dllJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psmachine.dllJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\Install\{DF7E1C1A-4867-4899-A0E8-C8CB671FD3D1}\WaveInstaller-v1.3.16.5.exeJump to dropped file
Source: C:\Users\user\Desktop\Wave Browser.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsResize.dllJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterOnDemand.exeJump to dropped file
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeDropped PE file which has not been started: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psuser_64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psuser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterOnDemand.exeJump to dropped file
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe TID: 7512Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe TID: 7360Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe TID: 7408Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe TID: 7620Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe TID: 4460Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_0040626D FindFirstFileA,FindClose,0_2_0040626D
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_00405732 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,0_2_00405732
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_004026FE FindFirstFileA,0_2_004026FE
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B35404CC FindFirstFileExW,4_2_00007FF6B35404CC
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0089BC91 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,18_2_0089BC91
Source: SWUpdaterCore.exe, 00000012.00000002.1873017722.0000000000EFD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yS
Source: SWUpdater.exe, 0000000F.00000003.2499522880.0000000000815000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y4
Source: SWUpdaterCore.exe, 00000012.00000002.1873017722.0000000000EFD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yq
Source: ie_to_edge_stub.exe, 00000019.00000002.1970342434.0000022F3BC45000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000
Source: SWUpdater.exe, 0000000F.00000003.2501017317.000000000082D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\<P
Source: SWUpdater.exe, 00000010.00000003.1855178131.0000000000887000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000010.00000003.1855491947.0000000000888000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000010.00000002.2156900603.000000000088A000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000010.00000003.1855365325.0000000000887000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWN
Source: WaveInstaller-v1.3.16.5.exe0.14.drBinary or memory string: 4tHGfs
Source: Wave Browser.exe, 00000000.00000003.1675108308.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674014008.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.000000000055F000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674919621.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1674919621.0000000000563000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675803860.0000000000563000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1675803860.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676677141.000000000059D000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1676677141.0000000000563000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119234785.000000000059D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: SWUpdater.exe, 00000008.00000002.1780415358.00000000013A6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWH
Source: iexplore.exe, 00000017.00000002.3516401707.000001A0A0472000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW=
Source: SWUpdater.exe, 00000009.00000002.1805756226.0000000000833000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
Source: SWUpdater.exe, 00000027.00000002.2484009312.00000000013AB000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000027.00000003.2180999883.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000027.00000003.2181492818.00000000013A8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW_d
Source: SWUpdater.exe, 00000002.00000003.3104979844.0000000000FF6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\z
Source: C:\Users\user\Desktop\Wave Browser.exeAPI call chain: ExitProcess graph end nodegraph_0-3672
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeAPI call chain: ExitProcess graph end node
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D844A9 IsDebuggerPresent,OutputDebugStringW,1_2_00D844A9
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B3534CC4 InitializeCriticalSectionAndSpinCount,GetLastError,IsDebuggerPresent,OutputDebugStringW,4_2_00007FF6B3534CC4
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0089BC91 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C18_2_0089BC91
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B353397C LoadLibraryW,GetProcAddress,FreeLibrary,4_2_00007FF6B353397C
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D7BDE3 mov eax, dword ptr fs:[00000030h]1_2_00D7BDE3
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D77A26 mov eax, dword ptr fs:[00000030h]1_2_00D77A26
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCode function: 2_2_0064C528 mov eax, dword ptr fs:[00000030h]2_2_0064C528
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCode function: 2_2_0064AE31 mov eax, dword ptr fs:[00000030h]2_2_0064AE31
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C3C528 mov eax, dword ptr fs:[00000030h]3_2_00C3C528
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C3AE31 mov eax, dword ptr fs:[00000030h]3_2_00C3AE31
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0088D038 mov eax, dword ptr fs:[00000030h]18_2_0088D038
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_00890578 mov eax, dword ptr fs:[00000030h]18_2_00890578
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D711D5 GetProcessHeap,__Init_thread_footer,__Init_thread_footer,1_2_00D711D5
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess token adjusted: DebugJump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D75825 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00D75825
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D7551E SetUnhandledExceptionFilter,1_2_00D7551E
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D7A602 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00D7A602
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D7538B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00D7538B
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCode function: 2_2_0064783B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_0064783B
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCode function: 2_2_0064A818 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0064A818
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCode function: 2_2_0064795C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0064795C
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeCode function: 2_2_00647AF2 SetUnhandledExceptionFilter,2_2_00647AF2
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C3A818 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00C3A818
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C3783B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00C3783B
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C3795C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00C3795C
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeCode function: 3_2_00C37AF2 SetUnhandledExceptionFilter,3_2_00C37AF2
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B3535B5C SetUnhandledExceptionFilter,4_2_00007FF6B3535B5C
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B3539E38 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF6B3539E38
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B3535978 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_00007FF6B3535978
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exeCode function: 4_2_00007FF6B35355C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_00007FF6B35355C0
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0088997E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,18_2_0088997E
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_00889A9F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_00889A9F
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_0088CA1D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_0088CA1D
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_00889C35 SetUnhandledExceptionFilter,18_2_00889C35

HIPS / PFW / Operating System Protection Evasion

barindex
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeSection loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_00883EDB SetForegroundWindow,ShellExecuteExW,AllowSetForegroundWindow,GetLastError,GetLastError,DestroyWindow,SetLastError,18_2_00883EDB
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9Ins1RjRENDdGRS1CNDQ4LTQzNDAtQjY1Qi03QUYyNDVFRTc5MEN9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezVEOUEyNUNELTJDQkQtNDIxMS1CM0MzLTIxMEREQzcxNjk4MH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjEzMy4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTAxNiIvPjwvYXBwPjwvcmVxdWVzdD4Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /handoff "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{5F4D47FE-B448-4340-B65B-7AF245EE790C}"Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /registermsihelperJump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0ie0IwNEYxMzYzLTQxQTgtNDg2RS1BOTU4LTEzMUZDNTcwRTEwOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RUIxNDlBRDItQ0U0RS00RjUxLUI3RkMtQTE0OUZBQTRDQ0FGfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0iezMyNzQ0Q0IzLUQ3M0EtNEQ5NC1BMkIyLUM1ODIwNUE0NDJBQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iMS4zLjEzMy4wIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: unknown unknown
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /c
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "c:\users\user\wavesor software\swupdater\swupdater.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjtv1vwzgf0zxiiihvwzgf0zxj2zxjzaw9upsixljmumtmzljaiihnozwxsx3zlcnnpb249ijeumy4xmzmumcigaxntywnoaw5lpsiwiibzzxnzaw9uawq9ins1rjrenddgrs1cndq4ltqzndatqjy1qi03quyyndvfrtc5men9iib1c2vyawq9intjmwu4mgi5os1hn2m1ltqwy2ytytg4mi0yyzawyjy4ogzkytz9iibpbnn0ywxsc291cmnlpsjvdghlcmluc3rhbgxjbwqiihjlcxvlc3rpzd0iezveoueynuneltjdqkqtndixms1cm0mzltixmereqzcxnjk4mh0iigrlzhvwpsjjciigzg9tywluam9pbmvkpsiwij48ahcgcgh5c21lbw9yet0iocigc3nlpsixiibzc2uypsixiibzc2uzpsixiibzc3nlmz0imsigc3nlnde9ijeiihnzztqypsixiibhdng9ijeilz48b3mgcgxhdgzvcm09indpbiigdmvyc2lvbj0imtaumc4xota0ns4ymda2iibzcd0iiibhcmnopsj4njqilz48yxbwigfwcglkpsj7rjzgnjbbq0utnzfbrc00njewltgwrdqtoti1mzcyouzcnei3fsigdmvyc2lvbj0iiibuzxh0dmvyc2lvbj0ims4zljezmy4wiibsyw5npsjlbiigynjhbmq9iiigy2xpzw50psiipjxldmvudcbldmvudhr5cgu9ijiiigv2zw50cmvzdwx0psixiiblcnjvcmnvzgu9ijaiigv4dhjhy29kzte9ijaiigluc3rhbgxfdgltzv9tcz0imtaxniivpjwvyxbwpjwvcmvxdwvzdd4
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "c:\users\user\wavesor software\swupdater\swupdater.exe" /handoff "bundlename=wavebrowser&appguid={eb149ad2-ce4e-4f51-b7fc-a149faa4ccaf}&appname=wavebrowser&needsadmin=false&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{5f4d47fe-b448-4340-b65b-7af245ee790c}"
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "c:\users\user\wavesor software\swupdater\swupdater.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjtv1vwzgf0zxiiihvwzgf0zxj2zxjzaw9upsixljmumtmzljaiihnozwxsx3zlcnnpb249ijeumy4xmzmumcigaxntywnoaw5lpsiwiibzzxnzaw9uawq9inswrju4qtawrc00mtc1ltreodctquiwmi1frtlcmtq0otcznjf9iib1c2vyawq9intjmwu4mgi5os1hn2m1ltqwy2ytytg4mi0yyzawyjy4ogzkytz9iibpbnn0ywxsc291cmnlpsj1bmluc3rhbgwiihjlcxvlc3rpzd0ie0iwneyxmzyzltqxqtgtndg2rs1botu4ltezmuzdntcwrtewoh0iigrlzhvwpsjjciigzg9tywluam9pbmvkpsiwij48ahcgcgh5c21lbw9yet0iocigc3nlpsixiibzc2uypsixiibzc2uzpsixiibzc3nlmz0imsigc3nlnde9ijeiihnzztqypsixiibhdng9ijeilz48b3mgcgxhdgzvcm09indpbiigdmvyc2lvbj0imtaumc4xota0ns4ymda2iibzcd0iiibhcmnopsj4njqilz48yxbwigfwcglkpsj7ruixndlbrditq0u0rs00rjuxlui3rkmtqte0ouzbqtrdq0fgfsigdmvyc2lvbj0iiibuzxh0dmvyc2lvbj0iiibsyw5npsiiigjyyw5kpsiiignsawvudd0iij48zxzlbnqgzxzlbnr0exblpsi0iibldmvudhjlc3vsdd0imsigzxjyb3jjb2rlpsiwiiblehryywnvzguxpsiwii8-pc9hcha-pc9yzxf1zxn0pg
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "c:\users\user\wavesor software\swupdater\swupdater.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjtv1vwzgf0zxiiihvwzgf0zxj2zxjzaw9upsixljmumtmzljaiihnozwxsx3zlcnnpb249ijeumy4xmzmumcigaxntywnoaw5lpsiwiibzzxnzaw9uawq9inswrju4qtawrc00mtc1ltreodctquiwmi1frtlcmtq0otcznjf9iib1c2vyawq9intjmwu4mgi5os1hn2m1ltqwy2ytytg4mi0yyzawyjy4ogzkytz9iibpbnn0ywxsc291cmnlpsj1bmluc3rhbgwiihjlcxvlc3rpzd0iezmynzq0q0izluq3m0etneq5nc1bmkiylum1odiwnue0ndjbqn0iigrlzhvwpsjjciigzg9tywluam9pbmvkpsiwij48ahcgcgh5c21lbw9yet0iocigc3nlpsixiibzc2uypsixiibzc2uzpsixiibzc3nlmz0imsigc3nlnde9ijeiihnzztqypsixiibhdng9ijeilz48b3mgcgxhdgzvcm09indpbiigdmvyc2lvbj0imtaumc4xota0ns4ymda2iibzcd0iiibhcmnopsj4njqilz48yxbwigfwcglkpsj7rjzgnjbbq0utnzfbrc00njewltgwrdqtoti1mzcyouzcnei3fsigdmvyc2lvbj0ims4zljezmy4wiibuzxh0dmvyc2lvbj0iiibsyw5npsiiigjyyw5kpsjhr0xtiibjbgllbnq9iiigaw5zdgfsbgfnzt0imcigaw5zdgfsbgrhdgu9ii0xij48zxzlbnqgzxzlbnr0exblpsi0iibldmvudhjlc3vsdd0imsigzxjyb3jjb2rlpsiwiiblehryywnvzguxpsiwii8-pc9hcha-pc9yzxf1zxn0pg
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "c:\users\user\wavesor software\swupdater\swupdater.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjtv1vwzgf0zxiiihvwzgf0zxj2zxjzaw9upsixljmumtmzljaiihnozwxsx3zlcnnpb249ijeumy4xmzmumcigaxntywnoaw5lpsiwiibzzxnzaw9uawq9ins1rjrenddgrs1cndq4ltqzndatqjy1qi03quyyndvfrtc5men9iib1c2vyawq9intjmwu4mgi5os1hn2m1ltqwy2ytytg4mi0yyzawyjy4ogzkytz9iibpbnn0ywxsc291cmnlpsjvdghlcmluc3rhbgxjbwqiihjlcxvlc3rpzd0iezveoueynuneltjdqkqtndixms1cm0mzltixmereqzcxnjk4mh0iigrlzhvwpsjjciigzg9tywluam9pbmvkpsiwij48ahcgcgh5c21lbw9yet0iocigc3nlpsixiibzc2uypsixiibzc2uzpsixiibzc3nlmz0imsigc3nlnde9ijeiihnzztqypsixiibhdng9ijeilz48b3mgcgxhdgzvcm09indpbiigdmvyc2lvbj0imtaumc4xota0ns4ymda2iibzcd0iiibhcmnopsj4njqilz48yxbwigfwcglkpsj7rjzgnjbbq0utnzfbrc00njewltgwrdqtoti1mzcyouzcnei3fsigdmvyc2lvbj0iiibuzxh0dmvyc2lvbj0ims4zljezmy4wiibsyw5npsjlbiigynjhbmq9iiigy2xpzw50psiipjxldmvudcbldmvudhr5cgu9ijiiigv2zw50cmvzdwx0psixiiblcnjvcmnvzgu9ijaiigv4dhjhy29kzte9ijaiigluc3rhbgxfdgltzv9tcz0imtaxniivpjwvyxbwpjwvcmvxdwvzdd4Jump to behavior
Source: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "c:\users\user\wavesor software\swupdater\swupdater.exe" /handoff "bundlename=wavebrowser&appguid={eb149ad2-ce4e-4f51-b7fc-a149faa4ccaf}&appname=wavebrowser&needsadmin=false&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{5f4d47fe-b448-4340-b65b-7af245ee790c}"Jump to behavior
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "c:\users\user\wavesor software\swupdater\swupdater.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjtv1vwzgf0zxiiihvwzgf0zxj2zxjzaw9upsixljmumtmzljaiihnozwxsx3zlcnnpb249ijeumy4xmzmumcigaxntywnoaw5lpsiwiibzzxnzaw9uawq9inswrju4qtawrc00mtc1ltreodctquiwmi1frtlcmtq0otcznjf9iib1c2vyawq9intjmwu4mgi5os1hn2m1ltqwy2ytytg4mi0yyzawyjy4ogzkytz9iibpbnn0ywxsc291cmnlpsj1bmluc3rhbgwiihjlcxvlc3rpzd0ie0iwneyxmzyzltqxqtgtndg2rs1botu4ltezmuzdntcwrtewoh0iigrlzhvwpsjjciigzg9tywluam9pbmvkpsiwij48ahcgcgh5c21lbw9yet0iocigc3nlpsixiibzc2uypsixiibzc2uzpsixiibzc3nlmz0imsigc3nlnde9ijeiihnzztqypsixiibhdng9ijeilz48b3mgcgxhdgzvcm09indpbiigdmvyc2lvbj0imtaumc4xota0ns4ymda2iibzcd0iiibhcmnopsj4njqilz48yxbwigfwcglkpsj7ruixndlbrditq0u0rs00rjuxlui3rkmtqte0ouzbqtrdq0fgfsigdmvyc2lvbj0iiibuzxh0dmvyc2lvbj0iiibsyw5npsiiigjyyw5kpsiiignsawvudd0iij48zxzlbnqgzxzlbnr0exblpsi0iibldmvudhjlc3vsdd0imsigzxjyb3jjb2rlpsiwiiblehryywnvzguxpsiwii8-pc9hcha-pc9yzxf1zxn0pg
Source: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exeProcess created: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe "c:\users\user\wavesor software\swupdater\swupdater.exe" /ping pd94bwwgdmvyc2lvbj0ims4wiiblbmnvzgluzz0ivvrgltgipz48cmvxdwvzdcbwcm90b2nvbd0imy4wiib1cgrhdgvypsjtv1vwzgf0zxiiihvwzgf0zxj2zxjzaw9upsixljmumtmzljaiihnozwxsx3zlcnnpb249ijeumy4xmzmumcigaxntywnoaw5lpsiwiibzzxnzaw9uawq9inswrju4qtawrc00mtc1ltreodctquiwmi1frtlcmtq0otcznjf9iib1c2vyawq9intjmwu4mgi5os1hn2m1ltqwy2ytytg4mi0yyzawyjy4ogzkytz9iibpbnn0ywxsc291cmnlpsj1bmluc3rhbgwiihjlcxvlc3rpzd0iezmynzq0q0izluq3m0etneq5nc1bmkiylum1odiwnue0ndjbqn0iigrlzhvwpsjjciigzg9tywluam9pbmvkpsiwij48ahcgcgh5c21lbw9yet0iocigc3nlpsixiibzc2uypsixiibzc2uzpsixiibzc3nlmz0imsigc3nlnde9ijeiihnzztqypsixiibhdng9ijeilz48b3mgcgxhdgzvcm09indpbiigdmvyc2lvbj0imtaumc4xota0ns4ymda2iibzcd0iiibhcmnopsj4njqilz48yxbwigfwcglkpsj7rjzgnjbbq0utnzfbrc00njewltgwrdqtoti1mzcyouzcnei3fsigdmvyc2lvbj0ims4zljezmy4wiibuzxh0dmvyc2lvbj0iiibsyw5npsiiigjyyw5kpsjhr0xtiibjbgllbnq9iiigaw5zdgfsbgfnzt0imcigaw5zdgfsbgrhdgu9ii0xij48zxzlbnqgzxzlbnr0exblpsi0iibldmvudhjlc3vsdd0imsigzxjyb3jjb2rlpsiwiiblehryywnvzguxpsiwii8-pc9hcha-pc9yzxf1zxn0pg
Source: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exeCode function: 18_2_00883372 GetSecurityDescriptorDacl,SetSecurityDescriptorDacl,18_2_00883372
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D75638 cpuid 1_2_00D75638
Source: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exeCode function: 1_2_00D7527B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,1_2_00D7527B
Source: C:\Users\user\Desktop\Wave Browser.exeCode function: 0_2_004031D6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_004031D6

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts13
Native API		1
DLL Side-Loading		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Exploitation for Client Execution		1
DLL Search Order Hijacking		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol2
Clipboard Data		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts12
Command and Scripting Interpreter		1
Scheduled Task/Job		1
DLL Search Order Hijacking		21
Obfuscated Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
Scheduled Task/Job		11
Registry Run Keys / Startup Folder		1
Access Token Manipulation		1
Software Packing		NTDS16
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script111
Process Injection		1
DLL Side-Loading		LSA Secrets1
Query Registry		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Scheduled Task/Job		1
DLL Search Order Hijacking		Cached Domain Credentials31
Security Software Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items11
Registry Run Keys / Startup Folder		2
Masquerading		DCSync1
Virtualization/Sandbox Evasion		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Virtualization/Sandbox Evasion		Proc Filesystem1
Process Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Access Token Manipulation		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron111
Process Injection		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1468666 Sample: Wave Browser.exe Startdate: 07/07/2024 Architecture: WINDOWS Score: 45 164 Multi AV Scanner detection for submitted file 2->164 13 Wave Browser.exe 3 43 2->13         started        17 msedge.exe 2->17         started        20 SWUpdater.exe 2 1 2->20         started        22 5 other processes 2->22 process3 dnsIp4 154 52.205.35.208 AMAZON-AESUS United States 13->154 124 C:\Users\user\AppData\...\SWUpdaterSetup.exe, PE32 13->124 dropped 126 C:\Users\user\AppData\Local\...\nsResize.dll, PE32 13->126 dropped 128 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 13->128 dropped 130 3 other files (none is malicious) 13->130 dropped 24 SWUpdaterSetup.exe 18 13->24         started        156 239.255.255.250 unknown Reserved 17->156 160 Creates multiple autostart registry keys 17->160 162 Maps a DLL or memory area into another process 17->162 28 msedge.exe 17->28         started        41 3 other processes 17->41 158 18.210.144.17 AMAZON-AESUS United States 20->158 31 SWUpdater.exe 20->31         started        33 SWUpdater.exe 20->33         started        35 SWUpdater.exe 22->35         started        37 SWUpdater.exe 22->37         started        39 SWUpdater.exe 22->39         started        43 2 other processes 22->43 file5 signatures6 process7 dnsIp8 102 C:\Program Files (x86)\...\SWUpdater.exe, PE32 24->102 dropped 104 C:\...\swupdaterres_en.dll, PE32 24->104 dropped 106 C:\Program Files (x86)\...\swupdater.dll, PE32 24->106 dropped 114 9 other files (none is malicious) 24->114 dropped 166 Found evasive API chain checking for user administrative privileges 24->166 45 SWUpdater.exe 17 20 24->45         started        148 13.107.21.239 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 28->148 150 13.107.246.42 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 28->150 152 8 other IPs or domains 28->152 108 C:\Users\...\swupdaterres_en.dll59227b (copy), PE32 31->108 dropped 110 C:\Users\user\...\swupdater.dll59227b (copy), PE32 31->110 dropped 112 C:\Users\user\...\SWUpdater.exe59227b (copy), PE32 31->112 dropped 49 SWUpdater.exe 31->49         started        51 SWUpdater.exe 31->51         started        53 SWUpdater.exe 31->53         started        file9 signatures10 process11 file12 116 C:\Users\user\...\SWUpdater.exe, PE32 45->116 dropped 118 C:\Users\user\...\swupdaterres_en.dll, PE32 45->118 dropped 120 C:\Users\user\...\swupdater.dll, PE32 45->120 dropped 122 10 other files (none is malicious) 45->122 dropped 168 Creates multiple autostart registry keys 45->168 55 SWUpdater.exe 45->55         started        58 SWUpdater.exe 129 45->58         started        60 SWUpdater.exe 45->60         started        62 SWUpdaterComRegisterShell64.exe 49->62         started        64 SWUpdaterComRegisterShell64.exe 49->64         started        signatures13 process14 file15 98 C:\Users\user\...\WaveInstaller-v1.3.16.5.exe, PE32 55->98 dropped 100 C:\Users\user\...\WaveInstaller-v1.3.16.5.exe, PE32 55->100 dropped 66 iexplore.exe 55->66         started        69 iexplore.exe 55->69         started        71 iexplore.exe 55->71         started        79 3 other processes 55->79 73 SWUpdaterComRegisterShell64.exe 6 58->73         started        75 SWUpdaterComRegisterShell64.exe 6 58->75         started        77 SWUpdaterComRegisterShell64.exe 92 58->77         started        process16 dnsIp17 146 2.23.209.149 CWVodafoneGroupPLCEU European Union 66->146 81 iexplore.exe 66->81         started        84 iexplore.exe 66->84         started        86 iexplore.exe 66->86         started        88 2 other processes 66->88 process18 dnsIp19 132 13.107.21.237 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 81->132 134 13.74.129.1 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 81->134 138 6 other IPs or domains 81->138 90 ie_to_edge_stub.exe 81->90         started        92 ssvagent.exe 81->92         started        140 3 other IPs or domains 84->140 142 4 other IPs or domains 86->142 136 104.208.16.95 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 88->136 144 5 other IPs or domains 88->144 process20 process21 94 msedge.exe 90->94         started        process22 96 msedge.exe 94->96         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Wave Browser.exe12%ReversingLabs
Wave Browser.exe10%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe3%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterBroker.exe4%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterComRegisterShell64.exe4%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterCore.exe8%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterOnDemand.exe4%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterSetup.exe8%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psmachine.dll3%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psmachine_64.dll4%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psuser.dll3%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psuser_64.dll4%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\swupdater.dll3%ReversingLabs
C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\swupdaterres_en.dll4%ReversingLabs
C:\Users\user\AppData\Local\Temp\SWUpdater.exe59227b (copy)3%ReversingLabs
C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe8%ReversingLabs
C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsArray.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsDialogs.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsResize.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\swupdater.dll59227b (copy)3%ReversingLabs
C:\Users\user\AppData\Local\Temp\swupdaterres_en.dll59227b (copy)4%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdater.exe3%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterBroker.exe4%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe4%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe8%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterOnDemand.exe4%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterSetup.exe8%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psmachine.dll3%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psmachine_64.dll4%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psuser.dll3%ReversingLabs
C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psuser_64.dll4%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://nsis.sf.net/NSIS_Error0%URL Reputationsafe
https://www.msn.com/?ocid=iehp72M0%Avira URL Cloudsafe
http://www.dailymail.co.uk/0%Avira URL Cloudsafe
http://www.merlin.com.pl/favicon.ico0%Avira URL Cloudsafe
http://search.chol.com/favicon.ico0%Avira URL Cloudsafe
https://android.notify.windows.com/iOSX0%Avira URL Cloudsafe
https://ff.search.yahoo.com/gossip?output=fxjson&command=0%Avira URL Cloudsafe
http://search.aol.com/M0%Avira URL Cloudsafe
https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=07/&0%Avira URL Cloudsafe
http://www.merlin.com.pl/favicon.ico0%VirustotalBrowse
http://www.dailymail.co.uk/0%VirustotalBrowse
https://aefd.nelreports.net/api/report?cat=bingcsp0%Avira URL Cloudsafe
https://android.notify.windows.com/iOSX0%VirustotalBrowse
http://search.chol.com/favicon.ico0%VirustotalBrowse
https://ff.search.yahoo.com/gossip?output=fxjson&command=0%VirustotalBrowse
http://fr.search.yahoo.com/0%Avira URL Cloudsafe
http://video.globo.com/favicon.icog0%Avira URL Cloudsafe
https://aefd.nelreports.net/api/report?cat=bingcsp0%VirustotalBrowse
http://www.etmall.com.tw/favicon.icoY0%Avira URL Cloudsafe
http://fr.search.yahoo.com/0%VirustotalBrowse
http://in.search.yahoo.com/0%Avira URL Cloudsafe
https://clients2.swupdater.com/tN0%Avira URL Cloudsafe
http://www.alarabiya.net/a0%Avira URL Cloudsafe
http://www.etmall.com.tw/favicon.icoY0%VirustotalBrowse
https://clients2.swupdater.com/service/check2?Z0%Avira URL Cloudsafe
http://img.shopzilla.com/shopzilla/shopzilla.ico0%Avira URL Cloudsafe
http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSea0%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS50%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS60%Avira URL Cloudsafe
http://busca.uol.com.br/H0%Avira URL Cloudsafe
http://img.shopzilla.com/shopzilla/shopzilla.ico0%VirustotalBrowse
http://recherche.tf1.fr/00%Avira URL Cloudsafe
http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSea0%VirustotalBrowse
http://msk.afisha.ru/0%Avira URL Cloudsafe
http://in.search.yahoo.com/0%VirustotalBrowse
http://www.orange.fr/r0%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS60%VirustotalBrowse
https://wns.windows.com/0%Avira URL Cloudsafe
http://recherche.tf1.fr/00%VirustotalBrowse
http://www.reddit.com/0%Avira URL Cloudsafe
https://www.msn.com/?ocid=iehpB2E3A0%Avira URL Cloudsafe
http://www.merlin.com.pl/80%Avira URL Cloudsafe
http://www.ya.com/favicon.ico0%Avira URL Cloudsafe
https://www.msn.com/?ocid=iehpB2E3A0%VirustotalBrowse
http://www.orange.fr/r0%VirustotalBrowse
http://search.ebay.com/favicon.icoJ0%Avira URL Cloudsafe
http://www.ya.com/favicon.ico0%VirustotalBrowse
http://www.merlin.com.pl/80%VirustotalBrowse
http://msk.afisha.ru/0%VirustotalBrowse
http://www.reddit.com/0%VirustotalBrowse
http://www.etmall.com.tw/favicon.ico0%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS50%VirustotalBrowse
http://www.mtv.com/j?L0%Avira URL Cloudsafe
http://it.search.dada.net/favicon.ico0%Avira URL Cloudsafe
http://price.ru/favicon.icoY0%Avira URL Cloudsafe
http://www.etmall.com.tw/favicon.ico0%VirustotalBrowse
http://search.hanafos.com/favicon.ico0%Avira URL Cloudsafe
http://cgi.search.biglobe.ne.jp/favicon.ico0%Avira URL Cloudsafe
https://wns.windows.com/0%VirustotalBrowse
http://search.ebay.com/favicon.icoJ0%VirustotalBrowse
http://search.msn.co.jp/results.aspx?q=0%Avira URL Cloudsafe
http://it.search.dada.net/favicon.ico0%VirustotalBrowse
http://buscar.ozu.es/0%Avira URL Cloudsafe
http://price.ru/favicon.icoY0%VirustotalBrowse
http://www.ask.com/0%Avira URL Cloudsafe
http://cgi.search.biglobe.ne.jp/favicon.ico0%VirustotalBrowse
http://search.live.com/results.aspx?FORM=SOLTDF&q=0%Avira URL Cloudsafe
http://search.msn.co.jp/results.aspx?q=0%VirustotalBrowse
http://www.google.it/0%Avira URL Cloudsafe
http://search.auction.co.kr/0%Avira URL Cloudsafe
http://www.ask.com/0%VirustotalBrowse
http://search.yahoo.com/favicon.icot0%Avira URL Cloudsafe
http://search.live.com/results.aspx?FORM=SOLTDF&q=0%VirustotalBrowse
http://search.cn.yahoo.com/t0%Avira URL Cloudsafe
http://www.amazon.de/0%Avira URL Cloudsafe
http://www.google.it/0%VirustotalBrowse
https://swupdater.com/service/update24N0%Avira URL Cloudsafe
http://sads.myspace.com/0%Avira URL Cloudsafe
http://search.interpark.com/t0%Avira URL Cloudsafe
http://suche.freenet.de/favicon.icoC0%Avira URL Cloudsafe
http://search.ebay.com/favicon.icot0%Avira URL Cloudsafe
http://search.hanafos.com/favicon.ico0%VirustotalBrowse
http://www.pchome.com.tw/favicon.ico0%Avira URL Cloudsafe
http://list.taobao.com/browse/search_visual.htm?n=15&q=0%Avira URL Cloudsafe
http://google.pchome.com.tw/0%Avira URL Cloudsafe
http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=0%Avira URL Cloudsafe
http://www.rambler.ru/favicon.ico0%Avira URL Cloudsafe
http://uk.search.yahoo.com/0%Avira URL Cloudsafe
https://www.msn.com/favicon.ico:Sat:Saturday0%Avira URL Cloudsafe
https://wavebrowser.co/termshttps://wavebrowser.co/privacyhttps://wavebrowser.co/changelog0%Avira URL Cloudsafe
https://swupdater.com:4430%Avira URL Cloudsafe
http://www.ozu.es/favicon.ico0%Avira URL Cloudsafe
http://search.sify.com/0%Avira URL Cloudsafe
http://openimage.interpark.com/interpark.ico0%Avira URL Cloudsafe
http://search.yahoo.co.jp/favicon.ico0%Avira URL Cloudsafe
http://www.gmarket.co.kr/0%Avira URL Cloudsafe
http://search.nifty.com/0%Avira URL Cloudsafe
http://www.google.si/0%Avira URL Cloudsafe
http://www.ya.com/favicon.icoy0%Avira URL Cloudsafe
http://www.soso.com/0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://search.chol.com/favicon.icoiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.merlin.com.pl/favicon.icoiexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://android.notify.windows.com/iOSXiexplore.exe, 00000017.00000002.3520085326.000001A0A3391000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.dailymail.co.uk/iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.msn.com/?ocid=iehp72Miexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://ff.search.yahoo.com/gossip?output=fxjson&command=SWUpdater.exe, 0000000E.00000003.2790429232.0000000004340000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://search.aol.com/Miexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=07/&Wave Browser.exe, 00000000.00000002.3120881782.000000000470C000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://aefd.nelreports.net/api/report?cat=bingcspiexplore.exe, 00000017.00000003.2014518017.000001A0A332C000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://fr.search.yahoo.com/iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://video.globo.com/favicon.icogiexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.etmall.com.tw/favicon.icoYiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://in.search.yahoo.com/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://clients2.swupdater.com/tNSWUpdater.exe, 00000009.00000002.1805756226.000000000086E000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.alarabiya.net/aiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://clients2.swupdater.com/service/check2?ZSWUpdater.exe, 00000009.00000002.1805756226.0000000000854000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://img.shopzilla.com/shopzilla/shopzilla.icoiexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015469461.000001A0A3156000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation=ItemSeaiexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015469461.000001A0A3156000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS5iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://search.msn.co.jp/results.aspx?q=%7BsearchTerms%7D&FORM=AS6iexplore.exe, 00000017.00000002.3517451438.000001A0A2C74000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://busca.uol.com.br/Hiexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://recherche.tf1.fr/0iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://msk.afisha.ru/iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.orange.fr/riexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://wns.windows.com/iexplore.exe, 00000017.00000002.3520085326.000001A0A33DB000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.reddit.com/iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.msn.com/?ocid=iehpB2E3Aiexplore.exe, 00000017.00000002.3517451438.000001A0A2C67000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.merlin.com.pl/8iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.ya.com/favicon.icoiexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://search.ebay.com/favicon.icoJiexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.etmall.com.tw/favicon.icoiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://it.search.dada.net/favicon.icoiexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.mtv.com/j?Liexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://price.ru/favicon.icoYiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://search.hanafos.com/favicon.icoiexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://cgi.search.biglobe.ne.jp/favicon.icoiexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://search.msn.co.jp/results.aspx?q=iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3516401707.000001A0A0472000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3164000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://buscar.ozu.es/iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.ask.com/iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://search.live.com/results.aspx?FORM=SOLTDF&q=iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.google.it/iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://search.auction.co.kr/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.yahoo.com/favicon.icotiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.cn.yahoo.com/tiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.amazon.de/iexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://swupdater.com/service/update24NSWUpdater.exe, 00000008.00000002.1780415358.000000000134E000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://nsis.sf.net/NSIS_ErrorWave Browser.exe, Wave Browser.exe, 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Wave Browser.exe, 00000000.00000000.1662723487.0000000000409000.00000008.00000001.01000000.00000003.sdmp, WaveInstaller-v1.3.16.5.exe0.14.drfalse
  • URL Reputation: safe
unknown
http://sads.myspace.com/iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.interpark.com/tiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://suche.freenet.de/favicon.icoCiexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.ebay.com/favicon.icotiexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://list.taobao.com/browse/search_visual.htm?n=15&q=iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.pchome.com.tw/favicon.icoiexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://google.pchome.com.tw/iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.rambler.ru/favicon.icoiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://uk.search.yahoo.com/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.msn.com/favicon.ico:Sat:Saturdayiexplore.exe, 00000017.00000002.3522815682.000001A0A6911000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3522815682.000001A0A6A69000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://wavebrowser.co/termshttps://wavebrowser.co/privacyhttps://wavebrowser.co/changelogWave Browser.exe, 00000000.00000002.3119234785.0000000000518000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.1663580891.0000000002755000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://swupdater.com:443SWUpdater.exe, 0000000E.00000002.3099166175.00000000012B8000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.ozu.es/favicon.icoiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.sify.com/iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://openimage.interpark.com/interpark.icoiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.yahoo.co.jp/favicon.icoiexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.gmarket.co.kr/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3166000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.nifty.com/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.google.si/iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.ya.com/favicon.icoyiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.soso.com/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://espn.go.com/favicon.icoEiexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://asp.usatoday.com/favicon.ico&iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://busca.orange.es/iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://cnweb.search.live.com/results.aspx?q=iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015574156.000001A0A3175000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3176000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.twitter.com/iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.target.com/iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.cnet.co.uk/ciexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.myspace.com/favicon.ico&iexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.mercadolivre.com.br/piexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.univision.com/Niexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519669652.000001A0A315E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015603284.000001A0A315D000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://swupdater.com/cr/reportWavesorSWUpdaterSetup.exe, 00000001.00000003.1734132508.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1733593107.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, SWUpdaterSetup.exe, 00000001.00000003.1734319236.0000000002FDE000.00000004.00000020.00020000.00000000.sdmp, SWUpdater.exe, 00000002.00000003.1737926668.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, swupdater.dll.2.drfalse
  • Avira URL Cloud: safe
unknown
http://search.orange.co.uk/favicon.icoiexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.iask.com/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://api.wavebrowserbase.com/inst/15/status/chr_swupd_finished?id=&v=1.4.16.2&swexcr=0.tmpWave Browser.exe, 00000000.00000003.3117920074.00000000005AC000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000002.3119600983.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, Wave Browser.exe, 00000000.00000003.3118311906.00000000005B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.centrum.cz/favicon.icoiexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.news.com.au/favicon.icoiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.tiscali.it/favicon.icoiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://it.search.yahoo.com/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3182000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.ceneo.pl/favicon.icoiexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519733691.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.univision.com/favicon.icoGiexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.daum.net/favicon.icoiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.kkbox.com.tw/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.goo.ne.jp/favicon.icoiexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3517451438.000001A0A2C5E000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://search.msn.com/results.aspx?q=iexplore.exe, 00000017.00000002.3517451438.000001A0A2BBC000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3516401707.000001A0A04E1000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3164000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://list.taobao.com/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.nytimes.com/iexplore.exe, 00000017.00000002.3520085326.000001A0A3458000.00000004.00000020.00020000.00000000.sdmp, msapplication.xml4.23.drfalse
  • Avira URL Cloud: safe
unknown
http://www.taobao.com/favicon.icoiexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.etmall.com.tw/iexplore.exe, 00000017.00000003.2015000152.000001A0A316C000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015666914.000001A0A3184000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519813175.000001A0A3187000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015631814.000001A0A317D000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015169298.000001A0A3173000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://ie.search.yahoo.com/os?command=iexplore.exe, 00000017.00000003.2015533646.000001A0A3178000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015403827.000001A0A3173000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.cnet.com/favicon.icoiexplore.exe, 00000017.00000003.2015372752.000001A0A314F000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519445178.000001A0A3150000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.linternaute.com/favicon.icoiexplore.exe, 00000017.00000003.2015469461.000001A0A315B000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015243126.000001A0A315A000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000003.2015126048.000001A0A3157000.00000004.00000020.00020000.00000000.sdmp, iexplore.exe, 00000017.00000002.3519590513.000001A0A315B000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
2.23.209.149
unknownEuropean Union
1273CWVodafoneGroupPLCEUfalse
13.107.246.42
unknownUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
18.210.144.17
unknownUnited States
14618AMAZON-AESUSfalse
2.23.209.32
unknownEuropean Union
1273CWVodafoneGroupPLCEUfalse
151.101.129.108
unknownUnited States
54113FASTLYUSfalse
152.195.19.97
unknownUnited States
15133EDGECASTUSfalse
20.189.173.2
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
142.251.40.202
unknownUnited States
15169GOOGLEUSfalse
52.182.143.215
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
23.15.178.186
unknownUnited States
20940AKAMAI-ASN1EUfalse
88.221.110.195
unknownEuropean Union
20940AKAMAI-ASN1EUfalse
162.159.61.3
unknownUnited States
13335CLOUDFLARENETUSfalse
2.23.209.182
unknownEuropean Union
1273CWVodafoneGroupPLCEUfalse
13.74.129.1
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
151.101.194.137
unknownUnited States
54113FASTLYUSfalse
216.58.212.174
unknownUnited States
15169GOOGLEUSfalse
2.19.96.66
unknownEuropean Union
20940AKAMAI-ASN1EUfalse
172.64.41.3
unknownUnited States
13335CLOUDFLARENETUSfalse
104.208.16.95
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
13.89.179.10
unknownUnited States
8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
1.1.1.1
unknownAustralia
13335CLOUDFLARENETUSfalse
13.107.21.237
unknownUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
13.107.21.239
unknownUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
172.217.16.129
unknownUnited States
15169GOOGLEUSfalse
2.16.164.32
unknownEuropean Union
20940AKAMAI-ASN1EUfalse
2.16.164.97
unknownEuropean Union
20940AKAMAI-ASN1EUfalse
52.205.35.208
unknownUnited States
14618AMAZON-AESUSfalse
13.107.42.16
unknownUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
2.23.209.29
unknownEuropean Union
1273CWVodafoneGroupPLCEUfalse
18.244.18.38
unknownUnited States
16509AMAZON-02USfalse
184.28.89.167
unknownUnited States
16625AKAMAI-ASUSfalse
239.255.255.250
unknownReserved
unknownunknownfalse
104.126.37.144
unknownUnited States
20940AKAMAI-ASN1EUfalse
104.126.37.147
unknownUnited States
20940AKAMAI-ASN1EUfalse
204.79.197.203
unknownUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1468666
Start date and time:2024-07-07 10:53:08 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 32s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:Run with higher sleep bypass
Number of analysed new started processes analysed:53
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:Wave Browser.exe
Detection:MAL
Classification:mal45.evad.winEXE@121/503@0/35
EGA Information:
  • Successful, ratio: 85.7%
HCA Information:
  • Successful, ratio: 97%
  • Number of executed functions: 113
  • Number of non-executed functions: 185
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
  • Execution Graph export aborted for target SWUpdater.exe, PID 7344 because there are no executed function
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size getting too big, too many NtCreateKey calls found.
  • Report size getting too big, too many NtOpenFile calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtReadVirtualMemory calls found.
  • Report size getting too big, too many NtSetValueKey calls found.
  • Report size getting too big, too many NtWriteVirtualMemory calls found.
  • Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

TimeTypeDescription
09:54:06Task SchedulerRun new task: WavesorSWUpdaterTaskUserS-1-5-21-2246122658-3693405117-2476756634-1002Core path: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe s>/c
09:54:06Task SchedulerRun new task: WavesorSWUpdaterTaskUserS-1-5-21-2246122658-3693405117-2476756634-1002UA path: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe s>/ua /installsource scheduler
09:54:09AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Wavesor SWUpdater "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe"
09:54:18AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Wavesor SWUpdater "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe"
09:54:36AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
09:54:44AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
09:55:48Task SchedulerRun new task: WaveBrowser-StartAtLogin path: C:\Users\user\Wavesor Software\WaveBrowser\wavebrowser.exe s>--strtl=wts
09:55:53AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WaveBrowser_AD560CB9A7D27BAF872A589CCA5356D4 "C:\Users\user\Wavesor Software\WaveBrowser\wavebrowser.exe" --strtl=aut
09:56:01AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WaveBrowser_AD560CB9A7D27BAF872A589CCA5356D4 "C:\Users\user\Wavesor Software\WaveBrowser\wavebrowser.exe" --strtl=aut

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
2.23.209.149invoice 700898 for wallcentre.com.shtmlGet hashmaliciousUnknownBrowse
    http://css.cdntoswitchspirit.comGet hashmaliciousUnknownBrowse
      socar.exeGet hashmaliciousUnknownBrowse
        https://ipfs.io/ipfs/QmWKhkdexSueCwD6DsMpF9DYvwiW7bsBRRc6mCZnsMFGVE/?submit=integrationsrat@stadt.nuernberg.deGet hashmaliciousUnknownBrowse
          https://www.bing.com/ck/a?!&&p=f8a2d5c859978b76JmltdHM9MTY4NDI4MTYwMCZpZ3VpZD0yZGZmZTZiYS04YjY0LTY0NWItMzViMy1mNWFlOGE3NjY1NDImaW5zaWQ9NTEzNw&ptn=3&hsh=3&fclid=2dffe6ba-8b64-645b-35b3-f5ae8a766542&u=a1aHR0cDovL2JsdWVmaWVsZGludmVzdG1lbnQub3JnLwGet hashmaliciousUnknownBrowse
            MDE_File_Sample_e058c05eaa614f5e86e702a65f146893d8235c0e.zipGet hashmaliciousNetSupport RATBrowse
              https://lylrefrigeracion.com.pe/eod/eumest.php?mveina=9&c=E,1,dp9NEob1tkw1QlmkYDvrpdXiwpOZWzmXtsOSdXKGKBo6nVnI3CB1fphmKUxpZStAO9kKHVcgoRgNcB9cg-uZTI3IM6ecbHi9BxSH_dXeAQBC66bFMFp4kBht&typo=1&ancr_add=1Get hashmaliciousUnknownBrowse
                13.107.246.42file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                  https://41619ec8e8407cbea965833e1fb35e027cd895bdef33c8d4bb7a06d460.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                    https://f4dfc3a6ab223a609ab2682120fd9f431b51dcff8df1312719112d196d.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                      Cherokeebrick-salary increase.pdfGet hashmaliciousHTMLPhisherBrowse
                        Invoice - 74950723898713999323684865104322985373179531936365 - Kforce.pdfGet hashmaliciousHTMLPhisherBrowse
                          https://chorbie.com/services/Get hashmaliciousUnknownBrowse
                            https://iriss.online/i/ontransfer_pathways/login?p=loginGet hashmaliciousUnknownBrowse
                              https://url.uk.m.mimecastprotect.com/s/rO3rCG6qJSA66X7FKCV6f?domain=nam.dcv.msGet hashmaliciousHTMLPhisherBrowse
                                http://sites.google.com/view/terramininghseq/inductions/binduli-and-goldfields-inductionGet hashmaliciousUnknownBrowse
                                  https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fwww.cognitoforms.com%2fPaulWareConstruction%2fPaulWareConstruction&umid=78a9b273-344a-4f1a-b7d2-24e7c118b2df&auth=3a5566c60b1f4d8525fa8ab109f94675a663eb25-b5b8ec923cecbd7e3e5907f0ebdd261fbc9f6201Get hashmaliciousHTMLPhisherBrowse
                                    2.23.209.32https://messengeravl-my.sharepoint.com/:b:/p/joe/EUaalaFNBFVFgzqdWjgwP10BDkdHrky0cuqdP-RpLXIPLQ?e=jfHJMyGet hashmaliciousHTMLPhisherBrowse
                                      https://jornalangolense.com/Get hashmaliciousHTMLPhisherBrowse
                                        https://login.gatx-portal.com/JGVLrPVA?client_id=shXtw698iHGet hashmaliciousHTMLPhisherBrowse
                                          151.101.129.108Wave Browser.exeGet hashmaliciousUnknownBrowse
                                            https://dofaceb00kl0gin.angelfire.com/index.htm/Get hashmaliciousUnknownBrowse
                                              9d565bee-e6ce-1842-e729-b0df8f08ed34.emlGet hashmaliciousHTMLPhisherBrowse
                                                https://www.msn.com/en-us/autos/enthusiasts/what-s-the-difference-between-a-shelby-mustang-and-a-regular-mustang/ar-AA1ntM5Z?ocid=entnewsntp&pc=U531&cvid=8b8aa9e3e14d4164a6a2181020104694&ei=36Get hashmaliciousUnknownBrowse
                                                  http://woollamau.comGet hashmaliciousUnknownBrowse
                                                    https://digitalmissioners.comGet hashmaliciousUnknownBrowse
                                                      [EXTERNAL]0001174512' 'Customer Balance Confirmation.emlGet hashmaliciousUnknownBrowse
                                                        FW EXTERNALRequest For ACH Completion Form February 05 2024.msgGet hashmaliciousUnknownBrowse
                                                          https://www.notion.so/Roofers-Mart-261c63250b4847e890515b9d060c1c63?pvs=4Get hashmaliciousUnknownBrowse
                                                            https://usp.usspcd.topGet hashmaliciousUnknownBrowse
                                                              152.195.19.97http://ustteam.com/Get hashmaliciousUnknownBrowse
                                                              • www.ust.com/

                                                              Domains

                                                              ⊘No context

                                                              ASNs

                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              CWVodafoneGroupPLCEUhttps://fastupload.io/1824d409732f30beGet hashmaliciousUnknownBrowse
                                                              • 2.23.197.190
                                                              https://fastupload.io/1824d409732f30beGet hashmaliciousUnknownBrowse
                                                              • 2.23.197.190
                                                              https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLrGet hashmaliciousHTMLPhisherBrowse
                                                              • 2.23.209.37
                                                              https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLrGet hashmaliciousHTMLPhisherBrowse
                                                              • 2.23.209.42
                                                              205.185.124.50-mips-2024-07-03T23_47_54.elfGet hashmaliciousMirai, MoobotBrowse
                                                              • 195.59.60.235
                                                              ztGOiA742S.elfGet hashmaliciousUnknownBrowse
                                                              • 217.135.37.116
                                                              jxnRJIvUKz.elfGet hashmaliciousMiraiBrowse
                                                              • 194.221.96.177
                                                              https://vogelgormanplc-my.sharepoint.com/:o:/g/personal/mcook_vgllaw_com/EoWNEiRfVRJGgG47q5PYhKIBkV4CjNWUYZjZU9msILDe-Q?e=5%3akZcnSr&at=9&xsdata=MDV8MDJ8bWljaGFlbC5tY2d1aXJlQHhjZWxlbmVyZ3kuY29tfDMwN2U0MjVlMmE1MTQwYjJkYjg1MDhkYzliOTRmMTNhfDI0YjJhNTgzNWMwNTRiNmFiNGU5NGUxMmRjMDAyNWFkfDB8MHw2Mzg1NTYzMTEyNDIyMTkzODh8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=dWtMc0lWaVl3YitOcHQ2VURyZ0hXdUMxNk9mMFJEY3JRc3Rob3U2emVDYz0%3dGet hashmaliciousHTMLPhisherBrowse
                                                              • 2.23.209.42
                                                              https://vogelgormanplc-my.sharepoint.com/:o:/g/personal/mcook_vgllaw_com/EoWNEiRfVRJGgG47q5PYhKIBkV4CjNWUYZjZU9msILDe-Q?e=5%3akZcnSr&at=9&xsdata=MDV8MDJ8bWljaGFlbC5tY2d1aXJlQHhjZWxlbmVyZ3kuY29tfDMwN2U0MjVlMmE1MTQwYjJkYjg1MDhkYzliOTRmMTNhfDI0YjJhNTgzNWMwNTRiNmFiNGU5NGUxMmRjMDAyNWFkfDB8MHw2Mzg1NTYzMTEyNDIyMTkzODh8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=dWtMc0lWaVl3YitOcHQ2VURyZ0hXdUMxNk9mMFJEY3JRc3Rob3U2emVDYz0%3dGet hashmaliciousHTMLPhisherBrowse
                                                              • 2.23.209.24
                                                              AMAZON-AESUSgoPhzZ.exeGet hashmaliciousRemCom RemoteAdmin, Mimikatz, DUMPNTLM, MetasploitBrowse
                                                              • 18.208.156.248
                                                              https://www.metauka.com/buscar.php?q=8xdlpb%22%3E%3C%69%6D%67%20%73%72%63%3D%22%69%6D%61%67%65%2E%6A%70%67%22%20%6F%6E%65%72%72%6F%72%3D%22%76%61%72%20%75%72%6C%31%20%3D%20%5B%27%68%74%74%70%3A%2F%2F%67%27%2C%27%6F%6F%67%27%2C%27%6C%65%2E%63%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%20%76%61%72%20%75%72%6C%32%20%3D%20%5B%27%68%74%74%70%3A%2F%2F%67%27%2C%27%6F%6F%67%27%2C%27%6C%65%2E%63%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%76%61%72%20%75%72%6C%20%3D%20%5B%27%68%27%2C%27%74%74%27%2C%27%70%27%2C%27%73%3A%2F%27%2C%27%2F%77%27%2C%27%77%77%2E%77%27%2C%27%65%62%27%2C%27%77%61%74%63%27%2C%27%68%65%72%27%2C%27%6F%6E%27%2C%27%6C%27%2C%27%69%6E%27%2C%27%65%2E%78%27%2C%27%79%7A%27%2C%27%2F%32%27%2C%27%35%27%2C%27%50%42%27%2C%27%4E%5A%27%2C%27%39%27%2C%27%39%2F%37%27%2C%27%43%35%27%2C%27%58%33%27%2C%27%53%57%27%2C%27%34%2F%3F%73%75%62%31%3D16%26%73%75%62%32%3D309%2D14441%26%73%75%62%33%3D1271%2D102518%2D22496%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%20%75%72%6C%20%3D%20%75%72%6C%2E%72%65%70%6C%61%63%65%28%2F%2C%2F%67%2C%20%27%27%29%3B%20%76%61%72%20%77%69%6E%20%3D%20%77%69%6E%64%6F%77%2E%6F%70%65%6E%28%75%72%6C%2C%20%27%5F%73%65%6C%66%27%29%3B%20%77%69%6E%2E%6F%70%65%6E%65%72%20%3D%20%6E%75%6C%6C%3B%20%77%69%6E%2E%6C%6F%63%61%74%69%6F%6E%2E%72%65%70%6C%61%63%65%28%75%72%6C%29%3B%22%3E#h6fmSBGiZh8X20Zr6k7pGet hashmaliciousUnknownBrowse
                                                              • 52.205.223.226
                                                              http://sectocarewl.online/mona-michelle/Get hashmaliciousUnknownBrowse
                                                              • 52.44.76.179
                                                              https://anp.ab9.mywebsitetransfer.com/eddGet hashmaliciousUnknownBrowse
                                                              • 54.243.157.39
                                                              https://eaglecomputersystems.com/Get hashmaliciousUnknownBrowse
                                                              • 52.23.44.153
                                                              https://prometals.co.za/Get hashmaliciousUnknownBrowse
                                                              • 34.204.146.159
                                                              https://help-app-metamaskii.gitbook.io/usGet hashmaliciousUnknownBrowse
                                                              • 3.223.122.65
                                                              https://heatpt.com/Get hashmaliciousUnknownBrowse
                                                              • 35.169.243.125
                                                              https://my-site-103570-106139.weeblysite.com/Get hashmaliciousUnknownBrowse
                                                              • 50.19.89.137
                                                              CWVodafoneGroupPLCEUhttps://fastupload.io/1824d409732f30beGet hashmaliciousUnknownBrowse
                                                              • 2.23.197.190
                                                              https://fastupload.io/1824d409732f30beGet hashmaliciousUnknownBrowse
                                                              • 2.23.197.190
                                                              https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLrGet hashmaliciousHTMLPhisherBrowse
                                                              • 2.23.209.37
                                                              https://1drv.ms/b/c/76a2f2769a0f2d92/EVBBlcPr69hPlwB4teIJkR8BhOEwtE3haDg1sSdukRfZrw?e=geYoLrGet hashmaliciousHTMLPhisherBrowse
                                                              • 2.23.209.42
                                                              205.185.124.50-mips-2024-07-03T23_47_54.elfGet hashmaliciousMirai, MoobotBrowse
                                                              • 195.59.60.235
                                                              ztGOiA742S.elfGet hashmaliciousUnknownBrowse
                                                              • 217.135.37.116
                                                              jxnRJIvUKz.elfGet hashmaliciousMiraiBrowse
                                                              • 194.221.96.177
                                                              https://vogelgormanplc-my.sharepoint.com/:o:/g/personal/mcook_vgllaw_com/EoWNEiRfVRJGgG47q5PYhKIBkV4CjNWUYZjZU9msILDe-Q?e=5%3akZcnSr&at=9&xsdata=MDV8MDJ8bWljaGFlbC5tY2d1aXJlQHhjZWxlbmVyZ3kuY29tfDMwN2U0MjVlMmE1MTQwYjJkYjg1MDhkYzliOTRmMTNhfDI0YjJhNTgzNWMwNTRiNmFiNGU5NGUxMmRjMDAyNWFkfDB8MHw2Mzg1NTYzMTEyNDIyMTkzODh8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=dWtMc0lWaVl3YitOcHQ2VURyZ0hXdUMxNk9mMFJEY3JRc3Rob3U2emVDYz0%3dGet hashmaliciousHTMLPhisherBrowse
                                                              • 2.23.209.42
                                                              https://vogelgormanplc-my.sharepoint.com/:o:/g/personal/mcook_vgllaw_com/EoWNEiRfVRJGgG47q5PYhKIBkV4CjNWUYZjZU9msILDe-Q?e=5%3akZcnSr&at=9&xsdata=MDV8MDJ8bWljaGFlbC5tY2d1aXJlQHhjZWxlbmVyZ3kuY29tfDMwN2U0MjVlMmE1MTQwYjJkYjg1MDhkYzliOTRmMTNhfDI0YjJhNTgzNWMwNTRiNmFiNGU5NGUxMmRjMDAyNWFkfDB8MHw2Mzg1NTYzMTEyNDIyMTkzODh8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpXSWpvaU1DNHdMakF3TURBaUxDSlFJam9pVjJsdU16SWlMQ0pCVGlJNklrMWhhV3dpTENKWFZDSTZNbjA9fDB8fHw%3d&sdata=dWtMc0lWaVl3YitOcHQ2VURyZ0hXdUMxNk9mMFJEY3JRc3Rob3U2emVDYz0%3dGet hashmaliciousHTMLPhisherBrowse
                                                              • 2.23.209.24
                                                              MICROSOFT-CORP-MSN-AS-BLOCKUSfile.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 94.245.104.56
                                                              UlVCqlQ0lF.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 13.107.21.200
                                                              arm7-20240707-0306.elfGet hashmaliciousMiraiBrowse
                                                              • 23.100.229.141
                                                              arm5-20240707-0306.elfGet hashmaliciousMiraiBrowse
                                                              • 20.98.156.81
                                                              file.exeGet hashmaliciousAmadey, Mars Stealer, Stealc, VidarBrowse
                                                              • 13.107.21.200
                                                              https://anp.ab9.mywebsitetransfer.com/eddGet hashmaliciousUnknownBrowse
                                                              • 20.8.91.96
                                                              https://41619ec8e8407cbea965833e1fb35e027cd895bdef33c8d4bb7a06d460.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                              • 13.107.246.60
                                                              https://f4dfc3a6ab223a609ab2682120fd9f431b51dcff8df1312719112d196d.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                              • 13.107.246.60
                                                              https://islandhouse-470927714.phsafarilodge.co.zm/Get hashmaliciousUnknownBrowse
                                                              • 13.107.246.60
                                                              FASTLYUSFax-ScannerDaiichi-sankyo.htmGet hashmaliciousHTMLPhisherBrowse
                                                              • 104.244.43.131
                                                              http://sectocarewl.online/mona-michelle/Get hashmaliciousUnknownBrowse
                                                              • 199.232.196.193
                                                              http://ipfs.io/ipfs/bafkreig67laqctkbcpqgnju77gx73en5q3sbc3lxzw7kpoxxfdodcctjaaGet hashmaliciousHTMLPhisherBrowse
                                                              • 151.101.130.137
                                                              http://dev-005454452441.pantheonsite.io/Get hashmaliciousUnknownBrowse
                                                              • 23.185.0.1
                                                              https://18b03de5-136a-42be-b26e-3fcb7fc3a767-00-39mzoh574apng.spock.replit.dev/english.htmlGet hashmaliciousUnknownBrowse
                                                              • 151.101.2.137
                                                              https://kainat-zia.github.io/NetflixGet hashmaliciousUnknownBrowse
                                                              • 185.199.110.153
                                                              https://itssachindey.github.io/Video-53-Project-1-Get hashmaliciousUnknownBrowse
                                                              • 185.199.108.153
                                                              https://ralphs-sublime-site-7b219a.webflow.io/Get hashmaliciousUnknownBrowse
                                                              • 151.101.2.188
                                                              http://best-practice-and-impact.github.io/govcookiecutter/Get hashmaliciousUnknownBrowse
                                                              • 185.199.108.153

                                                              JA3 Fingerprints

                                                              ⊘No context

                                                              Dropped Files

                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exehttp://wavebrowser.coGet hashmaliciousUnknownBrowse
                                                                Wave Browser.exeGet hashmaliciousUnknownBrowse
                                                                  https://www.googleadservices.com/pagead/aclk?sa=L&ai=CEPSIY7k7Zpu1AY3rkPIP8q21mAvP_pi8d4PY85XiEsq6jPG-ARABIPT5xiVgyeaGi7ykoBqgAcCz_YIDyAEC4AIAqAMByAMIqgSdAk_QZfhjp8EKKRw8Ud-sac3T3jbhfjxjJ1sRhgU3SOjAuI5huqeTvemsIazylmO5A9WU45_edGutcUqL46MvuNtxU89a64S7xhljcSlyUs-dysnWLJ2j0jUpH_gKnco9owTuaX1dg-lH7IYSpQI3MKj-Dr00v1SC_8ZhuzoINVR1E2pcblzJpyD5_udwujRkOY3Fao0Lt8Mai9Sq-EbJfdXMijbwOeNV94FwcwlSMZ7he13IkHy_a1HexFAPvo5qqjQXKG7VuYCajYpF3q5URq0loIuDY5WXWNc5RPV77yzvPDM2ytOukuK76vBmfoFdcFIyWUc5xZIVsm9dr8SzjJNE1z63RwDOkXHpq4VxrPcl1gRfUlqaUGyYeMbOoMAEp9WvltcE4AQBiAWQgcDhTpAGAaAGAoAHqMyCfYgHAZAHAqgH2baxAqgH1ckbqAemvhuoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwHSCCcIABACGB0yAQA6Dp_QgICAgASAwICAgKAoSL39wTpYjsuajM3-hQOxCUbAF_v0mAHVgAoDmAsByAsBqg0CVVPIDQHiDRMIlf2ajM3-hQMVjTVECB3yVg2z2BMM0BUB-BYBgBcBshgJEgLeaBgCIgEA6BgB&ae=1&gclid=Cj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB&num=1&cid=CAQSQwB7FLtqgUEuOym-5Tn68arUiPJ1jdwPgw46Y6zUHfAkI3hTIEhGQzVeYafsm9LBj6pxutwTRiLFJPhCq9OvYdD7CqQYAQ&sig=AOD64_2G4fRbd2sH1E5jnf1iXQS4SW_Q2g&client=ca-pub-6396844742497208&rf=5&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=2&adurl=https://browsingwithwave.com/%3Fsrc%3Dd-aff16-cp21142438032%26ob%3Dobgcobedobem%26dvc%3Dc%26k%3D%26crt%3D695418066867%26adp%3D%26plc%3D%26tgt%3D%26sl%3D%26cpd%3D21142438032%26iid%3Dwav%26gclid%3DCj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcBGet hashmaliciousUnknownBrowse
                                                                    https://pdfeditwithwave.com/Get hashmaliciousUnknownBrowse
                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterComRegisterShell64.exehttp://wavebrowser.coGet hashmaliciousUnknownBrowse
                                                                        Wave Browser.exeGet hashmaliciousUnknownBrowse
                                                                          https://www.googleadservices.com/pagead/aclk?sa=L&ai=CEPSIY7k7Zpu1AY3rkPIP8q21mAvP_pi8d4PY85XiEsq6jPG-ARABIPT5xiVgyeaGi7ykoBqgAcCz_YIDyAEC4AIAqAMByAMIqgSdAk_QZfhjp8EKKRw8Ud-sac3T3jbhfjxjJ1sRhgU3SOjAuI5huqeTvemsIazylmO5A9WU45_edGutcUqL46MvuNtxU89a64S7xhljcSlyUs-dysnWLJ2j0jUpH_gKnco9owTuaX1dg-lH7IYSpQI3MKj-Dr00v1SC_8ZhuzoINVR1E2pcblzJpyD5_udwujRkOY3Fao0Lt8Mai9Sq-EbJfdXMijbwOeNV94FwcwlSMZ7he13IkHy_a1HexFAPvo5qqjQXKG7VuYCajYpF3q5URq0loIuDY5WXWNc5RPV77yzvPDM2ytOukuK76vBmfoFdcFIyWUc5xZIVsm9dr8SzjJNE1z63RwDOkXHpq4VxrPcl1gRfUlqaUGyYeMbOoMAEp9WvltcE4AQBiAWQgcDhTpAGAaAGAoAHqMyCfYgHAZAHAqgH2baxAqgH1ckbqAemvhuoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwHSCCcIABACGB0yAQA6Dp_QgICAgASAwICAgKAoSL39wTpYjsuajM3-hQOxCUbAF_v0mAHVgAoDmAsByAsBqg0CVVPIDQHiDRMIlf2ajM3-hQMVjTVECB3yVg2z2BMM0BUB-BYBgBcBshgJEgLeaBgCIgEA6BgB&ae=1&gclid=Cj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB&num=1&cid=CAQSQwB7FLtqgUEuOym-5Tn68arUiPJ1jdwPgw46Y6zUHfAkI3hTIEhGQzVeYafsm9LBj6pxutwTRiLFJPhCq9OvYdD7CqQYAQ&sig=AOD64_2G4fRbd2sH1E5jnf1iXQS4SW_Q2g&client=ca-pub-6396844742497208&rf=5&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=2&adurl=https://browsingwithwave.com/%3Fsrc%3Dd-aff16-cp21142438032%26ob%3Dobgcobedobem%26dvc%3Dc%26k%3D%26crt%3D695418066867%26adp%3D%26plc%3D%26tgt%3D%26sl%3D%26cpd%3D21142438032%26iid%3Dwav%26gclid%3DCj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcBGet hashmaliciousUnknownBrowse
                                                                            https://pdfeditwithwave.com/Get hashmaliciousUnknownBrowse
                                                                              C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterBroker.exehttp://wavebrowser.coGet hashmaliciousUnknownBrowse
                                                                                Wave Browser.exeGet hashmaliciousUnknownBrowse
                                                                                  https://www.googleadservices.com/pagead/aclk?sa=L&ai=CEPSIY7k7Zpu1AY3rkPIP8q21mAvP_pi8d4PY85XiEsq6jPG-ARABIPT5xiVgyeaGi7ykoBqgAcCz_YIDyAEC4AIAqAMByAMIqgSdAk_QZfhjp8EKKRw8Ud-sac3T3jbhfjxjJ1sRhgU3SOjAuI5huqeTvemsIazylmO5A9WU45_edGutcUqL46MvuNtxU89a64S7xhljcSlyUs-dysnWLJ2j0jUpH_gKnco9owTuaX1dg-lH7IYSpQI3MKj-Dr00v1SC_8ZhuzoINVR1E2pcblzJpyD5_udwujRkOY3Fao0Lt8Mai9Sq-EbJfdXMijbwOeNV94FwcwlSMZ7he13IkHy_a1HexFAPvo5qqjQXKG7VuYCajYpF3q5URq0loIuDY5WXWNc5RPV77yzvPDM2ytOukuK76vBmfoFdcFIyWUc5xZIVsm9dr8SzjJNE1z63RwDOkXHpq4VxrPcl1gRfUlqaUGyYeMbOoMAEp9WvltcE4AQBiAWQgcDhTpAGAaAGAoAHqMyCfYgHAZAHAqgH2baxAqgH1ckbqAemvhuoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwHSCCcIABACGB0yAQA6Dp_QgICAgASAwICAgKAoSL39wTpYjsuajM3-hQOxCUbAF_v0mAHVgAoDmAsByAsBqg0CVVPIDQHiDRMIlf2ajM3-hQMVjTVECB3yVg2z2BMM0BUB-BYBgBcBshgJEgLeaBgCIgEA6BgB&ae=1&gclid=Cj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB&num=1&cid=CAQSQwB7FLtqgUEuOym-5Tn68arUiPJ1jdwPgw46Y6zUHfAkI3hTIEhGQzVeYafsm9LBj6pxutwTRiLFJPhCq9OvYdD7CqQYAQ&sig=AOD64_2G4fRbd2sH1E5jnf1iXQS4SW_Q2g&client=ca-pub-6396844742497208&rf=5&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=2&adurl=https://browsingwithwave.com/%3Fsrc%3Dd-aff16-cp21142438032%26ob%3Dobgcobedobem%26dvc%3Dc%26k%3D%26crt%3D695418066867%26adp%3D%26plc%3D%26tgt%3D%26sl%3D%26cpd%3D21142438032%26iid%3Dwav%26gclid%3DCj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcBGet hashmaliciousUnknownBrowse
                                                                                    https://pdfeditwithwave.com/Get hashmaliciousUnknownBrowse

                                                                                      Created / dropped Files

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):111000
                                                                                      Entropy (8bit):6.520895887440003
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:VPY5KTfLLX8YrWqY7/pTXb77Kxl4uZiT9XZwoDfrYeR48qy6peTUnZuh6o7YmzUY:a17KmbkGVkT7wuT76B+jXM
                                                                                      MD5:57428456C6E6C2EA328C864681DB5DF3
                                                                                      SHA1:2DC7329E0B346C435B6EA5CF44A3D0A076F8D398
                                                                                      SHA-256:EE87747102EBA8844939352740D0BB6C4A67F10C2656961CB2722CD42BA99F40
                                                                                      SHA-512:40FB34FCE07F094FDAF78C499A21C3F534F0C8AE1246B6CF382EA7E63FA08B4DE56E6C81EB8FADCE8A2E508AE5D03831590A06FFDA3D46026FB894E4997F31B0
                                                                                      Malicious:true
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                      Joe Sandbox View:
                                                                                      • Filename: , Detection: malicious, Browse
                                                                                      • Filename: Wave Browser.exe, Detection: malicious, Browse
                                                                                      • Filename: , Detection: malicious, Browse
                                                                                      • Filename: , Detection: malicious, Browse
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z^+..0x..0x..0x.s3y..0x.s5yK.0x.s4y..0x?k5y..0x?k4y..0x?k3y..0xpj5y..0x.s1y..0x..1x..0xzj9y..0xzj.x..0x...x..0xzj2y..0xRich..0x........PE..L....W.e.................*...f.......x.......@....@.......................................@.................................\a..x....p...5...............)......T...l]..T...................x^.......]..@............`..X............................text....(.......*.................. ..`.data...`....@......................@....idata..2....`.......8..............@..@.rsrc....5...p...6...B..............@..@.reloc..T............x..............@..B................................................................................................................................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterBroker.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):100256
                                                                                      Entropy (8bit):6.47039848214214
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:E6YCLNYEz/lQe0mWfY3WCuch7HW7DxVymB+FgStZZy:E6YaVZWCuchrmB+7tZ
                                                                                      MD5:558A3FA51457575EA29F9B041729EE8B
                                                                                      SHA1:7196875CE5B68F088E19FE4B7CC07BEC29CDA038
                                                                                      SHA-256:74BD216198FF11F08542473AAA7E5A619B50574E344BA8E8CA2C19FF497BF284
                                                                                      SHA-512:A0AFC3650879D6DF55ABE2CA461631BFA53E78376F1A702D42869026CAAE035982E22DF938D48D7DC42D6482237DB614A06DF067E2D3F89CDB2B915CDA9ED5C2
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Joe Sandbox View:
                                                                                      • Filename: , Detection: malicious, Browse
                                                                                      • Filename: Wave Browser.exe, Detection: malicious, Browse
                                                                                      • Filename: , Detection: malicious, Browse
                                                                                      • Filename: , Detection: malicious, Browse
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f4.="U.n"U.n"U.ny=.o(U.ny=.o.U.ny=.o0U.n.%.o.U.n.%.o3U.n.%.o3U.ny=.o'U.n"U.nqU.n.$.o#U.n.$hn#U.n"U.n#U.n.$.o#U.nRich"U.n........PE..L....W.e..........................................@.......................................@.................................,$..<....P..82...........^...)..........l...T...............................@............................................text............................... ..`.rdata..PZ.......\..................@..@.data........0......................@....rsrc...82...P...4..................@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterComRegisterShell64.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):195488
                                                                                      Entropy (8bit):6.2260860920108145
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:eS2deX2FXRPBKKZGNfGWlLYaYmzG3woY466OunZXgftB+FL:eSGmuXRpKKZsHRfoh9Xg1B+
                                                                                      MD5:10B82DC9D9A29BC4AF224981F0E1C6FE
                                                                                      SHA1:BC33B2EEAC62916EB9EE93A3F1ED6A0EB7611187
                                                                                      SHA-256:00CD644354032257A39FF710DDD03E9FB98348F5323DEC31CA670C903D68274C
                                                                                      SHA-512:A3C67A858CE7889506572E2448B5D1E936C6D6ADA2A04736B1F6CFE12B9AE46E9EE8C925778CDA273DB54000854F1EC4A544BCF2255770B978C7C6E9E24A1664
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Joe Sandbox View:
                                                                                      • Filename: , Detection: malicious, Browse
                                                                                      • Filename: Wave Browser.exe, Detection: malicious, Browse
                                                                                      • Filename: , Detection: malicious, Browse
                                                                                      • Filename: , Detection: malicious, Browse
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..)..)..)..r.."..r.......}.....;.....#....+.......r..=..r..0..)......(.....(..).x.(....(..Rich)..................PE..d....W.e.........."......T..........pP.........@.............................P.......]....`..................................................u..x.......82...............)...@.......[..T................... ]..(....[..0............p...............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....2...........j..............@....pdata...............x..............@..@_RDATA..............................@..@.rsrc...82.......4..................@..@.reloc.......@......................@..B................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterCore.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):213400
                                                                                      Entropy (8bit):6.657427399858563
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:Ndfq66ESD1t4cn4MJ9TuIJ2MalazAOJvKy7x+paPo9:ffq66ESD1t4cnH9TuIJ2CTKUx+UPo9
                                                                                      MD5:D40BD627BFB2BA39C5452A71A450EABD
                                                                                      SHA1:A0441DC20102FA71225F4F61675537D0549D5353
                                                                                      SHA-256:8AF504DDA28DA0896CB0E17273878D285D8CC1F912D304B21A49940FB577A0A5
                                                                                      SHA-512:434A8F5154A509BDA70EF7AF58E0029BA3AD9DA0E3803F9975609CAE65A1FDC0449D3A8D110A6928E9E621C7EA203CA98D96618C1DDE3DEE3A8110E806C05499
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..#...#...#..K...#..K..g#..:S..#..:S...#..:S...#..uR...#..K...#..K...#...#..F"...R...#...Rb..#...R...#..Rich.#..........PE..L....W.e.....................p......t.............@..........................p......P.....@.............................................82...............)...@... ..L...T...................X...........@............................................text...w........................... ..`.rdata..^...........................@..@.data....&..........................@....rsrc...82.......4..................@..@.reloc... ...@..."..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterOnDemand.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):100256
                                                                                      Entropy (8bit):6.470568162079437
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:A6wCLNYEz/lQe0mWfY3WCuchkHW7DxXymB+Fg9tZI:A6waVZWCuchgmB+ktZ
                                                                                      MD5:29B0571D015318EDB1C292AEA8011179
                                                                                      SHA1:E3A8019B41AE73F2AA213C10337BB42783F5B5ED
                                                                                      SHA-256:CEA433E8FEA8DCF1705016545ABD150A2891291AE122A776CD66DDB802A17587
                                                                                      SHA-512:8CA55FC8E86B0F147AB3B358009B294780030137710E356E405EA3F7D48276E4387E83BC479D72BF068196D6D33C0B5524528B52FD145BA1E8161073AEA62951
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f4.="U.n"U.n"U.ny=.o(U.ny=.o.U.ny=.o0U.n.%.o.U.n.%.o3U.n.%.o3U.ny=.o'U.n"U.nqU.n.$.o#U.n.$hn#U.n"U.n#U.n.$.o#U.nRich"U.n........PE..L....W.e..........................................@.................................x.....@.................................,$..<....P..82...........^...)..........l...T...............................@............................................text............................... ..`.rdata..PZ.......\..................@..@.data........0......................@....rsrc...82...P...4..................@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdaterSetup.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):815792
                                                                                      Entropy (8bit):7.870521754028661
                                                                                      Encrypted:false
                                                                                      SSDEEP:24576:f/RUhtSWUeNXoCPxjyJVhGi4vGuOg9ajduJd/WDj0:3RUhoK/9ecwjd6d/sI
                                                                                      MD5:18693249F3A283E83B8179E692FFBBA9
                                                                                      SHA1:546C0D89F8C8096D22C6F6BE7E843CF5CE08E220
                                                                                      SHA-256:3D828BCCCC628E7096856337B178DA5608A6C3DB99383374E6C49D50A1895E64
                                                                                      SHA-512:1AB246FEA99DAF75831F26930D458A05FF0EFD5F9C71C9C4396681A065FCF9F5C04AF774DF34AD55E140B71D41E42254EE2D9DABBB18009800BDFC62170A8C39
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+..Y+..Y+..Yp..X!..Yp..X...Yp..X9..Y..X...Y..X:..Y..X9..Y...X)..Y...X-..Yp..X&..Y+..Y\..Y...Y*..Y+.aY*..Y...X*..YRich+..Y................PE..L....W.e.................R.......... P.......p....@..................................X....@.................................H...x........@...........&...L...`..........T...........................@...@............p...............................text....Q.......R.................. ..`.rdata...p...p...r...V..............@..@.data...............................@....rsrc....@.......B..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psmachine.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):266136
                                                                                      Entropy (8bit):6.522279893817846
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:v+CRkUPava9DnekVeBl1CpWdbPirjuFIu0AO0sSKKBaQYphh:v+CR/Pava1ekVeBl1CpWdbwuFI7iJKXL
                                                                                      MD5:B10F0939BCE18AD24102C03769DDAB9B
                                                                                      SHA1:99B7CC45792F6CE7E270755E46A39F90D949C583
                                                                                      SHA-256:442AF0A1A403E17B5E5676CB49973D9E3AE067CFE9EFB8B669BF413F7B5A2E1D
                                                                                      SHA-512:2F7462160D0ADAA84E4996CAD27BB43A656D991BD8D8957C9AE3161BEF4CECCF1923D27B59FE69A8ACE048D9B663196EF44E7A7AEB52E9B93B560E10A3069121
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^._............A.......A...........P...........................A.......A...................+.....................d.............Rich....................PE..L....W.e...........!......................... ...............................@............@..........................>......@?...........g...............).......,..D/..T...................P0......./..@............ ..p............................text...$........................... ..`.orpc...c........................... ..`.rdata...2... ...4..................@..@.data....1...`.......8..............@....rsrc....g.......h...P..............@..@.reloc...,..........................@..B........................................................................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psmachine_64.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):331672
                                                                                      Entropy (8bit):6.12969104077321
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:CQOXiJFpBh12cITHjyXB6iohh3h0FKJ0ASaQYB:CJXSSpaXB9ogKvLT
                                                                                      MD5:19E105E099B7653CF60FF5783EC59453
                                                                                      SHA1:9D5AD1FBA3C03CE4C3841EF41F776B45CA9160D4
                                                                                      SHA-256:7E05780AFFFB2834EC4E2E1D67C9031616C13394CCFEB3A3C678415F19BA1104
                                                                                      SHA-512:E065358E22FEC9D2D323E7ACDCF3C4C81A629F4580E068F9B078CC414F2DC5B53912596CAB2CB40D5247A4746ACAFF2572445596F534940959E0B3E87E43AA13
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........T..T..T....._...............D....^.....V.....B.....O..T........e.....U......U..T.z.U.....U..RichT..........................PE..d....W.e.........." .....r..........L!.......................................`............`.........................................@....................g.......".......)...@..,.......T.......................(...p...0............................................text....n.......p.................. ..`.orpc...$............t.............. ..`.rdata..J............v..............@..@.data...\L...@...&..................@....pdata...".......$...@..............@..@_RDATA...............d..............@..@.rsrc....g.......h...f..............@..@.reloc..,....@......................@..B................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psuser.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):266136
                                                                                      Entropy (8bit):6.522220247860862
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:P+CRkUPava9DnekVeBl1CpWdbPirjuFIn0AOPTSK6BaQYphib:P+CR/Pava1ekVeBl1CpWdbwuFI0ZuKH+
                                                                                      MD5:71DD0ABC865C9D8873E93478707A16D8
                                                                                      SHA1:6CC5C855B93E455C92FC15853A7AC219F62A3B3E
                                                                                      SHA-256:A0439F5455EF696B70A230AB76C15F4BC3D7571AD4FBC32FDA95247789AA5822
                                                                                      SHA-512:9C5CDF72684A6FBF9FC4194F26208A7E5B877BE8EAF1F5A334B3691F7CC281C7F134421592A920F4F3A3F45C1287D04A95631411BF2BBB189E137D1D1D143A22
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^._............A.......A...........P...........................A.......A...................+.....................d.............Rich....................PE..L....W.e...........!......................... ...............................@............@..........................>......<?...........g...............).......,..D/..T...................P0......./..@............ ..p............................text...$........................... ..`.orpc...c........................... ..`.rdata...2... ...4..................@..@.data....1...`.......8..............@....rsrc....g.......h...P..............@..@.reloc...,..........................@..B........................................................................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\psuser_64.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):331672
                                                                                      Entropy (8bit):6.1295498236184365
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:NQOXiJVRBh12cITHjyXBMiohK3SrFKpNAQaQYK:NJXSKpaXBHozKzAh4
                                                                                      MD5:3D08BFC845A13602E942F839E75BE233
                                                                                      SHA1:7C8CBEEFFB2139E83214F9E66D01EACAE35F5BE0
                                                                                      SHA-256:2992995FE9FBB5B0FF1DA5F081F2AABD32CA276EDE41889B4E457E6CBCF21EFD
                                                                                      SHA-512:7A2D2B1AFAD039F37FC9F7CAA819181E710CF60F1348C129B5AF7ABCE3307DB653F69485D6200B947BCB42B4DE406441587867AD61B48110407E265817B212FE
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........T..T..T....._...............D....^.....V.....B.....O..T........e.....U......U..T.z.U.....U..RichT..........................PE..d....W.e.........." .....r..........L!.......................................`......\.....`.........................................@....................g.......".......)...@..,.......T.......................(...p...0............................................text....n.......p.................. ..`.orpc...$............t.............. ..`.rdata..B............v..............@..@.data...\L...@...&..................@....pdata...".......$...@..............@..@_RDATA...............d..............@..@.rsrc....g.......h...f..............@..@.reloc..,....@......................@..B................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\swupdater.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):1065888
                                                                                      Entropy (8bit):6.787215824096434
                                                                                      Encrypted:false
                                                                                      SSDEEP:24576:JXHn+3BSeyntPUjvkKtj190Lm3IEVYWoke8kNCFTYTnCqTukWL+jYGijK6:Q3BSfdUjvkKtj1h4ERoCFTqCqTDWL+tN
                                                                                      MD5:D388D67A1861F9D0CC4F6EDFA97861B4
                                                                                      SHA1:CA82FDB6FF39FE0B157100D1C8EEC48B73C34791
                                                                                      SHA-256:B21F99F14B4CCC78C5E01C269A8EBA83AE0C5912B46D8C1554F329A1076A7617
                                                                                      SHA-512:71879D3DD7B1B0B169E3C80FD88FF6F656778AF85462363202C4F28AE57B547EE569E5B43F55D0446CFBED736C32FA249BA91A5C34E8D9363295BE86B1D5A3D3
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......J..a...2...2...2U.3...2U.3...2U.3...2U.3..2?.@2...2...3C..2...3...2...3...2...3...2U.3...2U.3%..2...2P..2...3$..2...3...2..B2...2..*2...2...3...2Rich...2........PE..L....W.e...........!.........~.......3.......................................p.......F....@..........................T..T....T...........................)......|...d<..T...................p=.......<..@............................................text.............................. ..`.rdata..............................@..@.data...pX.......2...|..............@....rsrc...............................@..@.reloc..|...........................@..B................................................................................................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\swupdaterres_en.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):43416
                                                                                      Entropy (8bit):4.605896231361162
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:bvaagyWk9RsIYixpYSSmGbAM+o/8E9VF0NyvVgx:7aagyW49YiI4eAMxkE8x
                                                                                      MD5:35FD9F0A8FD4A41EBECAB887715A3FFD
                                                                                      SHA1:03CE4A819FB75E4C5E756FBE73F8A63B885B0624
                                                                                      SHA-256:A535EF96BCBE7F6953FB6D7194540716DF495BD7CF25E902DDDB6756561189BC
                                                                                      SHA-512:E6DB60D25DE13F5F452FD249AC2F6CDDD0958A2830404A2144154EE0E1023CF5CBFF3E58831383B14C9950DCF7C4B4B784D15E972B44808F8D02870A44D62D14
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#@..#@..#@..SD..#@..KA..#@..#A..#@.\RI..#@.\R@..#@.\R...#@.\RB..#@.Rich.#@.........................PE..L....W.e...........!.........z......p........ ............................................@.............................E....0..(....@...q...............)...... .......T...........................`...@............0...............................text............................... ..`.data...$.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Program Files (x86)\Wavesor\Temp\GUTF7C7.tmp

                                                                                      Download File
                                                                                      Process:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      File Type:POSIX tar archive (GNU)
                                                                                      Category:dropped
                                                                                      Size (bytes):3041280
                                                                                      Entropy (8bit):6.590088242785281
                                                                                      Encrypted:false
                                                                                      SSDEEP:49152:LKwFuU3BSfdUjvkKtj1h4ERoCFTqCqTDWL+tiGHz203I2pP4vIRtVedKdoXVaRpJ:LKwFDTXtj1z2CFTOtiez2MI2SvIRtVeZ
                                                                                      MD5:B6D46D944861F24875477D0254C2BE49
                                                                                      SHA1:4265A519EB496E8623C4FA28B6D1AAFBFE9D9FF3
                                                                                      SHA-256:CA23AC07590DED405CE7B3EE28A61D351D8E3AB92921E8F2DB02CE7FA6395320
                                                                                      SHA-512:0D5F6B930F97842B8492493564B08D41727431459797CD2DC1B075943522080E3A12E3FB255D81C58E25EC02217337823B4253B8A129859AC8C72499B3112E94
                                                                                      Malicious:false
                                                                                      Preview:SWUpdater.exe.......................................................................................0000777.0000000.0000000.00000330630.14500653725.011610. 0....................................................................................................ustar .................................................................0000000.0000000........................................................................................................................................................................MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z^+..0x..0x..0x.s3y..0x.s5yK.0x.s4y..0x?k5y..0x?k4y..0x?k3y..0xpj5y..0x.s1y..0x..1x..0xzj9y..0xzj.x..0x...x..0xzj2y..0xRich..0x........PE..L....W.e.................*...f.......x.......@....@.......................................@.................................\a..x....p...5...............)......T...l]..T...................x^.......]..@............`..X...

                                                                                      C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                      Category:dropped
                                                                                      Size (bytes):4286
                                                                                      Entropy (8bit):3.8046022951415335
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
                                                                                      MD5:DA597791BE3B6E732F0BC8B20E38EE62
                                                                                      SHA1:1125C45D285C360542027D7554A5C442288974DE
                                                                                      SHA-256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
                                                                                      SHA-512:D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
                                                                                      Malicious:false
                                                                                      Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0057d959-6bdb-445f-868b-f22e7ee60a28.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):60373
                                                                                      Entropy (8bit):6.079253008328437
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:iMSzMtXija+4YyOBsK22DUkV91j5OvBV0mkzkcHyGgLx:iMSuij7GOCK22AkVKf5kz3m
                                                                                      MD5:F03FBBB9BEE37DD8AC0A2C6CD72ECA4A
                                                                                      SHA1:965C2827996A5668F6918516430667D8AB29F65C
                                                                                      SHA-256:5D1D655C0813204871D8B8A4B5D81FDEBE5C2BDD354A1F4E3885EB98209E5967
                                                                                      SHA-512:8318077455D2A41D7F7DE5DDE50758053193F9C719BE0CA1EAD5500F43BFA2A3C6DD97CECC659395566845D9B1B137E3576D07B25151A5DA5402AB65BC7E7965
                                                                                      Malicious:false
                                                                                      Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13364816069218291","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1325ae8c-4ef5-4256-b83b-775b1ca692dd.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):60334
                                                                                      Entropy (8bit):6.0792618059785335
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:iMSzMtXija+FYyOBsK22DUkV91j5OvBV0mkzkcHyGgLx:iMSuij7xOCK22AkVKf5kz3m
                                                                                      MD5:48F6D4D6524B9E3C6FC7E50C56ADE697
                                                                                      SHA1:9B1A11E3A0138F38322CD1914506D7EB1785D4C8
                                                                                      SHA-256:97D616F587488AFEC86AB4953573A27727CC964ADB24D60075810E4F7DE3CBEE
                                                                                      SHA-512:D733420D1D7EB697C5545959FEE4A5CD7EE3F1781FB08C3861BD78A614F2E712EAA0EE38422C6CE99CD4F9BE7BD024C97BB0A8E4A5DA7A133710B1ADECB631C9
                                                                                      Malicious:false
                                                                                      Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13364816069218291","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\18ff81bc-2183-46c3-9fc8-de6b23eb36d5.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):60373
                                                                                      Entropy (8bit):6.079253008328437
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:iMSzMtXija+4YyOBsK22DUkV91j5OvBV0mkzkcHyGgLx:iMSuij7GOCK22AkVKf5kz3m
                                                                                      MD5:F03FBBB9BEE37DD8AC0A2C6CD72ECA4A
                                                                                      SHA1:965C2827996A5668F6918516430667D8AB29F65C
                                                                                      SHA-256:5D1D655C0813204871D8B8A4B5D81FDEBE5C2BDD354A1F4E3885EB98209E5967
                                                                                      SHA-512:8318077455D2A41D7F7DE5DDE50758053193F9C719BE0CA1EAD5500F43BFA2A3C6DD97CECC659395566845D9B1B137E3576D07B25151A5DA5402AB65BC7E7965
                                                                                      Malicious:false
                                                                                      Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13364816069218291","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2b27562c-9bf9-4cc1-872d-f470c5535537.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):24186
                                                                                      Entropy (8bit):6.064101114353223
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:76tM7XKnG7EtlXrFJOg5+VCKP4gW5CiUMzcBhcsNwCYNYfDHyWNNWRIFRWX4nL6x:iM7X2zt1jOXtXi3zahcnNYfDHyWNN2Ou
                                                                                      MD5:55006B7FAB7E04356B92AB3C41EFBE5E
                                                                                      SHA1:34CE176B6B0022797D0F33A9A3EFA4A69CD13A0C
                                                                                      SHA-256:342CBDBCA08FE6FAE874CAB323A188AB0DC2EDE4507E9075278565EA907A03EE
                                                                                      SHA-512:5727B9157BCF8FC9F4A27DC2C412EED273F9A5B0EEF6BFEA2906B9D3B51EAA0B6F0713EFF497343B88A44A6F6906BE7E180F73BA574959AC0401EDD661BACD89
                                                                                      Malicious:false
                                                                                      Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13364816069218291","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2c533bfc-9b8f-4729-9b02-ce4915000222.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):8251
                                                                                      Entropy (8bit):5.803367847255263
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:fsNAr02leiRUI7jbkfLW6qRAq1k8SPxVLZ7VTiQ:fsNAjPnYfS6q3QxVNZTiQ
                                                                                      MD5:4A2F9864710B8B3CFA55DFC81C27D15C
                                                                                      SHA1:E598817ED1FC809149CEE34652B7883A23F39F11
                                                                                      SHA-256:B0AF816F711A4EE325411EAF24D4366ABE42E1694B693348E924EA17E7BC82F5
                                                                                      SHA-512:2FFFDB453E23075F48658F9BA1CAFEFA69104F2F3DD757559941C3FB45E206A65228C65C9B31D4C041DB56692DCA0C704F981E8EEB5B3C931DFBD1AEE83A56DD
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2f708062-9cf7-459e-9c9c-a6aecdc0c71f.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):60334
                                                                                      Entropy (8bit):6.079252573987691
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:iMSzMtXija+FYIOBsK22DUkV91j5OvBV0mkzkcHyGgLx:iMSuij7LOCK22AkVKf5kz3m
                                                                                      MD5:AED0EEA9ABE6E3267F59880A282B5B94
                                                                                      SHA1:B1E238E5352E6F1356FF9B27C2EEB22FEBB06494
                                                                                      SHA-256:587A5769DB11ED9A609AA011374DEEF1464A67A716ECAAD185515BBA33F1EEAC
                                                                                      SHA-512:2ECEDB431C6FECDEF1F27F44A429E3236453463554E16FDF6BB87F818027EF977F32858A32CF81A483BE553EE6AC9A27575B45E4CAEB77A930C0966EB670FEEC
                                                                                      Malicious:false
                                                                                      Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13364816069218291","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3a8f2127-a5da-48fe-8258-6154fc7af093.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\43c51e5f-9346-4b8b-93ac-11cb212474af.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):8333
                                                                                      Entropy (8bit):5.7971280674755805
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:fsNwr02leiRUn7jbkfLW6qRAq1k8SPxVLZ7VTiQ:fsNwjanYfS6q3QxVNZTiQ
                                                                                      MD5:C1F98734988B03D25ECF3B44A50FE631
                                                                                      SHA1:9674B3921F460E389D532CA92A1BAC3B9D242B68
                                                                                      SHA-256:29FDAA11C3D954655CB1B4478E02A772F40FC6FA2CADBA1D0B5668A5DFAA21A1
                                                                                      SHA-512:6F54563076BCE6AEC111F61A29F15AC4B2AC230B40894A78BFF8CD5385C97B88789806F91FB23D40BEA42E2AB7CBF67EE3D3DA25E85DBFAE3B1359AB7349EA03
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\48f5eae8-dfcb-4dea-9ac9-925cc769d9e5.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):25228
                                                                                      Entropy (8bit):6.063146900268504
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:iM7X2zt1jOXtXi3zahcnocftUHyWNN2OWk6Tm:iMSzMtXija+FUHyGgLa
                                                                                      MD5:DB7EB8B7E674498B0104415C8A07F06B
                                                                                      SHA1:A03A835FB59BEC9DA4CA8B040EC0AB5EE2F59F89
                                                                                      SHA-256:DCEC9AB83C21062FB41208D11A19CBF9FC76BE5E4DA08FA3C9868096511186F6
                                                                                      SHA-512:E6885CB0B183288D76375AC33AAC71ACADC628B69A7F1A4A712516C05B43500106F21F46E6B2362A81DF65227025B4FD8D4387FBE388D42B9ACBACBCE3141D28
                                                                                      Malicious:false
                                                                                      Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13364816069218291","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5dda3585-7182-4801-92c8-ba397f615f39.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:modified
                                                                                      Size (bytes):25228
                                                                                      Entropy (8bit):6.063146900268504
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:iM7X2zt1jOXtXi3zahcnocftUHyWNN2OWk6Tm:iMSzMtXija+FUHyGgLa
                                                                                      MD5:DB7EB8B7E674498B0104415C8A07F06B
                                                                                      SHA1:A03A835FB59BEC9DA4CA8B040EC0AB5EE2F59F89
                                                                                      SHA-256:DCEC9AB83C21062FB41208D11A19CBF9FC76BE5E4DA08FA3C9868096511186F6
                                                                                      SHA-512:E6885CB0B183288D76375AC33AAC71ACADC628B69A7F1A4A712516C05B43500106F21F46E6B2362A81DF65227025B4FD8D4387FBE388D42B9ACBACBCE3141D28
                                                                                      Malicious:false
                                                                                      Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13364816069218291","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\30bb371a-1477-4f92-a574-6c425c48437a.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):107893
                                                                                      Entropy (8bit):4.640151608055479
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
                                                                                      MD5:3AE014B030BB845E97DA6156100482CF
                                                                                      SHA1:BE802FB3E0ED5F8B0B98804631F577A9B17C223A
                                                                                      SHA-256:7C044F2C2DF1D380724E025D35EC9044C551CBDF24472C7165FF37DA60EEAD1D
                                                                                      SHA-512:43472397831783CBAE349D7A93EF02F5CE8E055909C39B74F7C1A16F425F6DBEA32C9AA7393C3D2906728625EA13708247D78ADF33ECE19BBD4031C3BCD95349
                                                                                      Malicious:false
                                                                                      Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):107893
                                                                                      Entropy (8bit):4.640151608055479
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
                                                                                      MD5:3AE014B030BB845E97DA6156100482CF
                                                                                      SHA1:BE802FB3E0ED5F8B0B98804631F577A9B17C223A
                                                                                      SHA-256:7C044F2C2DF1D380724E025D35EC9044C551CBDF24472C7165FF37DA60EEAD1D
                                                                                      SHA-512:43472397831783CBAE349D7A93EF02F5CE8E055909C39B74F7C1A16F425F6DBEA32C9AA7393C3D2906728625EA13708247D78ADF33ECE19BBD4031C3BCD95349
                                                                                      Malicious:false
                                                                                      Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):4194304
                                                                                      Entropy (8bit):0.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3::
                                                                                      MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                      SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                      SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                      SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):4194304
                                                                                      Entropy (8bit):0.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3::
                                                                                      MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                      SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                      SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                      SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-668A57C3-1FBC.pma

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):4194304
                                                                                      Entropy (8bit):0.03965729293543012
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:wG01utmqvDzKX7UaJ8iD12absbZHtgbXsFhxULHhJfNEl/9GRQMYfHn8y08Tcm2D:B0EtYlWCphlgo8fH08T2RGOD
                                                                                      MD5:89A6C6B43CD0358172AF9DB25082319E
                                                                                      SHA1:0A4A5883E1C97F2F5835D8513CEAD3E642E4A167
                                                                                      SHA-256:708F4FCA63F369F8778E3320FBA28672E6FE1B6DA19718D832229C02293811BD
                                                                                      SHA-512:F403A1CFD196B397A297B486124B3FCF1AC620E06761BE399C86F698AB75621E04F839A169984905680994F17633384287EF60697C49952E8F8BAF1BB416EA70
                                                                                      Malicious:false
                                                                                      Preview:...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....m.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".tkhhwb20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U...&..`v.>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-668A57C4-1B4C.pma

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):4194304
                                                                                      Entropy (8bit):0.36900120636086137
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:k5uxRo+7XTeOO8wK5YyMiLTirpk0VuW1hiaclQTxqSsGebbSFfQgi/b+srJEwiQD:9oKfC9uW1hGNd9EVSaHM9FgaIk
                                                                                      MD5:438730BAB718678FAEFF1152526958F9
                                                                                      SHA1:D3954F34727390F3ABFF569E5745BCF79870286A
                                                                                      SHA-256:1C3FEEA1C2AFA5E814ADD72DFF11ABD399C84C6CCF37418A17119272D46E2D3E
                                                                                      SHA-512:AB91E3BBDF45B478D6AEDBB5DC6F18CED5868C835D43A5D89F19EB9B9DD19CEE888AE9B9D7E9CC7131D5EE2F61755A862481AB10003786DF22C7CCF202970F79
                                                                                      Malicious:false
                                                                                      Preview:...@..@...@.....C.].....@...............X7...6..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".tkhhwb20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...b.J.^o..J...#...^o..J....k..^o..J..?....^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J....%.^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J.......^o..J...'x#.^o..J......^o..J....\.^o.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-668A57D4-23C0.pma

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):4194304
                                                                                      Entropy (8bit):0.0407200281689405
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:9N0EbtmqvDtKX7uJEa3XxxTxqZ/g+XT970R6Eqh57NaT921gQ8LdSMn8y08Tcm2D:/0EtBeK8YWFhxeSgndt08T2RGOD
                                                                                      MD5:980D937C4B27E21C2467EA69EA6FAED3
                                                                                      SHA1:7F5AAF1772B909F10903ADB3125798E090BF44DD
                                                                                      SHA-256:09B603888CDC7CC820952DC7FED5558B0F95C67E6A8150E8F4121B0DB2B6D96A
                                                                                      SHA-512:B2BB88BC80510FBEBA6B708C7334B9D43EB1F80D18A76C2699977777C62094530B468185BCB5236BB9A877560191EF5A192A4D0BED7D5463D8641A31462C9B1D
                                                                                      Malicious:false
                                                                                      Preview:...@..@...@.....C.].....@................b...Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".tkhhwb20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-668A57DC-1FE0.pma

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):4194304
                                                                                      Entropy (8bit):0.03989839197408464
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:W+0EbtmqvD3KX7CJEa3Xxx7uqZGXPtg34N+hHBNE6nI1gQMDko8In8y08Tcm2RGY:z0EtXe18xFhhxggHke08T2RGOD
                                                                                      MD5:C474C24288C0B75C4218280C06470485
                                                                                      SHA1:936CCDE72F8B2F52B7256C1BDEB44E134396F875
                                                                                      SHA-256:F53D96247B88A5F9ADE34A7A00D2783A669D3862E2B24E5264D62EC9C57CF45A
                                                                                      SHA-512:5FB7D75A21341F1D941778641F367FA20AAB0F69AB94D7EEF5136F0C47F5832895214FC8AE707B809CA25F86DE1F7C4ED88E546DFF85D5043912CCFE2154FEBD
                                                                                      Malicious:false
                                                                                      Preview:...@..@...@.....C.].....@................`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".tkhhwb20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.3553968406659012
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
                                                                                      MD5:CFAB81B800EDABACBF6CB61AA78D5258
                                                                                      SHA1:2730D4DA1BE7238D701DC84EB708A064B8D1CF27
                                                                                      SHA-256:452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
                                                                                      SHA-512:EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
                                                                                      Malicious:false
                                                                                      Preview:...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):280
                                                                                      Entropy (8bit):3.060980776278344
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
                                                                                      MD5:74B32A83C9311607EB525C6E23854EE0
                                                                                      SHA1:C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
                                                                                      SHA-256:06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
                                                                                      SHA-512:ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
                                                                                      Malicious:false
                                                                                      Preview:sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0fa400c5-7099-4f2d-996d-54505ed8ef59.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):9332
                                                                                      Entropy (8bit):5.178649804581472
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:sVol/JT0iADXPtL9oqYlsYPpj+FVAZNFBf:sVol/JT0FDXFL9o1pUVoJ
                                                                                      MD5:E029BD505C3DE0CA3C38E30038404CFB
                                                                                      SHA1:5C8C4004D03458258D1907A968577E3194A95E5E
                                                                                      SHA-256:BADEA44AFD3BAC8C8A8894AF413EA5553AE460C595DBC46496D203662A549829
                                                                                      SHA-512:0F372F5772FF66F048AEE40EAE748C9BD743D79310C07398E26119E30B614BA184AF5129D22C6BD98AD324E072C9AD04DB4000C07B298587C0F37F60889372B8
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1d92e567-b5d5-45ad-a1c3-85e71caf2adb.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:very short file (no magic)
                                                                                      Category:dropped
                                                                                      Size (bytes):1
                                                                                      Entropy (8bit):0.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:L:L
                                                                                      MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                      SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                      SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                      SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                      Malicious:false
                                                                                      Preview:.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2cec0147-95f1-43da-850b-51ac4b206032.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):28366
                                                                                      Entropy (8bit):5.557433709377644
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:aRZHEN7pLGLhtsWPqUfkD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAxCDKrw/pqtu+:aRZHE7chtsWPqUfkDu1jaVgDvMtp
                                                                                      MD5:8234CDAFA6E8ED6E4446BC6454327C5D
                                                                                      SHA1:8338DDDB1E7F1ADF58BE90159E32769B4DD2702F
                                                                                      SHA-256:5898BD847F0547A85E2DDEE10174A4B6E47F15E02630732BF5A745A995612796
                                                                                      SHA-512:851A2E3B336C2B45B96A8512346C48545A362C0969318CC421EAFDCF8D2E6276E9912D18FBE4049337FEEBB510FF11E10A628D9B7EFEBE6E70BD903DA8AE4377
                                                                                      Malicious:false
                                                                                      Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13364816068715002","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13364816068715002","location":5,"ma

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\37adbec2-4092-4280-b0c4-5bc595f7a980.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):30210
                                                                                      Entropy (8bit):5.565369530848969
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:aRZHEN7pLGLhtsWPqUfLD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQyfxCDKrwWpqtH:aRZHE7chtsWPqUfLDu1ja1yfgDvztH
                                                                                      MD5:184D02EBF5CF98C3FC8B384EED706D52
                                                                                      SHA1:90D2843EEE88B87FE6CF1309D579580569E8447B
                                                                                      SHA-256:DEA30A93EA61E4C29CF3712C5129E2B66C8436706F38B7BC4953413F381896F5
                                                                                      SHA-512:729B7EEC13A91C1880FC370DC8AEA9F71B63F0534D25DBD52C33081F38763B124FEF2B895389160B5466975F43A8CE9A9FEEBAB01B8143112522582E2AF33B62
                                                                                      Malicious:false
                                                                                      Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13364816068715002","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13364816068715002","location":5,"ma

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6ec4b201-d49f-41c2-8c97-970c9cb0372b.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:very short file (no magic)
                                                                                      Category:dropped
                                                                                      Size (bytes):1
                                                                                      Entropy (8bit):0.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:L:L
                                                                                      MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                      SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                      SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                      SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                      Malicious:false
                                                                                      Preview:.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7c90ec08-4c0f-4f46-a899-63620321e481.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):9294
                                                                                      Entropy (8bit):5.17989366637406
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:sVol/JT0iADXPtL9oqYlsYPpj+FVAlNFBf:sVol/JT0FDXFL9o1pUVAJ
                                                                                      MD5:B14B841A4DA04A81D5DC6ADB262C5D83
                                                                                      SHA1:9F991AB22750E9A9BF616965CB0E26505E6BBCE0
                                                                                      SHA-256:81403C93D2482379DC2799BC3B824CBB8142CDED9781E99A33378A0E30E33C89
                                                                                      SHA-512:0A38741CE347BBE2FB68C280DE42A1FAD5FC791504CA53AD5DA8CC57114E6126515AF66BDDD1F0DCACCC5DFDE2B9CF0D81AC39F9138681011BDF63AFE97DF495
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\96083b2c-3d88-4a4b-a724-7c69b3582c18.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):7984
                                                                                      Entropy (8bit):4.922383761978736
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:sVolqlJyJ1AGb9Ys0NYlsY5Th6Cp9/x+6M8muecmAeCze4zvrN2X6gE5AtEHb:sVol/JT0NYlsYPpj+FVATNFBf
                                                                                      MD5:5380A4AF5A8D76001C403136BC382210
                                                                                      SHA1:EA692A4D14CAAEBD64F57F0EE7A13324D3100222
                                                                                      SHA-256:7B28DDE48D67CAB25CB1F248BB0145C1B0B0ECAC4C1520C98C22FF4F60B6167A
                                                                                      SHA-512:A4D85289A407C21661E0FD7D34D6145CFE72DA3CBE151907D810E0C662DA9370D4318C26FFC54ED0240E6735E3A9E9BF55F6AD16BB3A888BD280D39D147F9812
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:modified
                                                                                      Size (bytes):12600
                                                                                      Entropy (8bit):5.3217509411864174
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:lAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:+OEOKSXs/J7mGnQmLu5/5eNdl
                                                                                      MD5:9EFAFC08DB75E8BCF20888CE51BA87D6
                                                                                      SHA1:177973C232D783A34964C67A24A9B383DADEFE17
                                                                                      SHA-256:D6E6F64C8435F55F2B9934456DF075E1C4CE5AEF2EE5A37C25C574B8B615B071
                                                                                      SHA-512:E18691F50B494590B9AC3AB1FE5C21C34C0A370A5611056F72F7428115806DD4F40853E9D7EB091114D03DC4B713F00E6BC022FA292CF3BD3CE82AEC7C81B8F4
                                                                                      Malicious:false
                                                                                      Preview:...m.................DB_VERSION.1..J.................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13364816075232786.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):293
                                                                                      Entropy (8bit):5.077716573344413
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIPJB1wkn23oH+Tcwt9Eh1ZB2KLlrOSIPvQ+q2Pwkn23oH+Tcwt9Eh1tIFUv:E7RkfYeb9Eh1ZFLc7Q+vYfYeb9Eh16F2
                                                                                      MD5:1780FB0BEB5C5CC901F15D5E05730D71
                                                                                      SHA1:F336DF9A89384FE3B45628D5A5C22E0D426EE32B
                                                                                      SHA-256:B84990F4EB339DB26144ACD4E6027E5B1E0D4A24795B83060FCB4DA2DD9A4E6F
                                                                                      SHA-512:52FB8E2469DA73AC61EBDAD7FAED80DCA441924AC7BF3D459B12E580B8A8BCD41340A1428F75B67661861744753BDE4DDC8A3C7E3F4062C24D28C86EAF1CC792
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:34.147 214c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/07/07-04:54:34.203 214c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:OpenPGP Secret Key
                                                                                      Category:dropped
                                                                                      Size (bytes):41
                                                                                      Entropy (8bit):4.704993772857998
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                      Malicious:false
                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                      Category:dropped
                                                                                      Size (bytes):12288
                                                                                      Entropy (8bit):0.3202460253800455
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
                                                                                      MD5:40B18EC43DB334E7B3F6295C7626F28D
                                                                                      SHA1:0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
                                                                                      SHA-256:85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
                                                                                      SHA-512:8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.01057775872642915
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsFl:/F
                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                      Malicious:false
                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):270336
                                                                                      Entropy (8bit):8.280239615765425E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.011852361981932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsHlDll:/H
                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.012340643231932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsGl3ll:/y
                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):262512
                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:LsNl1dl/:Ls31dl/
                                                                                      MD5:5A8CA3FC8EBAB94E5E06FFA2F38A45C2
                                                                                      SHA1:F7E62534500D7225F5B681630946EF14859B599D
                                                                                      SHA-256:97C366862D21B032EF687D9E20043A21A950FFE8CD9B5A5CD9BA7A2CCC56671E
                                                                                      SHA-512:386F047403FDBCB73A6245BAA8F6E71F19D016713DC8AB5390F131125EC57FDAA4C0FE6920CD38FC8D072F9C5617C713D95C8DECB856759DE4379556896A7E1F
                                                                                      Malicious:false
                                                                                      Preview:..........................................I.:{/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):33
                                                                                      Entropy (8bit):3.5394429593752084
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:iWstvhYNrkUn:iptAd
                                                                                      MD5:F27314DD366903BBC6141EAE524B0FDE
                                                                                      SHA1:4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
                                                                                      SHA-256:68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
                                                                                      SHA-512:07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
                                                                                      Malicious:false
                                                                                      Preview:...m.................DB_VERSION.1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):305
                                                                                      Entropy (8bit):5.186647455782965
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIx74M1wkn23oH+TcwtnG2tbB2KLlrOSIFHpq2Pwkn23oH+TcwtnG2tMsIFUv:E7V4rfYebn9VFLc7dpvYfYebn9GFUv
                                                                                      MD5:34CA0A5D7DECA3F329C7F40FE2CF56EE
                                                                                      SHA1:C0BB27F97168E794AF4BB09840B0FB362B873106
                                                                                      SHA-256:513E07BCE7412B43718DA7C1B881D65677B29949B4CBD25FB571D8AE201AA390
                                                                                      SHA-512:10720A68BD47080A6BA25334DB669FAC434945B26B6E62DCB55DD7DFED1ACC7ADB6BAB2FFE67E943DD531A06F69FE3D020534264C2FE16F012CDEE8A711568BB
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:28.717 1e44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/07/07-04:54:29.043 1e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:OpenPGP Secret Key
                                                                                      Category:dropped
                                                                                      Size (bytes):41
                                                                                      Entropy (8bit):4.704993772857998
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                      Malicious:false
                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
                                                                                      Category:dropped
                                                                                      Size (bytes):32768
                                                                                      Entropy (8bit):0.494709561094235
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
                                                                                      MD5:CF7760533536E2AF66EA68BC3561B74D
                                                                                      SHA1:E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
                                                                                      SHA-256:E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
                                                                                      SHA-512:38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                                                      Category:dropped
                                                                                      Size (bytes):20480
                                                                                      Entropy (8bit):0.5094712832659277
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
                                                                                      MD5:D4971855DD087E30FC14DF1535B556B9
                                                                                      SHA1:9E00DEFC7E54C75163273184837B9D0263AA528C
                                                                                      SHA-256:EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
                                                                                      SHA-512:ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):209
                                                                                      Entropy (8bit):1.8784775129881184
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                      MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                      SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                      SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                      SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                      Malicious:false
                                                                                      Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):281
                                                                                      Entropy (8bit):5.185520193897598
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIxZUydFD1wkn23oH+Tcwt8aVdg2KLlrOSI/Q+q2Pwkn23oH+Tcwt8aPrqIFUv:E7tHyfYeb0Lc7/VvYfYebL3FUv
                                                                                      MD5:328E339E126EEBFD647B1A050D25AEFA
                                                                                      SHA1:CAF9DB3533FCFC0919618A13329893D233834E15
                                                                                      SHA-256:B52F19AA5D5AA57D4639F4DC0FFB7DD9CD7CB5C02BCD763F8B5A765DBB8DF204
                                                                                      SHA-512:5C8B0749B1E45BF577846D148E870EACFA4AA84FC47F39974C3F55348C8304262450E840C4F13A3B4EA2BA97EC7A60A39B30379F95F4FD57D686DC84DC28B539
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:28.726 17d8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/07/07-04:54:28.910 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:OpenPGP Secret Key
                                                                                      Category:dropped
                                                                                      Size (bytes):41
                                                                                      Entropy (8bit):4.704993772857998
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                      Malicious:false
                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):209
                                                                                      Entropy (8bit):1.8784775129881184
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                                                      MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                                                      SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                                                      SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                                                      SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                                                      Malicious:false
                                                                                      Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):285
                                                                                      Entropy (8bit):5.184548194480475
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSI/uD1wkn23oH+Tcwt86FB2KLlrOSIFVa+q2Pwkn23oH+Tcwt865IFUv:E7/uyfYeb/FFLc7f7vYfYeb/WFUv
                                                                                      MD5:2135AD5A77C0C86D59997A24D2CD4531
                                                                                      SHA1:E1A7E12B8404A68DC55B6ECF89F701986617C2E6
                                                                                      SHA-256:5DC29D901BABCB5A69D2C9E23D6CC28595E9BC7987492B53D506F7D962F1D084
                                                                                      SHA-512:F1C626901792825F4CD95B19439483A3B4D64531D9DA5FA804D374DB516D436101B223B0AF09046A14507EBD9A6C6C6221141A07F9418BBEDB48EABCB1350741
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:28.916 17d8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/07/07-04:54:29.122 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:OpenPGP Secret Key
                                                                                      Category:dropped
                                                                                      Size (bytes):41
                                                                                      Entropy (8bit):4.704993772857998
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                      Malicious:false
                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):1197
                                                                                      Entropy (8bit):1.8784775129881184
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                                                      MD5:A2A3B1383E3AAC2430F44FC7BF3E447E
                                                                                      SHA1:B807210A1205126A107A5FE25F070D2879407AA4
                                                                                      SHA-256:90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
                                                                                      SHA-512:396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
                                                                                      Malicious:false
                                                                                      Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):322
                                                                                      Entropy (8bit):5.182481826630664
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIFr4lL+q2Pwkn23oH+Tcwt8NIFUt84OSIF8K1Zmw+4OSIF8cLVkwOwkn23oHt:E7XvYfYebpFUt8176K1/+176s5JfYeb2
                                                                                      MD5:ECF4BD07F6BD08C45D13F7DCC426DFD3
                                                                                      SHA1:873F68AD263D767EDE53713E0D22EEB94338F0D3
                                                                                      SHA-256:D6A420929C3221C85F3EF5199362BFC108A2E6E475EAACBB13C654300D9E6EC8
                                                                                      SHA-512:9332043E4EE3B0E0D23E73774358B79CBDF1CB162DC3FC2A6E47E6DB5A1668215FC4C4BC69AC1AF42B313D01CB0B2D47BC755A727189DC09F257964ECAFBAB25
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.257 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/07/07-04:54:29.258 1e58 Recovering log #3.2024/07/07-04:54:29.258 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):322
                                                                                      Entropy (8bit):5.182481826630664
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIFr4lL+q2Pwkn23oH+Tcwt8NIFUt84OSIF8K1Zmw+4OSIF8cLVkwOwkn23oHt:E7XvYfYebpFUt8176K1/+176s5JfYeb2
                                                                                      MD5:ECF4BD07F6BD08C45D13F7DCC426DFD3
                                                                                      SHA1:873F68AD263D767EDE53713E0D22EEB94338F0D3
                                                                                      SHA-256:D6A420929C3221C85F3EF5199362BFC108A2E6E475EAACBB13C654300D9E6EC8
                                                                                      SHA-512:9332043E4EE3B0E0D23E73774358B79CBDF1CB162DC3FC2A6E47E6DB5A1668215FC4C4BC69AC1AF42B313D01CB0B2D47BC755A727189DC09F257964ECAFBAB25
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.257 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/07/07-04:54:29.258 1e58 Recovering log #3.2024/07/07-04:54:29.258 1e58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                      Category:dropped
                                                                                      Size (bytes):4096
                                                                                      Entropy (8bit):0.3169096321222068
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
                                                                                      MD5:2554AD7847B0D04963FDAE908DB81074
                                                                                      SHA1:F84ABD8D05D7B0DFB693485614ECF5204989B74A
                                                                                      SHA-256:F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
                                                                                      SHA-512:13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                      Category:dropped
                                                                                      Size (bytes):32768
                                                                                      Entropy (8bit):0.40981274649195937
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
                                                                                      MD5:1A7F642FD4F71A656BE75B26B2D9ED79
                                                                                      SHA1:51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
                                                                                      SHA-256:B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
                                                                                      SHA-512:FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):429
                                                                                      Entropy (8bit):5.809210454117189
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
                                                                                      MD5:5D1D9020CCEFD76CA661902E0C229087
                                                                                      SHA1:DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
                                                                                      SHA-256:B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
                                                                                      SHA-512:5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
                                                                                      Malicious:false
                                                                                      Preview:{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
                                                                                      Category:dropped
                                                                                      Size (bytes):159744
                                                                                      Entropy (8bit):0.5241404324800358
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
                                                                                      MD5:241322143A01979D346689D9448AC8C0
                                                                                      SHA1:DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
                                                                                      SHA-256:65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
                                                                                      SHA-512:9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8720
                                                                                      Entropy (8bit):0.3283577581710296
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:eYA/J3+t76Y4QZZofU99pO0BYhllaqR4EZY4QZvG8con:UhHQws9LdEljBQZG8Z
                                                                                      MD5:2DE92535563F968205B9D981146CA6B6
                                                                                      SHA1:34A0BBE88BF5667A86649938D2AEA33E42BE41C0
                                                                                      SHA-256:CCB930B7DCE3C69728517241DF4B6E5562399EA6BFF3E1558F8334541A6C1E1C
                                                                                      SHA-512:6D6AB88EDA2D093A47D049F814B28FC8B55F093EEA3BD4F58575F54194AFC950900B2CD421C5C9492411BF36B3597EBF130AF2249A6A48E207C22827EC89646E
                                                                                      Malicious:false
                                                                                      Preview:.................'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
                                                                                      Category:dropped
                                                                                      Size (bytes):28672
                                                                                      Entropy (8bit):0.33890226319329847
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
                                                                                      MD5:971F4C153D386AC7ED39363C31E854FC
                                                                                      SHA1:339841CA0088C9EABDE4AACC8567D2289CCB9544
                                                                                      SHA-256:B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
                                                                                      SHA-512:1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):406
                                                                                      Entropy (8bit):5.227379581889947
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:E76QvYfYeb8rcHEZrELFUt8176Rk/+176RE5JfYeb8rcHEZrEZSJ:EuiYfYeb8nZrExg81uxuYJfYeb8nZrE8
                                                                                      MD5:940F44017726A88D98B256BE7351B974
                                                                                      SHA1:559245308AEA6C7F886C1F66D86E9DDF95F92ADD
                                                                                      SHA-256:0F9779E4BD18B0B7A1F40408E7E8C4493B2F9F8D86CFD3ACF7074EA576B1E937
                                                                                      SHA-512:B4821B31F1A9A500720B72BEEDD4304E36CCD15BF30758F7B733839785099BE0BA0670B6F4FBC1479BF6DE66BBCE3CA82C615EE1032952D865E9C0AE70F7CA64
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:30.702 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/07/07-04:54:30.703 1d14 Recovering log #3.2024/07/07-04:54:30.703 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):406
                                                                                      Entropy (8bit):5.227379581889947
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:E76QvYfYeb8rcHEZrELFUt8176Rk/+176RE5JfYeb8rcHEZrEZSJ:EuiYfYeb8nZrExg81uxuYJfYeb8nZrE8
                                                                                      MD5:940F44017726A88D98B256BE7351B974
                                                                                      SHA1:559245308AEA6C7F886C1F66D86E9DDF95F92ADD
                                                                                      SHA-256:0F9779E4BD18B0B7A1F40408E7E8C4493B2F9F8D86CFD3ACF7074EA576B1E937
                                                                                      SHA-512:B4821B31F1A9A500720B72BEEDD4304E36CCD15BF30758F7B733839785099BE0BA0670B6F4FBC1479BF6DE66BBCE3CA82C615EE1032952D865E9C0AE70F7CA64
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:30.702 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/07/07-04:54:30.703 1d14 Recovering log #3.2024/07/07-04:54:30.703 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):331
                                                                                      Entropy (8bit):5.155136471520607
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIFT84N4q2Pwkn23oH+Tcwt8a2jMGIFUt84OSIF1Zmw+4OSIF2FkwOwkn23oHr:E7xOvYfYeb8EFUt8177/+17c5JfYeb8N
                                                                                      MD5:E09FB10AB329FE0664CAD9CDBADD70E1
                                                                                      SHA1:978415F0A54D4AE9E8A3C8D4FB80E73998E70CD9
                                                                                      SHA-256:8C13663E82F8A15A62AF65E2343F6BDADDAAC0AEB005FE23EC9DE1C628F64F84
                                                                                      SHA-512:6552205F6AF93EDB233768E607E550108846E9E4E0B4C83A894C51DC2D51E86E98E075B59DCB698F9CCFA5347C1A32D1EA95CDFACC011C7F4C16E4397B118988
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.947 ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/07/07-04:54:29.956 ca4 Recovering log #3.2024/07/07-04:54:29.964 ca4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):331
                                                                                      Entropy (8bit):5.155136471520607
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIFT84N4q2Pwkn23oH+Tcwt8a2jMGIFUt84OSIF1Zmw+4OSIF2FkwOwkn23oHr:E7xOvYfYeb8EFUt8177/+17c5JfYeb8N
                                                                                      MD5:E09FB10AB329FE0664CAD9CDBADD70E1
                                                                                      SHA1:978415F0A54D4AE9E8A3C8D4FB80E73998E70CD9
                                                                                      SHA-256:8C13663E82F8A15A62AF65E2343F6BDADDAAC0AEB005FE23EC9DE1C628F64F84
                                                                                      SHA-512:6552205F6AF93EDB233768E607E550108846E9E4E0B4C83A894C51DC2D51E86E98E075B59DCB698F9CCFA5347C1A32D1EA95CDFACC011C7F4C16E4397B118988
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.947 ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/07/07-04:54:29.956 ca4 Recovering log #3.2024/07/07-04:54:29.964 ca4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
                                                                                      Category:dropped
                                                                                      Size (bytes):57344
                                                                                      Entropy (8bit):0.863060653641558
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
                                                                                      MD5:C681C90B3AAD7F7E4AF8664DE16971DF
                                                                                      SHA1:9F72588CEA6569261291B19E06043A1EFC3653BC
                                                                                      SHA-256:ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
                                                                                      SHA-512:4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                      Category:dropped
                                                                                      Size (bytes):45056
                                                                                      Entropy (8bit):0.40293591932113104
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
                                                                                      MD5:ADC0CFB8A1A20DE2C4AB738B413CBEA4
                                                                                      SHA1:238EF489E5FDC6EBB36F09D415FB353350E7097B
                                                                                      SHA-256:7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
                                                                                      SHA-512:38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\01e14e5b-8ca5-4198-bafa-04ad1cc6d5b7.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):40
                                                                                      Entropy (8bit):4.1275671571169275
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                      MD5:20D4B8FA017A12A108C87F540836E250
                                                                                      SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                      SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                      SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                      Malicious:false
                                                                                      Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1f2ad2d2-0b07-4994-a894-4e24aea95f9c.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):188
                                                                                      Entropy (8bit):5.423404609678128
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
                                                                                      MD5:6833E2FEEACF2930174137246FC7E09F
                                                                                      SHA1:7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
                                                                                      SHA-256:839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
                                                                                      SHA-512:B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
                                                                                      Malicious:false
                                                                                      Preview:{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\511b9b14-979c-4ec3-bf33-b31ff9a31664.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                      Category:dropped
                                                                                      Size (bytes):20480
                                                                                      Entropy (8bit):0.6732424250451717
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):61
                                                                                      Entropy (8bit):3.926136109079379
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                      MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                      SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                      SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                      SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                      Malicious:false
                                                                                      Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF33db6.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):61
                                                                                      Entropy (8bit):3.926136109079379
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                      MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                      SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                      SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                      SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                      Malicious:false
                                                                                      Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF42e01.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):61
                                                                                      Entropy (8bit):3.926136109079379
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                      MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                      SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                      SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                      SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                      Malicious:false
                                                                                      Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                      Category:dropped
                                                                                      Size (bytes):36864
                                                                                      Entropy (8bit):0.555790634850688
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                      MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                      SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                      SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                      SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF31790.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF326e2.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):40
                                                                                      Entropy (8bit):4.1275671571169275
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                      MD5:20D4B8FA017A12A108C87F540836E250
                                                                                      SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                      SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                      SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                      Malicious:false
                                                                                      Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):203
                                                                                      Entropy (8bit):5.4042796420747425
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                      MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                      SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                      SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                      SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                      Malicious:false
                                                                                      Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF33db6.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):203
                                                                                      Entropy (8bit):5.4042796420747425
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                      MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                      SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                      SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                      SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                      Malicious:false
                                                                                      Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                      Category:dropped
                                                                                      Size (bytes):36864
                                                                                      Entropy (8bit):0.36515621748816035
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                      MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                      SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                      SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                      SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\acfc7149-82fb-4252-a264-1cc448b59f54.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca2a09ae-00d8-4476-a222-f5806ca175e8.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):111
                                                                                      Entropy (8bit):4.718418993774295
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                      MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                      SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                      SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                      SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                      Malicious:false
                                                                                      Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e280f749-f68b-41cb-8ce9-a331ce858619.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed6a5c36-d48f-4fba-b56d-0d4d2422d329.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):881
                                                                                      Entropy (8bit):5.314300084711889
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:YXsnZVMdBs/iZFRudFGcsKZFGJ/dbG7nby:YXsZ8s/WfcdsugzbZ
                                                                                      MD5:0773995A4C68BFCD91F62287AD2D2E01
                                                                                      SHA1:44C447EEDF436BD8497BAB6223C5CB6884276479
                                                                                      SHA-256:1EFC4640FCB4B146F343A05BD58BC2D6837EFBB72C939D7E7A0AA27AEFB0C843
                                                                                      SHA-512:544EE87305339B8F0F9151C8BE46AE9368002F3DC0480CC399C83815A9B8BE359460387C42B70443A5F9303DAC52C3A551EE0D88544420ABD703FD76A383ADEC
                                                                                      Malicious:false
                                                                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13367408071949889","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13367408073165064","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13367408079392484","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                      Category:dropped
                                                                                      Size (bytes):20480
                                                                                      Entropy (8bit):0.5877891092219624
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isRdjiG1dOfNS9K0xHZ7y:TLiOUOq0afDdWec9sJ1VI7J5fc
                                                                                      MD5:C5B844241F847FB9AC61F4A8E9206AC8
                                                                                      SHA1:B4F64969D3AA0EB1EC97AFA248785CE8D9B69274
                                                                                      SHA-256:01D60A02D87F7995E9D25F35D7C681447F5C3BA03102BCC2B67D0A2C7C0E5F63
                                                                                      SHA-512:CB4F66149937A69C7232358E3A978296BD408321185FD42C71CE5DFD7CADD5C89A734D72A4D837CA6FBC987B77EDEE919201E1A33CCABA926B553D411F233900
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):7984
                                                                                      Entropy (8bit):4.922383761978736
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:sVolqlJyJ1AGb9Ys0NYlsY5Th6Cp9/x+6M8muecmAeCze4zvrN2X6gE5AtEHb:sVol/JT0NYlsYPpj+FVATNFBf
                                                                                      MD5:5380A4AF5A8D76001C403136BC382210
                                                                                      SHA1:EA692A4D14CAAEBD64F57F0EE7A13324D3100222
                                                                                      SHA-256:7B28DDE48D67CAB25CB1F248BB0145C1B0B0ECAC4C1520C98C22FF4F60B6167A
                                                                                      SHA-512:A4D85289A407C21661E0FD7D34D6145CFE72DA3CBE151907D810E0C662DA9370D4318C26FFC54ED0240E6735E3A9E9BF55F6AD16BB3A888BD280D39D147F9812
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF352b5.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):7984
                                                                                      Entropy (8bit):4.922383761978736
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:sVolqlJyJ1AGb9Ys0NYlsY5Th6Cp9/x+6M8muecmAeCze4zvrN2X6gE5AtEHb:sVol/JT0NYlsYPpj+FVATNFBf
                                                                                      MD5:5380A4AF5A8D76001C403136BC382210
                                                                                      SHA1:EA692A4D14CAAEBD64F57F0EE7A13324D3100222
                                                                                      SHA-256:7B28DDE48D67CAB25CB1F248BB0145C1B0B0ECAC4C1520C98C22FF4F60B6167A
                                                                                      SHA-512:A4D85289A407C21661E0FD7D34D6145CFE72DA3CBE151907D810E0C662DA9370D4318C26FFC54ED0240E6735E3A9E9BF55F6AD16BB3A888BD280D39D147F9812
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF385cb.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):7984
                                                                                      Entropy (8bit):4.922383761978736
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:sVolqlJyJ1AGb9Ys0NYlsY5Th6Cp9/x+6M8muecmAeCze4zvrN2X6gE5AtEHb:sVol/JT0NYlsYPpj+FVATNFBf
                                                                                      MD5:5380A4AF5A8D76001C403136BC382210
                                                                                      SHA1:EA692A4D14CAAEBD64F57F0EE7A13324D3100222
                                                                                      SHA-256:7B28DDE48D67CAB25CB1F248BB0145C1B0B0ECAC4C1520C98C22FF4F60B6167A
                                                                                      SHA-512:A4D85289A407C21661E0FD7D34D6145CFE72DA3CBE151907D810E0C662DA9370D4318C26FFC54ED0240E6735E3A9E9BF55F6AD16BB3A888BD280D39D147F9812
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3be50.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):7984
                                                                                      Entropy (8bit):4.922383761978736
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:sVolqlJyJ1AGb9Ys0NYlsY5Th6Cp9/x+6M8muecmAeCze4zvrN2X6gE5AtEHb:sVol/JT0NYlsYPpj+FVATNFBf
                                                                                      MD5:5380A4AF5A8D76001C403136BC382210
                                                                                      SHA1:EA692A4D14CAAEBD64F57F0EE7A13324D3100222
                                                                                      SHA-256:7B28DDE48D67CAB25CB1F248BB0145C1B0B0ECAC4C1520C98C22FF4F60B6167A
                                                                                      SHA-512:A4D85289A407C21661E0FD7D34D6145CFE72DA3CBE151907D810E0C662DA9370D4318C26FFC54ED0240E6735E3A9E9BF55F6AD16BB3A888BD280D39D147F9812
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF41346.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):7984
                                                                                      Entropy (8bit):4.922383761978736
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:sVolqlJyJ1AGb9Ys0NYlsY5Th6Cp9/x+6M8muecmAeCze4zvrN2X6gE5AtEHb:sVol/JT0NYlsYPpj+FVATNFBf
                                                                                      MD5:5380A4AF5A8D76001C403136BC382210
                                                                                      SHA1:EA692A4D14CAAEBD64F57F0EE7A13324D3100222
                                                                                      SHA-256:7B28DDE48D67CAB25CB1F248BB0145C1B0B0ECAC4C1520C98C22FF4F60B6167A
                                                                                      SHA-512:A4D85289A407C21661E0FD7D34D6145CFE72DA3CBE151907D810E0C662DA9370D4318C26FFC54ED0240E6735E3A9E9BF55F6AD16BB3A888BD280D39D147F9812
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):33
                                                                                      Entropy (8bit):4.051821770808046
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:YVXADAEvTLSJ:Y9AcEvHSJ
                                                                                      MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                                                                      SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                                                                      SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                                                                      SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                                                                      Malicious:false
                                                                                      Preview:{"preferred_apps":[],"version":1}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):28366
                                                                                      Entropy (8bit):5.557433709377644
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:aRZHEN7pLGLhtsWPqUfkD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAxCDKrw/pqtu+:aRZHE7chtsWPqUfkDu1jaVgDvMtp
                                                                                      MD5:8234CDAFA6E8ED6E4446BC6454327C5D
                                                                                      SHA1:8338DDDB1E7F1ADF58BE90159E32769B4DD2702F
                                                                                      SHA-256:5898BD847F0547A85E2DDEE10174A4B6E47F15E02630732BF5A745A995612796
                                                                                      SHA-512:851A2E3B336C2B45B96A8512346C48545A362C0969318CC421EAFDCF8D2E6276E9912D18FBE4049337FEEBB510FF11E10A628D9B7EFEBE6E70BD903DA8AE4377
                                                                                      Malicious:false
                                                                                      Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13364816068715002","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13364816068715002","location":5,"ma

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF36af0.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):28366
                                                                                      Entropy (8bit):5.557433709377644
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:aRZHEN7pLGLhtsWPqUfkD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAxCDKrw/pqtu+:aRZHE7chtsWPqUfkDu1jaVgDvMtp
                                                                                      MD5:8234CDAFA6E8ED6E4446BC6454327C5D
                                                                                      SHA1:8338DDDB1E7F1ADF58BE90159E32769B4DD2702F
                                                                                      SHA-256:5898BD847F0547A85E2DDEE10174A4B6E47F15E02630732BF5A745A995612796
                                                                                      SHA-512:851A2E3B336C2B45B96A8512346C48545A362C0969318CC421EAFDCF8D2E6276E9912D18FBE4049337FEEBB510FF11E10A628D9B7EFEBE6E70BD903DA8AE4377
                                                                                      Malicious:false
                                                                                      Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13364816068715002","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13364816068715002","location":5,"ma

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):232
                                                                                      Entropy (8bit):2.7061121767675385
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
                                                                                      MD5:8A30A1FDD0459D9EA8B1E78A8E636856
                                                                                      SHA1:9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
                                                                                      SHA-256:88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
                                                                                      SHA-512:B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
                                                                                      Malicious:false
                                                                                      Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):322
                                                                                      Entropy (8bit):5.188691419669236
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIjX9+q2Pwkn23oH+TcwtrQMxIFUt84OSIjX+rZmw+4OSIjQFe73VkwOwkn23X:E7jX4vYfYebCFUt817jX+r/+17jD5Jfn
                                                                                      MD5:AA7C5BAF9C8E7C3469531E5C057DAEA3
                                                                                      SHA1:DC437F99D482EF48A373B79E0F9AEAEAEC97AD98
                                                                                      SHA-256:A12E25048806ED740A31D1BFA58CD91103BEEEC9E9C95A3F6D046DDB03FAC51A
                                                                                      SHA-512:89588029F73512A1AECDE0A7FF7E8903597D15BDD901C03D548388D365DEA2A84DB2A37B8DAF243F8DBBEDD5D6E1504B1138BD055DDEAC96C919D80A051B8FA7
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:45.625 1b48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/07/07-04:54:45.628 1b48 Recovering log #3.2024/07/07-04:54:45.632 1b48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):322
                                                                                      Entropy (8bit):5.188691419669236
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIjX9+q2Pwkn23oH+TcwtrQMxIFUt84OSIjX+rZmw+4OSIjQFe73VkwOwkn23X:E7jX4vYfYebCFUt817jX+r/+17jD5Jfn
                                                                                      MD5:AA7C5BAF9C8E7C3469531E5C057DAEA3
                                                                                      SHA1:DC437F99D482EF48A373B79E0F9AEAEAEC97AD98
                                                                                      SHA-256:A12E25048806ED740A31D1BFA58CD91103BEEEC9E9C95A3F6D046DDB03FAC51A
                                                                                      SHA-512:89588029F73512A1AECDE0A7FF7E8903597D15BDD901C03D548388D365DEA2A84DB2A37B8DAF243F8DBBEDD5D6E1504B1138BD055DDEAC96C919D80A051B8FA7
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:45.625 1b48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/07/07-04:54:45.628 1b48 Recovering log #3.2024/07/07-04:54:45.632 1b48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):350
                                                                                      Entropy (8bit):5.159484866169311
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIxa+q2Pwkn23oH+Tcwt7Uh2ghZIFUt84OSIxeZmw+4OSIxzLRNVkwOwkn23oz:E7RvYfYebIhHh2FUt817M/+171LRz5J8
                                                                                      MD5:AFE3289302A48E65088226D396921F6D
                                                                                      SHA1:D34A1FD13B45F7443790CF958F4BB52007F6A9F0
                                                                                      SHA-256:7E9E56FA25F745BA1FFD50934104544FEF4B78ACD9DB7D921659149210D8188B
                                                                                      SHA-512:79645CC4C4125837778591B8401F2A7173C75FA00F2A8701A6F1A91DE85E2C7EA4D106310A9A42C3490DB2630FCEDAE648AB3E32CB682DA7F797D3E56EF4FB8D
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:28.723 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/07/07-04:54:28.723 17d8 Recovering log #3.2024/07/07-04:54:28.724 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):350
                                                                                      Entropy (8bit):5.159484866169311
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIxa+q2Pwkn23oH+Tcwt7Uh2ghZIFUt84OSIxeZmw+4OSIxzLRNVkwOwkn23oz:E7RvYfYebIhHh2FUt817M/+171LRz5J8
                                                                                      MD5:AFE3289302A48E65088226D396921F6D
                                                                                      SHA1:D34A1FD13B45F7443790CF958F4BB52007F6A9F0
                                                                                      SHA-256:7E9E56FA25F745BA1FFD50934104544FEF4B78ACD9DB7D921659149210D8188B
                                                                                      SHA-512:79645CC4C4125837778591B8401F2A7173C75FA00F2A8701A6F1A91DE85E2C7EA4D106310A9A42C3490DB2630FCEDAE648AB3E32CB682DA7F797D3E56EF4FB8D
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:28.723 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/07/07-04:54:28.723 17d8 Recovering log #3.2024/07/07-04:54:28.724 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.01057775872642915
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsFl:/F
                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                      Malicious:false
                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):270336
                                                                                      Entropy (8bit):8.280239615765425E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.011852361981932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsHlDll:/H
                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.012340643231932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsGl3ll:/y
                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):524656
                                                                                      Entropy (8bit):5.027445846313988E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:LsulsXll/:LsTl/
                                                                                      MD5:65F41A3DCBCBF93E127A8D5111B3B258
                                                                                      SHA1:9245B2380226FB708889EE9ED8FB44F7676902D2
                                                                                      SHA-256:0CE14C2762FC0DC94859728E1C3FDD9D9DEBBC7F232CE06469EB367F7AC80678
                                                                                      SHA-512:157AEF498502667A9B3B863E1A23D2225CFC6EE5CF2973CB6417531A0BFE17E9BF72ED4263714137C2643D7C2A9627C3276C5107290B8D0680851F523B238695
                                                                                      Malicious:false
                                                                                      Preview:........................................!...:{/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.01057775872642915
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsFl:/F
                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                      Malicious:false
                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):270336
                                                                                      Entropy (8bit):0.0012471779557650352
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                      MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                      SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                      SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                      SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.011852361981932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsHlDll:/H
                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.012340643231932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsGl3ll:/y
                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):262512
                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:LsNlKual/:Ls35al/
                                                                                      MD5:73FB226A38930F7890CAEE6F9DECD75D
                                                                                      SHA1:6CD82ED63ED11A161C8FE88FD62F38454D88AB0D
                                                                                      SHA-256:7917DB006CD1EE9E5ABFB7030754E9CDF7A8D142AC81505BBEB5A22192AE43DF
                                                                                      SHA-512:5C4466AEB5D659FEB550E532B29050104F870312A2E9E29463C01F1FC77E94644EF1DACF3B6667BD0468A8CCA4ABA15580153FD748048012960A5DF38891F3B9
                                                                                      Malicious:false
                                                                                      Preview:........................................_.K.:{/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):270336
                                                                                      Entropy (8bit):0.0012471779557650352
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                      MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                      SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                      SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                      SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):432
                                                                                      Entropy (8bit):5.273623567473763
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:E7YvYfYebvqBQFUt817E/+17qF5JfYebvqBvJ:EuYfYebvZg81n8JfYebvk
                                                                                      MD5:E24F98F73BFDE59CA6101D3F0F9FC279
                                                                                      SHA1:F24148D685F02CDCC130D6F5CB51189CC7DE09A3
                                                                                      SHA-256:DEED850CFF2F4E11C35779E5079A0663518CCDC9E4FE33B3F9E633CB52CCA1C2
                                                                                      SHA-512:5D1C9239B93E71A5091B3C91B3C5797F12BFDBE3A2EA00C2D07CDF65D7B83467259160F126FBCDA6E4ABE293FF26C68780F6A2A1DFB052EB7CA2490FE857045A
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.951 1b48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/07/07-04:54:29.952 1b48 Recovering log #3.2024/07/07-04:54:29.954 1b48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):432
                                                                                      Entropy (8bit):5.273623567473763
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:E7YvYfYebvqBQFUt817E/+17qF5JfYebvqBvJ:EuYfYebvZg81n8JfYebvk
                                                                                      MD5:E24F98F73BFDE59CA6101D3F0F9FC279
                                                                                      SHA1:F24148D685F02CDCC130D6F5CB51189CC7DE09A3
                                                                                      SHA-256:DEED850CFF2F4E11C35779E5079A0663518CCDC9E4FE33B3F9E633CB52CCA1C2
                                                                                      SHA-512:5D1C9239B93E71A5091B3C91B3C5797F12BFDBE3A2EA00C2D07CDF65D7B83467259160F126FBCDA6E4ABE293FF26C68780F6A2A1DFB052EB7CA2490FE857045A
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.951 1b48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/07/07-04:54:29.952 1b48 Recovering log #3.2024/07/07-04:54:29.954 1b48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\70956514-812a-46bf-b2e3-94a29de7d042.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7b113aac-d3a7-42ce-8fed-8cfa8f393c51.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):111
                                                                                      Entropy (8bit):4.718418993774295
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                                                      MD5:285252A2F6327D41EAB203DC2F402C67
                                                                                      SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                                                      SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                                                      SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                                                      Malicious:false
                                                                                      Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\901a3559-303e-4860-a2b2-f7d22cec1ff3.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):193
                                                                                      Entropy (8bit):4.864047146590611
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                      MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                      SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                      SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                      SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                      Malicious:false
                                                                                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF42e01.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):193
                                                                                      Entropy (8bit):4.864047146590611
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                      MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                      SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                      SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                      SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                      Malicious:false
                                                                                      Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                      Category:dropped
                                                                                      Size (bytes):36864
                                                                                      Entropy (8bit):0.555790634850688
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                      MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                      SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                      SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                      SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF326e2.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2
                                                                                      Entropy (8bit):1.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:H:H
                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                      Malicious:false
                                                                                      Preview:[]

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):40
                                                                                      Entropy (8bit):4.1275671571169275
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                      MD5:20D4B8FA017A12A108C87F540836E250
                                                                                      SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                      SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                      SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                      Malicious:false
                                                                                      Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                      Category:dropped
                                                                                      Size (bytes):36864
                                                                                      Entropy (8bit):0.36515621748816035
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                      MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                      SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                      SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                      SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c61ede9f-75e6-4857-b901-a7fd89ef1988.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):40
                                                                                      Entropy (8bit):4.1275671571169275
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                      MD5:20D4B8FA017A12A108C87F540836E250
                                                                                      SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                      SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                      SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                      Malicious:false
                                                                                      Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):80
                                                                                      Entropy (8bit):3.4921535629071894
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                                                      MD5:69449520FD9C139C534E2970342C6BD8
                                                                                      SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                                                      SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                                                      SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                                                      Malicious:false
                                                                                      Preview:*...#................version.1..namespace-..&f.................&f...............

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):417
                                                                                      Entropy (8bit):5.229731931904041
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:E7jXPvYfYebvqBZFUt817jX/4X/+17jk5JfYebvqBaJ:EP3YfYebvyg81P/TGJfYebvL
                                                                                      MD5:63099F71CA39D9E905788DD03A5DD266
                                                                                      SHA1:B30869D868D6FD081EE60C4CEFA07C713AB55AE1
                                                                                      SHA-256:F8BF1F27DDB96FB78AC1E36C31B7C2C7D9F5CB0BB512349537A5864426D6A38E
                                                                                      SHA-512:D6D1B5F73479242B616CA7A8CDDE3CFA377170727B193D47BE000CFFBC42FA37E55F3BDA9B3B5E0691B4F146E10C745F65FDFA3751F925093E6F1D63486AEA97
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:45.627 ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/07/07-04:54:45.629 ca4 Recovering log #3.2024/07/07-04:54:45.636 ca4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):417
                                                                                      Entropy (8bit):5.229731931904041
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:E7jXPvYfYebvqBZFUt817jX/4X/+17jk5JfYebvqBaJ:EP3YfYebvyg81P/TGJfYebvL
                                                                                      MD5:63099F71CA39D9E905788DD03A5DD266
                                                                                      SHA1:B30869D868D6FD081EE60C4CEFA07C713AB55AE1
                                                                                      SHA-256:F8BF1F27DDB96FB78AC1E36C31B7C2C7D9F5CB0BB512349537A5864426D6A38E
                                                                                      SHA-512:D6D1B5F73479242B616CA7A8CDDE3CFA377170727B193D47BE000CFFBC42FA37E55F3BDA9B3B5E0691B4F146E10C745F65FDFA3751F925093E6F1D63486AEA97
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:45.627 ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/07/07-04:54:45.629 ca4 Recovering log #3.2024/07/07-04:54:45.636 ca4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):326
                                                                                      Entropy (8bit):5.173782991284394
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIFBzhIq2Pwkn23oH+TcwtpIFUt84OSIFBzhZZmw+4OSIFBzhzkwOwkn23oH+v:E7SvYfYebmFUt817b/+17x5JfYebaUJ
                                                                                      MD5:391F18C322590054E669C8F63D8527CC
                                                                                      SHA1:E6640640259D9B9D72A7A8FBD19327A5978827BA
                                                                                      SHA-256:72F89AC3AA11601C22E66C22E8EEDF8C485EC03CD991472689943E830B57E18C
                                                                                      SHA-512:A532E0463A6F45B2D3B12BF0632A4790D7A19AF95C6A33C0257B98656C329BEC2A686039C17D62C8459C5D1C68A3DE59457695BD2050E80270CFF1B832F9A2A0
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.027 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/07/07-04:54:29.027 1e54 Recovering log #3.2024/07/07-04:54:29.027 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):326
                                                                                      Entropy (8bit):5.173782991284394
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIFBzhIq2Pwkn23oH+TcwtpIFUt84OSIFBzhZZmw+4OSIFBzhzkwOwkn23oH+v:E7SvYfYebmFUt817b/+17x5JfYebaUJ
                                                                                      MD5:391F18C322590054E669C8F63D8527CC
                                                                                      SHA1:E6640640259D9B9D72A7A8FBD19327A5978827BA
                                                                                      SHA-256:72F89AC3AA11601C22E66C22E8EEDF8C485EC03CD991472689943E830B57E18C
                                                                                      SHA-512:A532E0463A6F45B2D3B12BF0632A4790D7A19AF95C6A33C0257B98656C329BEC2A686039C17D62C8459C5D1C68A3DE59457695BD2050E80270CFF1B832F9A2A0
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.027 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/07/07-04:54:29.027 1e54 Recovering log #3.2024/07/07-04:54:29.027 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                                                                                      Category:dropped
                                                                                      Size (bytes):28672
                                                                                      Entropy (8bit):0.26707851465859517
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
                                                                                      MD5:04F8B790DF73BD7CD01238F4681C3F44
                                                                                      SHA1:DF12D0A21935FC01B36A24BF72AB9640FEBB2077
                                                                                      SHA-256:96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
                                                                                      SHA-512:0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
                                                                                      Category:dropped
                                                                                      Size (bytes):180224
                                                                                      Entropy (8bit):0.9237410161604507
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
                                                                                      MD5:C97C2FBAAEA45BB3C728D02689216CB2
                                                                                      SHA1:CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
                                                                                      SHA-256:DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
                                                                                      SHA-512:5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):2568
                                                                                      Entropy (8bit):0.06569804787746028
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:9Kl1lhtl3:k3H
                                                                                      MD5:A4618F27E8A320196488748B0CCDFBD2
                                                                                      SHA1:D5EE3F5B7F272DD929EF4971A1BCEE999C9EC87A
                                                                                      SHA-256:1CF97F454DDC68C3C9F0456CB705F5917703CF9959AE4A3D756407797F91CA44
                                                                                      SHA-512:ADC34C2C4E828E9C28D49E88F4149F21394F7723DAE5A27FF2ABFEFFC312AD555DAD6103E81F5A1ABA0A7F1AD65F235019EE571F9BFB14D4827C8608F48C821B
                                                                                      Malicious:false
                                                                                      Preview:............).....W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):11755
                                                                                      Entropy (8bit):5.190465908239046
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                                                      MD5:07301A857C41B5854E6F84CA00B81EA0
                                                                                      SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                                                      SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                                                      SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                                                      Malicious:false
                                                                                      Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\caf88036-6493-46ff-89df-c12efa6861d6.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):9222
                                                                                      Entropy (8bit):5.180143911014393
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:sVol/JT0iADXPtL9oqYlsYPpj+FVAaNFBf:sVol/JT0FDXFL9o1pUVPJ
                                                                                      MD5:3DC0C94A2B03FB1AF1E55F3562B339E1
                                                                                      SHA1:469E59B91177134FB1DA7FCBEB13CA558149AF32
                                                                                      SHA-256:CBD57517A5861931787D6E8F3EE6974016F2C4E95DE314013C4109A3BA9065D9
                                                                                      SHA-512:73E03D5443CAFAB1DA1E0D3ADE85C08D718100B1788635934DCDFB6739E9DA95AD1CCE7409603DE7E94CFBFD032DE209189CF257F38CCAB25F325407E5226025
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fad42079-93a3-49ad-a104-1648c9321893.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):8567
                                                                                      Entropy (8bit):5.059946731459231
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:sVolqlJyJ1AGb9Ys0iXQDdlP1NGYlsY5Th6Cp9/x+6M8muecmAeCze4zvrN2X6gM:sVol/JT0iADXPKYlsYPpj+FVATNFBf
                                                                                      MD5:50244C1B9E187CA85D866DE6752D4AF2
                                                                                      SHA1:60A54F3C8564E57FC9C2AFF6B377A82F375CCFA2
                                                                                      SHA-256:011555BB1205A172B71CAA6A9EB2AAF1D6723E9821AF883D74A51112851A2D3C
                                                                                      SHA-512:9229ACD3C7D6E0B5BA3E62FFB4421853B1321C5B7AE040A7A27C821D956E4CB72A15BAA6BB5FEA25BDE36434AAE654B1939185A9A22F664D8D6E08C7A988817B
                                                                                      Malicious:false
                                                                                      Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13364816069180404","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.35226517389931394
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
                                                                                      MD5:D2CCDC36225684AAE8FA563AFEDB14E7
                                                                                      SHA1:3759649035F23004A4C30A14C5F0B54191BEBF80
                                                                                      SHA-256:080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
                                                                                      SHA-512:1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):32768
                                                                                      Entropy (8bit):0.017262956703125623
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                      MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                      SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                      SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                      SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                      Malicious:false
                                                                                      Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):1566
                                                                                      Entropy (8bit):5.488473277206955
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:3Q8/SBSGQPPuHRHUxKIYjIY1KzYqk5MYjMYZy8KAlkfAlkRr35:U0GQWIYjIY1KzYb5MYjMYhKYcYOr35
                                                                                      MD5:DE0CB928C54B9EAE86B3F6193FC67283
                                                                                      SHA1:6BEB994519BAD60CADBB2A9DE335C2E43466D82F
                                                                                      SHA-256:39DB62F15B8388F984584BFB88229DE452FAA2C70D24519A8891B605F328F34E
                                                                                      SHA-512:354C2208D11958F8E77EE2111BE7F9545D94836104364814BBDA475C36AD91834413AD4D6AC91B3E2943EC0621FFF5E0BC1A3486D67C1F607A18D5B9C83E67C4
                                                                                      Malicious:false
                                                                                      Preview:A..r.................20_1_1...1.,U.................20_1_1...1r.2..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch.....4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton....&4_IPH_FocusHelpBubbleScreenReaderPromo*.$IPH_FocusHelpBubbleScreenReaderPromo.....4_IPH_GMCCastStartStop...IPH_GMCCastStartStop.....4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode.....4_IPH_LiveCaption...IPH_LiveCaption.....4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage...."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature.....4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature....&4_IPH_PriceTrackingEmailConsentFeature*.$IPH_PriceTrackingEmailConsentFeature....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature.....4_IPH_De

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):281
                                                                                      Entropy (8bit):5.245529511763963
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIFpah1wkn23oH+Tcwtfrl2KLlrOSIFwdjL+q2Pwkn23oH+TcwtfrK+IFUv:E7HfYeb1Lc7idOvYfYeb23FUv
                                                                                      MD5:B7542D4B605281557B5BD5DC51F5D1A3
                                                                                      SHA1:B809954D1765F64D7407F9BC2C77442D367DD1EA
                                                                                      SHA-256:8F5B77C01CD571B7F90C9B0DC929D7C84AE52C14875121DEB420ED95B0EA5AA3
                                                                                      SHA-512:4A02548ABE0DE16CE27A6D1D13932AF0EA04CFE324C91814DA3DAA252554C0E7A30AF3BD37D5283A5403C026BCD80D04A5BF5F8516C75DBBB70680F5709208C8
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.206 1e58 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/07/07-04:54:29.231 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:OpenPGP Secret Key
                                                                                      Category:dropped
                                                                                      Size (bytes):41
                                                                                      Entropy (8bit):4.704993772857998
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                      Malicious:false
                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):729
                                                                                      Entropy (8bit):3.9468862999486474
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:G0nYUtTNop//z3p/Uz0RuWlJhC+lWbilH/2PlesdbrRF6Nqa:G0nYUtypD3RUovhC+lWbGElb+
                                                                                      MD5:693038F2D0293D3622530FC70CBE1127
                                                                                      SHA1:BE1330C8B7C1D0F4B41106AC48BAD41D3D4B9410
                                                                                      SHA-256:B2BE5BA74DE1EA3A273FF507062E1BF0EB1330B3CC5DC22DE1A3D67BA410A349
                                                                                      SHA-512:15F9A4DF6B13F44ACCBA653FB9DADE0CF4D1E570CEB0F7DE361C863EA8776DA2C8719EEEA2AEB87AC4F77DE8E2213BB0278EE86F85E5E218D04EA1055AE8E015
                                                                                      Malicious:false
                                                                                      Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.......(..................3_.....B.I..................19_...../..................4_......(...................18_.....I.Ha.................37_......m.}.................38_..........................39_......M...................3_......-D..................4_.....P"...................9_.........................9_.....

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):16
                                                                                      Entropy (8bit):3.2743974703476995
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                      Malicious:false
                                                                                      Preview:MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):299
                                                                                      Entropy (8bit):5.19813966740021
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:BOSIFbUXR1wkn23oH+Tcwtfrzs52KLlrOSIFpQIjL+q2Pwkn23oH+TcwtfrzAdIg:E7hUEfYebs9Lc7jOvYfYeb9FUv
                                                                                      MD5:6572D7CE79B2655CBF5DEA33AA2EA3F2
                                                                                      SHA1:416DCF1D620B59350F742FABB7D0013732A46C85
                                                                                      SHA-256:CB300988E4FDA00E8B7687F1062F67056E416E1DF212C2A289209C26055332CB
                                                                                      SHA-512:2B8653DCAA2F787AB344F006AC3EBC657A9CCE5D6681B0F792E24FC5F95E0C11237D3F5EEE8F2F790E827B408DD1B4083F834ED4163AAF788F6AFC8FE4BAC1F4
                                                                                      Malicious:false
                                                                                      Preview:2024/07/07-04:54:29.181 1e58 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/07/07-04:54:29.203 1e58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:OpenPGP Secret Key
                                                                                      Category:dropped
                                                                                      Size (bytes):41
                                                                                      Entropy (8bit):4.704993772857998
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                      Malicious:false
                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.01057775872642915
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsFl:/F
                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                      Malicious:false
                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):270336
                                                                                      Entropy (8bit):8.280239615765425E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.011852361981932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsHlDll:/H
                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.012340643231932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsGl3ll:/y
                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):262512
                                                                                      Entropy (8bit):9.47693366977411E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:LsNl2vfeK/l/:Ls32v1l/
                                                                                      MD5:26048C3D39E10F8FD25D12AC6405EBA9
                                                                                      SHA1:A8F7004F92A9937C4E845309D393C223672ECE88
                                                                                      SHA-256:BA578F065336AE86E366448B00676E210AF9F0520989D916549A4C2B1BB002A8
                                                                                      SHA-512:DE7550F819FC0FDB4AE883DBE432BB36CF9035CB2FB15D532F899ECA76D1DA7C2A16BA8290A22B03A924713213642A407C6DF55B3578E0E832A7A8C772E27F92
                                                                                      Malicious:false
                                                                                      Preview:........................................1.R.:{/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.01057775872642915
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsFl:/F
                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                      Malicious:false
                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):270336
                                                                                      Entropy (8bit):8.280239615765425E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.011852361981932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsHlDll:/H
                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.012340643231932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsGl3ll:/y
                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):262512
                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:LsNl4//:Ls34/
                                                                                      MD5:040C3C859026999F997D839A555D8525
                                                                                      SHA1:B070DD002CAFB93B7CBD7FA81DB51EFE77E7A27D
                                                                                      SHA-256:7E0FD135735C09E9BB8249D38B0ADD67C1B5B6CB924E29FFE5A11CFA16B42E77
                                                                                      SHA-512:2ECFBB3C8645FE525975795A9E03A172AB10DB2AED86FF37CD47B6101E9B8D91349DF812BBFF4CCB23FBF20C41303F842847B6744ED3CC5779BDD136DDDB028E
                                                                                      Malicious:false
                                                                                      Preview:........................................HpS.:{/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):120
                                                                                      Entropy (8bit):3.32524464792714
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                                                      MD5:A397E5983D4A1619E36143B4D804B870
                                                                                      SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                                                      SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                                                      SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                                                      Malicious:false
                                                                                      Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text, with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):13
                                                                                      Entropy (8bit):2.7192945256669794
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:NYLFRQI:ap2I
                                                                                      MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                      SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                      SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                      SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                      Malicious:false
                                                                                      Preview:117.0.2045.47

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30030.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30205.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30272.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF32a6c.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF340f2.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34102.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3617a.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3618a.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ec16.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41346.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF43b40.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF47183.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4feaf.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF52ddd.TMP (copy)

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):6820
                                                                                      Entropy (8bit):5.790297321768548
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:iaqkHfzHbY2c5ih/cI9URLl8RotoyMFVvlwhwe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akr02xeiRUZhQ6qRAq1k8SPxVLZ7VTiq
                                                                                      MD5:D0F43C2F353C900B83BDD04061F0128B
                                                                                      SHA1:178D41E4EFA743E8CBF336129662E1E4B78FB904
                                                                                      SHA-256:1A529341FE1E262A501755CD92AF2590EB9D0FCF191B888C6FD84B96598685A9
                                                                                      SHA-512:A6AF37976F0FDBC58348CD5CD7B9283C4CFB762F37D0EC676117D36BEEC95A78E7FC37EE0E9416D71489101C2D990D87029AF05CE556483366A2C818E5256129
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAD1RZfmUFFcTL1Gof2BfZiGEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABnMn+ATNB30eXx13m61WoBEFb+Qo84ZXR3JvL1aCK/0QAAAAA

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                      Category:dropped
                                                                                      Size (bytes):20480
                                                                                      Entropy (8bit):0.46731661083066856
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
                                                                                      MD5:E93ACF0820CA08E5A5D2D159729F70E3
                                                                                      SHA1:2C1A4D4924B9AEC1A796F108607404B000877C5D
                                                                                      SHA-256:F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
                                                                                      SHA-512:3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
                                                                                      Malicious:false
                                                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.01057775872642915
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsFl:/F
                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                      Malicious:false
                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):270336
                                                                                      Entropy (8bit):8.280239615765425E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.011852361981932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsHlDll:/H
                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):8192
                                                                                      Entropy (8bit):0.012340643231932763
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:MsGl3ll:/y
                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                      Category:dropped
                                                                                      Size (bytes):262512
                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:LsNl6YfPll/:Ls36Yl/
                                                                                      MD5:87D6C18D34EB827BCFB2A1DF5F2E05E0
                                                                                      SHA1:518227CB5C8943A728107EEECFFC2C7439E451E8
                                                                                      SHA-256:168D7B3316BC9F4CD1B7238C900885B6EF84935B270E63349D3109551337F8BF
                                                                                      SHA-512:8DDB3B3FD52F2CA1082976D337FEC3319D256D368BCE9308374E422D5A5BBFBF2F8A1FEB9E91BF51BD689E6A46F54312AC6B7C33EC4D77CFFB57B899147D004A
                                                                                      Malicious:false
                                                                                      Preview:........................................A&3.:{/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text, with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):29
                                                                                      Entropy (8bit):3.922828737239167
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:2NGw+K+:fwZ+
                                                                                      MD5:7BAAFE811F480ACFCCCEE0D744355C79
                                                                                      SHA1:24B89AE82313084BB8BBEB9AD98A550F41DF7B27
                                                                                      SHA-256:D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
                                                                                      SHA-512:70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
                                                                                      Malicious:false
                                                                                      Preview:customSynchronousLookupUris_0

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):35302
                                                                                      Entropy (8bit):7.99333285466604
                                                                                      Encrypted:true
                                                                                      SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                      MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                      SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                      SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                      SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                      Malicious:false
                                                                                      Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text, with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):18
                                                                                      Entropy (8bit):3.5724312513221195
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:kDnaV6bVon:kDYa2
                                                                                      MD5:5692162977B015E31D5F35F50EFAB9CF
                                                                                      SHA1:705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
                                                                                      SHA-256:42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
                                                                                      SHA-512:32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
                                                                                      Malicious:false
                                                                                      Preview:edgeSettings_2.0-0

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):3581
                                                                                      Entropy (8bit):4.459693941095613
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
                                                                                      MD5:BDE38FAE28EC415384B8CFE052306D6C
                                                                                      SHA1:3019740AF622B58D573C00BF5C98DD77F3FBB5CD
                                                                                      SHA-256:1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
                                                                                      SHA-512:9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
                                                                                      Malicious:false
                                                                                      Preview:{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text, with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):47
                                                                                      Entropy (8bit):4.493433469104717
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:kfKbQSQSuLA5:kyUc5
                                                                                      MD5:3F90757B200B52DCF5FDAC696EFD3D60
                                                                                      SHA1:569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
                                                                                      SHA-256:1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
                                                                                      SHA-512:39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
                                                                                      Malicious:false
                                                                                      Preview:synchronousLookupUris_636976985063396749.rel.v2

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):35302
                                                                                      Entropy (8bit):7.99333285466604
                                                                                      Encrypted:true
                                                                                      SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                      MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                      SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                      SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                      SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                      Malicious:false
                                                                                      Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):86
                                                                                      Entropy (8bit):4.389669793590032
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
                                                                                      MD5:03B6D5E81A4DC4D4E6C27BE1E932B9D9
                                                                                      SHA1:3C5EF0615314BDB136AB57C90359F1839BDD5C93
                                                                                      SHA-256:73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
                                                                                      SHA-512:0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
                                                                                      Malicious:false
                                                                                      Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b1634b18-de2b-4775-88bf-8d4eb6e8017b.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):8098
                                                                                      Entropy (8bit):5.801027720932077
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:asNAr02leiRU22QNkfW+T6qRAq1k8SPxVLZ7VTiq:asNAj/Hefp6q3QxVNZTiq
                                                                                      MD5:C324B4A5DE8AB22002B022B6D0B6007A
                                                                                      SHA1:413E3EF77A2E5255DDAEB3176D89C49CF703F22C
                                                                                      SHA-256:368FABA51649D4BE183F1B02EF6D7DF55A11BF5478F4BD982D56DBD118FB5D64
                                                                                      SHA-512:7A60EC1B8D18BA7E2A0519F289F2F7F13C468490994EFF20D2E9B10CD4C39018EDA642684036750445C893E741A52B356611199753D9E72C37E247169E035C7B
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b19c8a4b-493c-4bf0-abc8-1c44bd6aac94.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):27023
                                                                                      Entropy (8bit):6.056962587925999
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:iM7X2zt1jOXtXi3zahcAzqkz+SHyWNN2OWk6Td:iMSzMtXija+LkzlHyGgLx
                                                                                      MD5:59612462230D6050572E8DA21697227F
                                                                                      SHA1:A2F93CC7C308EC07482CBAD756453FF27AFC0532
                                                                                      SHA-256:A32E46F2CA3B5E80A0AE0C589C19A8867086E96545679C9AA50465CCBD99BD0E
                                                                                      SHA-512:A2083252569C41015FB6D93B3EA31CAA90CDF7E92CB06E115D7D2DFF3A990B90A360689DD79CC7FD4F56C600DBB0FB9588FE92A535BB968F38ED888ABBD4F446
                                                                                      Malicious:false
                                                                                      Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13364816069218291","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e5975047-67d1-413e-846c-b150c73064c3.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:modified
                                                                                      Size (bytes):8098
                                                                                      Entropy (8bit):5.801027720932077
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:asNAr02leiRU22QNkfW+T6qRAq1k8SPxVLZ7VTiq:asNAj/Hefp6q3QxVNZTiq
                                                                                      MD5:C324B4A5DE8AB22002B022B6D0B6007A
                                                                                      SHA1:413E3EF77A2E5255DDAEB3176D89C49CF703F22C
                                                                                      SHA-256:368FABA51649D4BE183F1B02EF6D7DF55A11BF5478F4BD982D56DBD118FB5D64
                                                                                      SHA-512:7A60EC1B8D18BA7E2A0519F289F2F7F13C468490994EFF20D2E9B10CD4C39018EDA642684036750445C893E741A52B356611199753D9E72C37E247169E035C7B
                                                                                      Malicious:false
                                                                                      Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ee624d47-ef2c-474d-b1b4-a67be6f39bb0.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:modified
                                                                                      Size (bytes):29365
                                                                                      Entropy (8bit):6.051422689717999
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:iM7X2zt1jOXtXi3zahcr8YYqkz+zHyWNN2OWk6Td:iMSzMtXija+4YDkzAHyGgLx
                                                                                      MD5:8CB61E1A89C6268066F0D52CD7A441B5
                                                                                      SHA1:7CB37F7EC79CAA6FD56E959D7E88657D444B5874
                                                                                      SHA-256:FD2953000FAA50F61F071FEC31ADE07BA2866A972FA47F3DCEFD04F6A250A1F7
                                                                                      SHA-512:2F7089673E2B3F3736493B0D9B8FEFAA14DABC4DC9FC5DEED1E8520BAAB9DA0D7E264278EC1B36DFC49C02A986BCA0B4B9A45AF90B2B054C6B413C313AC4A291
                                                                                      Malicious:false
                                                                                      Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13364816069218291","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\BV0CIRYA\www.msn[1].xml

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:ASCII text, with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):126
                                                                                      Entropy (8bit):4.954873031287063
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:D9yRtFwsSxzqC+eAs9jrHFk6uMhOqTUL5wKb:JUF+FqCqm9ubL5Zb
                                                                                      MD5:58B5D740985DC466285D3FF3622DB605
                                                                                      SHA1:58D7EDEFFCA13AD9D397C76C066CDB001F4A97E8
                                                                                      SHA-256:A83049355FD19839E9D1F3D80C06462F6BD122BAFDFF2E4F5A4145573678F25A
                                                                                      SHA-512:4FCD57D5B561B2B7F09E9F7EF58DD2A1F397FF604FDB96251B384374DCC3555A791A9FE553E61D571D794F282F4DC5D22F86AB3593549D5E3233DCB4B15EB44F
                                                                                      Malicious:false
                                                                                      Preview:<root><item name="pageVersions" value="{&quot;hp&quot;:&quot;20240705.27&quot;}" ltime="1253524448" htime="31117387" /></root>

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):49120
                                                                                      Entropy (8bit):0.0017331682157558962
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:Ztt:T
                                                                                      MD5:0392ADA071EB68355BED625D8F9695F3
                                                                                      SHA1:777253141235B6C6AC92E17E297A1482E82252CC
                                                                                      SHA-256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
                                                                                      SHA-512:EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{82D2D456-3C3E-11EF-8C2C-ECF4BBEA1588}.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                      Category:dropped
                                                                                      Size (bytes):9728
                                                                                      Entropy (8bit):3.2524890048113173
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:Hb9WkkCl+UeYUKohEBCxDY8CxD1CxDxftffgpg:mYglngpg
                                                                                      MD5:70B4D04386111545800EDCB038457495
                                                                                      SHA1:E4DFC3751CD5411586865F009376FD511232C5AA
                                                                                      SHA-256:BCF4F84F187AFA0F1093EF57F432510C897006EA79A6FD9A18E86BA9C9DBC1B3
                                                                                      SHA-512:30BB344BE91F24802EB8FF0C751F892A1BD459E18653BF6C9904CA9A762A29E8F4DAE88B1815CE4253D0B28E81C88DD3B3C192CD2EB4C6DB6A3E9BA866A64F5A
                                                                                      Malicious:false
                                                                                      Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................@.kK.......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t...............................................................................................................O._.T.S.V.9.T.S.g.j.4.8.7.x.G.M.L.O.z.0.u.+.o.V.i.A.=.=.........:.......................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{82D2D458-3C3E-11EF-8C2C-ECF4BBEA1588}.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                      Category:dropped
                                                                                      Size (bytes):5632
                                                                                      Entropy (8bit):2.210182181983225
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:rFGDdtxB9lj8bZyll0bKvqy6yEyvy5DlsN5Acb9lj8bZyllXvqy:rFGPxZ8bZ+loKS9LYu0OU8bZ+lXS
                                                                                      MD5:B2F65442B9DBE94A49596E495C7402BD
                                                                                      SHA1:177662EAA6A934A1C0D2976070870DF5075BD835
                                                                                      SHA-256:C1CC0044782D3AFD24787C1844610FF3E8A9108C088F426CBAEC6C371E2F842D
                                                                                      SHA-512:65F6C830E0184BE744081EA7764DD36137599CF799BF52F0C0CEE200087FB2194AB3C1D327C3B87CDA5BF74492B0107EA7E4FEC992DD5B2D43496CC490F72EEC
                                                                                      Malicious:false
                                                                                      Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y......................................................................................... .HNK.................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{82D2D45A-3C3E-11EF-8C2C-ECF4BBEA1588}.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                      Category:dropped
                                                                                      Size (bytes):5632
                                                                                      Entropy (8bit):2.2119435086647883
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:rRGDXRH79lj8R/lZyI/luKvqy6yEyvy5DlsNUAcb9lj8R/lZyI/lXvqy:rRG7RX81lZ3luKS9LYu09U81lZ3lXS
                                                                                      MD5:E548607B38E0D560F0A2EDE87F326729
                                                                                      SHA1:6A4816F9D870FC23FE83B185A417B50C1AD1B917
                                                                                      SHA-256:32BF227991A44B0D9C610C31D69B1E6E6ED70294EA994183251BE80DADCED834
                                                                                      SHA-512:9102FBF1A4EBC46624C9E31EB6D1BD492D5D3B0046C96A306EA240C209EC5289CE5CB060112BDF3942A5D8EACBFB11603FCF971B333CDE7AFDE399F88923A211
                                                                                      Malicious:false
                                                                                      Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................V.JK.................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{951D3151-3C3E-11EF-8C2C-ECF4BBEA1588}.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                      Category:dropped
                                                                                      Size (bytes):5632
                                                                                      Entropy (8bit):2.210265285384571
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:rEGDqtRH79lj801ZyL1uKvqy6yEyvy5DlsNUAcb9lj801ZyL1Xvqy:rEGetRX801ZW1uKS9LYu09U801ZW1XS
                                                                                      MD5:1C22FCA3C8C5B1171446C95AFE3C2C5C
                                                                                      SHA1:339DF799F1D2585298B6055F8563F9A46EF647A1
                                                                                      SHA-256:1788F2FEC5584D3BFFEF755204DC6B3EFAB571FC178D4CE0C3374D106D8F7C4F
                                                                                      SHA-512:CA57B3544C0CB0175DE98FFDAAF13D42C4ECAE253050052E889DDCEC685FA2BF3E2B13968C412A13A8A52A5B5430A67EE46D2C801F0992E17DF180E6F8E4D12A
                                                                                      Malicious:false
                                                                                      Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y............................................................................................XK.................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{951D3153-3C3E-11EF-8C2C-ECF4BBEA1588}.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                      Category:dropped
                                                                                      Size (bytes):5632
                                                                                      Entropy (8bit):2.201673903506332
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:rJAtxGv9lj8FZy801ZKvqy6yEyvy5DlsNUAcb9lj8FZy8Xvqy:rOjGb8FZHKZKS9LYu09U8FZHXS
                                                                                      MD5:49118C60B9DD94D1346838FE8851C90E
                                                                                      SHA1:2080B993634F411828C89C9D6DE27B32B5A765A2
                                                                                      SHA-256:C611CBD8DEB86F47D7681B0BC5E29F73881CAB081483D5BB7A1694E4DD87B7FA
                                                                                      SHA-512:982A727544FA7067ADDA10293B19F94B7FA5A34144DE42BE5C4C85D9E22DDC982524371C577F86277B6AC200960B49922D10758C5662B382E77B1EDFD5642F95
                                                                                      Malicious:false
                                                                                      Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y...........................................................................................`K.......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9C962388-3C3E-11EF-8C2C-ECF4BBEA1588}.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                      Category:dropped
                                                                                      Size (bytes):5632
                                                                                      Entropy (8bit):2.2067741258832214
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:rJ0JxGv9lj85ZyJU01ZKvqy6yEyvy5DlsNUAcb9lj85ZyJUXvqy:rW/Gb85ZBKZKS9LYu09U85ZBXS
                                                                                      MD5:C23A76F2BFD34279502944D6D629A896
                                                                                      SHA1:AA29EC4209A2D878752C7398BEF9EB857DAFCB4E
                                                                                      SHA-256:1866D6509ED2421CF3C5BBBB2F96F38912804F7DB7A65CC4B14B1FBBE1C218E5
                                                                                      SHA-512:351441FBA41A7DEAD1A75937619515666F1A3C71506C68AA6ACE969E7C477082B7CE361EB772B69F73F13BA9F0C2C8E847ABEEFA58485D967378FB9BF2BB9C3C
                                                                                      Malicious:false
                                                                                      Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................`.dK.......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9C96238A-3C3E-11EF-8C2C-ECF4BBEA1588}.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                      Category:dropped
                                                                                      Size (bytes):5632
                                                                                      Entropy (8bit):2.20816184936586
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:rTGDgRH79lj8b2ZyI2uKvqy6yEyvy5DlsNUAcb9lj8b2ZyI2Xvqy:rTGURX8SZwuKS9LYu09U8SZwXS
                                                                                      MD5:9558F8FBC9EE163421FAD3349B3ACC87
                                                                                      SHA1:D1FC7811DD148A6A237DAFDAA54A8A2330B7AF91
                                                                                      SHA-256:E8A336DA59B9FCE80A70ED65F289A908E3797C923E31484B244614CB49F332E0
                                                                                      SHA-512:41DF4B61C026D76E1E9249269018FF787AEF1561EF7B2559661E1E4783A4A0D8566BABB96187D2F1AD9EDA6185D674F794DCD7C7FB525020BA9E0922AFA5587D
                                                                                      Malicious:false
                                                                                      Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................'.cK.................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A403E1CC-3C3E-11EF-8C2C-ECF4BBEA1588}.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                      Category:dropped
                                                                                      Size (bytes):5632
                                                                                      Entropy (8bit):2.208881958171389
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:rJOtzxGv9lj8LzZyp01ZKvqy6yEyvy5DlsNUAcb9lj8LzZypXvqy:rQ9Gb8LzZOKZKS9LYu09U8LzZOXS
                                                                                      MD5:8919B2A8B875D56601FEF4AC115BA9D6
                                                                                      SHA1:3F7C323887C478918F974D8DB95C422DC2E9C5D1
                                                                                      SHA-256:E154514ADE5F0CBD68BA32A1F50FDC28D546666638C65D31FA1DFFDF30E39E2D
                                                                                      SHA-512:BE7B07A752B6684CE7B84473CA2C690783914613F1934996C0D33BD664106916F54B2E7402EC41BFC3ECAC439C5B3CA16622383F59F1DD3C64E4DD8056CF9951
                                                                                      Malicious:false
                                                                                      Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y...........................................................................................JlK.......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A403E1CE-3C3E-11EF-8C2C-ECF4BBEA1588}.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                      Category:dropped
                                                                                      Size (bytes):4096
                                                                                      Entropy (8bit):1.9473114963275113
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:rl0ZGFwrEgmfu66FuxrEgmfu6qg9lSaJI0tnRYCDAzuk9lIcatQ0tbuH5youB:r0G9xGv9lg8nOBzuk9lj8buZyouB
                                                                                      MD5:182BFE505307EF72C2B86264567E18CB
                                                                                      SHA1:B4AD3B3DC4A00ECABCDDFC9693C3F6C102E90BAB
                                                                                      SHA-256:EBA9F348D90F5A1E2C88C6BD71BAA822D18A953225069F5E6862F8B3D663B091
                                                                                      SHA-512:82B019D600D30F8432B8836BAC3E4C1072E7E5DA0A941352597E5FC4F947CC61B8A649F42E3610D3E7DC95F3CDF3A7B06DC1A7DBE6FB1A8F0233DD12F56A13F1
                                                                                      Malicious:false
                                                                                      Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y............................................................................................lK.................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................4.......T.r.a.v.e.l.L.o.g.......................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):355
                                                                                      Entropy (8bit):5.108400251517626
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltqc41EW5mAK+EpTD90/QL3WIZK0QhPPwGVDHkEtMjwu:TMHdNMNxOEymAK9nWimI00OYGVbkEtMb
                                                                                      MD5:99111BC0EDC731D981A7DEB7A57DD216
                                                                                      SHA1:84386FFD484A7557F1FF339723077ACC6F5F6B52
                                                                                      SHA-256:709A0672AA12DAB10221B39E153BB54B216A7BC391B4233AF5F157D95DEF7C37
                                                                                      SHA-512:64F9B0357D932DDF4E3A87D88345952DC19B2C4CCC9E87EAB6E7F97D1B979E6923F191E7EC98F4EC3D3B8581F3D046AB6F7469B7E07D78C24711F07064D5CC21
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x4e6ea2cd,0x01dad04b</date><accdate>0x4e73685b,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):353
                                                                                      Entropy (8bit):5.1415112210940475
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltqc4fLGTkr4VoAa4VoLTD90/QL3WIZK0QhPPwGkI5kU5EtMjwu:TMHdNMNxe2kMinWimI00OYGkak6EtMb
                                                                                      MD5:5E1DF980922B0F4302DB25E5B52D168B
                                                                                      SHA1:931FB9B7064F0213E831C5299223B45C958204D5
                                                                                      SHA-256:0D46E9C7A930AD04C02A62C639251964D0965D71FBC02DF7F6100912F16E3F7A
                                                                                      SHA-512:239D807F87778E98CA79331000F915C2ACBFB292526ABD0A7E70692B9314B43304B2AAA0B5204582A2839EBA7A868DEF74AF0C5D9604CDDD53D1D1D00B920F5C
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x4e56e609,0x01dad04b</date><accdate>0x4e56e609,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (317), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):359
                                                                                      Entropy (8bit):5.1320358154716486
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltqc4GL1+EuRSTD90/QL3WIZK0QhPPwGyhBcEEtMjwu:TMHdNMNxvL16RSnWimI00OYGmZEtMb
                                                                                      MD5:4AD408D65CB654E1CCE6DA4F52729535
                                                                                      SHA1:FB39EB23B5E97388916B39C0DD5BA2B91907739B
                                                                                      SHA-256:A1F7ECAF451828FB9C04F3076E44FC2AE8D2791B692F37E33B42EE9B8AE68A28
                                                                                      SHA-512:83F4A7D942C22E8C5E2EEB118CAC532F71860812AB8ADC52B1E79DBBF1A6C2E2E640E046F1B32B9E1E6367B8D85FB9070D302036BBDBA9CC6A4D82D3ACCD0627
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x4e73685b,0x01dad04b</date><accdate>0x4e75c9e0,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (334), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):376
                                                                                      Entropy (8bit):5.175812297070185
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltq08eDPOOKaihMc4VoAUSTD90/QL3WIZK0QhPPwGcE5EtMjwu:TMHdNMNxtDPOOKajUSnWimI00OYGcE5t
                                                                                      MD5:065B1915E6E7822262A234881CEA2049
                                                                                      SHA1:B4B69217A5A0ADBA7BB7036F16882301DA576EC1
                                                                                      SHA-256:567937E7A0482C192F9D2CEC8E32CAF132E9F5A2E653AA7EDF491A77C0F30320
                                                                                      SHA-512:7DB47A96BB562E02DB034C8B2BECD6E92F41855252735898679178D0C3439E4990963C8A53BBEBAF736365BB430B2C768AAB7D2835CD3D89587A386D288259EC
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://go.microsoft.com/fwlink/p/?LinkId=255142"/><date>0x4e56e609,0x01dad04b</date><accdate>0x4e5a00e3,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Bing.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (307), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):349
                                                                                      Entropy (8bit):5.105969201660778
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltqc4JkWTD90/QL3WIZK0QhPPwGgE5EtMjwu:TMHdNMNxikWnWimI00OYGd5EtMb
                                                                                      MD5:2FD654DB30CABC0E4980FEDA2345D3C4
                                                                                      SHA1:1EDB3FC04CB88C694B35AEA71512CA2DB9092968
                                                                                      SHA-256:08E614EF8C89C3CAC46B062D8603B0740511D3CB404A7CA299193002A407D068
                                                                                      SHA-512:707920EC683921F64369BC62DEEB46E7541A1E4C97C9ADD6BCCAD2EA6C29B2F2CC29E4FEBE30BA535C172CC7ABA2764C58783CF0ECFA3B9F23EB6E5BDB65A70D
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x4e60ff7b,0x01dad04b</date><accdate>0x4e60ff7b,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):355
                                                                                      Entropy (8bit):5.106223337862237
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltqc4UxGwJTTD90/QL3WIZK0QhPPwG8K0QU5EtMjwu:TMHdNMNxhGwJTnWimI00OYG8K075EtMb
                                                                                      MD5:58E3794D9B8FC3663B891A18F900FA63
                                                                                      SHA1:EA249638691819A4C79CEAF0A1FCF723CCC77484
                                                                                      SHA-256:413166E5EF608D4D8EC024682B9D16FC086E26ACF0851514F2F44E286289F535
                                                                                      SHA-512:33D6ACEF558CB809093B28CC9660FC6FC6068083AA41827324D23F52917ADC4B703A1673F063A7423E4EB5965A5635710EF12A8DD1AAF4D52E54B35F688ACC35
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x4e7a20c1,0x01dad04b</date><accdate>0x4e7a20c1,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):353
                                                                                      Entropy (8bit):5.095806902152601
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltqc4QunQH15mLTD90/QL3WIZK0QhPPwGAkEtMjwu:TMHdNMNx0nQHLmLnWimI00OYGxEtMb
                                                                                      MD5:E931F8B94CB235C6A93EE83CCAE6A3C9
                                                                                      SHA1:C2171959F9F1A360669019A8D52613A4BD070EC8
                                                                                      SHA-256:8A7388162B393A6BCDC0CAD7764E85EC55E72905541FF6B3816CC81CBD20302E
                                                                                      SHA-512:9B06E96B310E3C530A2E484000020F429E6C5F48A2E46FE868F88EEBF0A572AF82E1AD2D5750F46E4F7847210ED9070D2975E86689059D381E020BB518F19C86
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x4e6c4082,0x01dad04b</date><accdate>0x4e6ea2cd,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):355
                                                                                      Entropy (8bit):5.179441528982559
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltqc4oTDMASdgpTD90/QL3WIZK0QhPPwG6Kq5EtMjwu:TMHdNMNxxVtnWimI00OYG6Kq5EtMb
                                                                                      MD5:50501E2CCA83EFD953677A93F3AE1D8F
                                                                                      SHA1:EBCFDE5745685CDF79487590A01619293191CA27
                                                                                      SHA-256:6944F8EBEFF2DF2B0B5A68F926C6502034C2F55F999ED900A85A29A033624BA2
                                                                                      SHA-512:F3D118BD9C926ADC93CBCD71785494BC5F3E0B5DB8A4971CCC03194F169D072EC2F43D54F301CC13C653B19143F2FC48B47DB6C365AEE38159B13B69790B553D
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x4e6519f9,0x01dad04b</date><accdate>0x4e677bb8,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (315), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):357
                                                                                      Entropy (8bit):5.0697556993698365
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltqc4YX2nrBUSTD90/QL3WIZK0QhPPwG02CqEtMjwu:TMHdNMNxcrBUSnWimI00OYGVEtMb
                                                                                      MD5:88B47F77498A2CF2CA0FB9926B8FB8A8
                                                                                      SHA1:B15BDBB6CC0F7A5C57AAD530D06914980EB8D8F5
                                                                                      SHA-256:B8B0E022FECCB7EB10431FC25D810BF87E223C0E281854A31D786C44FBDAD87D
                                                                                      SHA-512:D4C13B25FD6AAD66FE7F757CDF43738557CCDC5B8394DD25E4F2B5F6914F9654CE79C3AD6410DA0207395EBFCAF2B3BA8DD0F6B1CC71CE153B3282C2CEDF97BE
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x4e5a00e3,0x01dad04b</date><accdate>0x4e5a00e3,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):353
                                                                                      Entropy (8bit):5.0831513139341
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:TMVBdc9EMdLD5Ltqc4InKARxlMl+TD90/QL3WIZK0QhPPwGiwE5EtMjwu:TMHdNMNxfnbRxlMl+nWimI00OYGe5Ety
                                                                                      MD5:38EA186EDDFD59AA2FCDAFF20FE26799
                                                                                      SHA1:80DB35CFE3E86EA12089EAE3F0EC5CBA0C1D49DC
                                                                                      SHA-256:F6179CB9DE8D4EE0263E2E648947E8EAD97690F839C83DEA512DC96C277CE01B
                                                                                      SHA-512:17E16A8EA30377BA8D66A240187AE62B3A39D06CD4CBE6F6434D519E4D7281C519B19884199A4BD580F3DE4A77DB5CCC715E2351019F1F3843656272880A5A1A
                                                                                      Malicious:false
                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x4e5c5e42,0x01dad04b</date><accdate>0x4e5eae75,0x01dad04b</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\3qz8kd9\imagestore.dat

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:modified
                                                                                      Size (bytes):1724
                                                                                      Entropy (8bit):7.186127401200827
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:kUt/6symC+PTCq5TcBUX4b5Ut/6symC+PTCq5TcBUX4b3Il:LS29dcBUXqWS29dcBUXqI
                                                                                      MD5:AF133FFFDC17499D27511D89F1A4DA27
                                                                                      SHA1:F8941A0157B12A147E300474245CD65057929E97
                                                                                      SHA-256:41BC681E16636C9DCCE11698567E80A393A1D5C71D0AFE3722412524BFF6320E
                                                                                      SHA-512:641A147C2C54CDEF30C2359535B6745F6F3EEF19DFDB620982F12F720D6DB655A84B554E327352EA41F5668ADF732F97344D271A34842DEF293BACB878C7E967
                                                                                      Malicious:false
                                                                                      Preview:..........h.t.t.p.s.:././.w.w.w...m.s.n...c.o.m./.f.a.v.i.c.o.n...i.c.o......PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D.*.M.*.............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`. ... ............W.f.....W.f......h.t.t.p.s.:././.w.w.w...m.s.n...c.o.m./.f.a.v.i.c.o.n...i.c.o......PNG........IHDR... ... ............pHYs.................vpAg...

                                                                                      C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):2278
                                                                                      Entropy (8bit):3.8558882522357245
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:uiTrlKxrgxaxl9Il8uZGzZA0HSKjx400hAyERPkr1Id1rc:mjYPG+0Hz3vZON
                                                                                      MD5:F0C0FA685EFF7BEE45BB63E397E7A2DF
                                                                                      SHA1:77872EF4F857002D20B91D6DB74A2CF53365D79F
                                                                                      SHA-256:AF97598C333272E4494B9F1D2D308A665A3FA2C5B44AFF4DA4C3E99E36ABA55D
                                                                                      SHA-512:E0307CE4EDA67CF6546E335FB20EA5D1CA00BEF64C24C556C998BEF99CB8178E0F2C5320A72F8312721C63DF6DE571297772EC2117057020AD938C24E5EF1D29
                                                                                      Malicious:false
                                                                                      Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.G.X.F.q.V.P.Q.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.U.W.X.5.l.

                                                                                      C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):4622
                                                                                      Entropy (8bit):4.005410994835365
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:BYR7ux9xK4u5iCxQHxmdkN1RYcIiFWNE9UfPaVwy:BXr84u5i6/yjYQ0ieqKy
                                                                                      MD5:AD5F0846335AEF0C3B6F0B4690F056FB
                                                                                      SHA1:76DCB8073B36E19656D67EF5A0BAAD0213485E33
                                                                                      SHA-256:EE8E68E288AD5083383EA7533613D0BD7A527F6664C9ECBB2BD54B3BF051F2D8
                                                                                      SHA-512:88B09860B2CCC12275B208448B95EDB448EEF4987F8A3A57E5D6D14A04EEB0B46E22CA79330179CCFCAD32BFD66FCB14FC7F5CD0677A4C9043B2356F0ED129D5
                                                                                      Malicious:false
                                                                                      Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".8.2.v.r.j.0.v.Q.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.9.U.W.X.5.l.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\7U63GPVH.htm

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:HTML document, ASCII text, with very long lines (57699), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):193100
                                                                                      Entropy (8bit):5.463391449836657
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:fJkgFLF3xsDWH+BCDheFhWNyhxpAOukO/xY2:xkwF3xsDeDheiNyhnAwsxY2
                                                                                      MD5:C7B8CA9451C65EDAAB8E755DF9E8F305
                                                                                      SHA1:78C7E092C7A73646E50E9EE7539BFE2269C738FB
                                                                                      SHA-256:36891A4900D358E1F1B1D8539655BDD767E20B630A50FA8C1F57C226911442EE
                                                                                      SHA-512:D66A227ED916F9FB80064F36C147A79B4DDF46936A6C1A5351F22D8F269DE4C009674B1B8808AE45F5CDD8EF40A16A024FD8C2C52A5E01A142557A5308F278CA
                                                                                      Malicious:false
                                                                                      Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-shop-staging,prg-hub-staging,ads-controlcbceleb,cprg-rvr-ads-dl,prg-rvr-ads-dl,cprg-ctrl-viewspage,prg-1sw-sa-ntf-ddp-c,prg-1sw-sal2coldctxbc,prg-1sw-spdptcf,1sw-esprt-shlnc,prg-1sw-header-event,prg-1sw-headrc,prg-1sw-cdelay,prg-blck-web,prg-1sw-mebc81,prg-1sw-tbnewicons,prg-1sw-dibdgc,prg-fin-cl3ad,c-prg-1sw-curff,c-prg-ad-more,iframeflex,prg-adspeek,1s-winauthservice,prg-1sw-haltmmcall,prg-1sw-nommcall,traffic-pr2-news-cf,prg-pr2-widget-tab,btie-ad-ctalog-cf,1s-ads-ntpcta,1s-ads-ntplogo,prg-ad-cta-logo-cf,1s-fcrypt,1s-ntf1-flupc,prg-ctr-pnpc,preprg-1sw-sadwf-c1,prg-upsaip-w1-t,prg-upsaip-r-t,prg-cg-search-api-c,1s-rpssecautht,prg-1sw-p1wtrclm,jj_fac_c,prg-1sw-ofett,prg-1sw-ofet,prg-pr2-icbdgtt,prg-pr2-icbdgt3,prg-pr2-tbnewani,prg-pr2-respsection-c,cprg-ad-dtag-agv,prg-1cashback-logo-t,prg-unified-pclick-t2,1s-p2-promotedondmd,1s-wpo-pr2-promad,prg-2unified-exp2,1s-wpo-prg2-sdmr05-c,1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AA12TS68[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):387
                                                                                      Entropy (8bit):6.746676324682719
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/78/UomvPlBsFnMMXTCyHoxXnvSkB81kisN:5AcME7oxXjB82F
                                                                                      MD5:3B8C755191862131B6B3D29A42DA0F76
                                                                                      SHA1:77B8B93CE7AE6E280FB502EF2CCBD8468C035ED8
                                                                                      SHA-256:9D29563031A40834CF2B0B559BDA391ECD870F0825CFBE4719FA7D5B0074DAFD
                                                                                      SHA-512:0681819B5D7FE3EFE0BD53924805DE0904094C6F0C85B383904E0253F1EF08F771B6A351979973B43A52D617C69CE1CB95EF0603F75D4217E66632FE97B5E751
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8Oc.O!...|.....#G.....PQL....>.W7p.........PQL.._.....|..(`...ss..?.......l;...u.......[ZZ..Y.f.T..`5 ....E;?..6m...ooo.,*.0....`..O..........kkk..9v..T..`.P6.5...."......HII.. ....^..o....Al..w......0.......+.m.....l......*..(.\.........|..*...=.'.3g.@E .#.H..m.......{).......IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AA179X84[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):3379
                                                                                      Entropy (8bit):7.916680030038272
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:CSwZR2PYZJMrpxu6HyBuozqa7ZAzHL/Ty/A/ReMmzkrVHLvnl:CSw7utpxuS65zqayjfyARe6lvnl
                                                                                      MD5:1CE26316083E46EC559ADDE2D5A47D66
                                                                                      SHA1:89520B24791AA4B829315FFF8A4DC83582CA817E
                                                                                      SHA-256:CCA55B44EDB17EB13B92B9CDF952AEE496F77C7A30103D8F01FA71AAC286C850
                                                                                      SHA-512:6EE2EEEEBFC162FD5BAF16389746B952CCB953ACF84528DF75EAF49C9B50EB2ADA75CF234E904DCE1EE5BF4FA317FEB4D6BC49872A4FEEE2E5C07D1E275EE857
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......w8....pHYs.................sRGB.........gAMA......a.....IDATx..]]r........T]...h;!..0+...{...\p...\.bV.X.f.(+.Hb.........s.;.......FU..(..h~............O.Z...#.G..E.."...w_).v.u{....-..Z....=T...BO.?..'z.rs.KK.........?..>....78..........o............aD.%Xqw...c.j.Z. ..R.D5..7E.U.F?l:..R;....C5Fm..8...@.gA-}@...=..O$......[C.!j9.&....5..hSMQO..hH*..D..D..px~.......l..b..N....2..B .1..u...;>/...........D)....l...."h;.;.}.......txz.m..eQ........b...rb.......t....a..*..H......>9;..j..x.#...B..%R.V..M..C....('.0.U....t.w..irqq.{$C@..J0V./.......f.#,K...;H....<..>.S...db..3V./.J....x.'}.....<...~{Yk...Y..)@........./_.}.{M..P.....:...`...4.)@x..o..T.W....,`%.."..H(.....59.H..co.0..&}.......<.3..e.....).%.Cq8.'/.L.4.g..C..5.u./ez..U.:.H....n..,.\.>L...W...G..`.^.....M#....i..M.K.....'.s....v.+7n..e?YP?Q.p<.h..).9....!.L...2..*.c.g/~.a.P.........,.e....G......V.k..v.(*.g.;.u...-.i...xx......E.....X..e ?......xx.ps../.~

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AA17TFZv[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):2880
                                                                                      Entropy (8bit):7.879136096857446
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:C/6SyJtSJGYielqeKcdbk2QPFKxfGYMs+dqRmRIg5SZcgjsKs88hPTQQQQv:CSS8tODlqbce2jtGu3a5SCgjsKs8+
                                                                                      MD5:04BC888A67735209F284676628AA9325
                                                                                      SHA1:BEC523E7378599AC1D59FE2069797F8A1223A7B3
                                                                                      SHA-256:B108D167C84C2266C0D96B5413A08694EE9BB1C70952794A5296B2CC3A0111C7
                                                                                      SHA-512:65C47B01C55262E9F36AF461493F08EE626B1AFFBD0B910A018DC62BBFC449CC13CEEFF54B9E2103AF2A829497ED7AA2CF69EF1FA4EE2CF9FEB59257C09192A2
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......w8....pHYs.................sRGB.........gAMA......a.....IDATx..Kl.E....v....*.AH..8h,...h..I..%....r.`|..D.6.D........r.-...6..x.5...@.. >p...e...<.....'..?v.?..kfZG^....x.:..J..3A....<...L..3A....<...L..3A....<...L..3A....<s=.!:W.&..#...."c3'b....F.N.....L.l..T..?..W.eC......|...<.9"Bsv....O.zrd..U...;.M.~.*.:7C..]&M.U..,....V.$!..R.~..t......_......x..{sv).{...5.q....8GZ.]$..K...)...........z..0B.....=..........I...H.....E..1A2...1S.c@e.2u..W5...F.kk&.E.#...u...c..Z.?...AM. f^^...m.Q..[.8D...'4.z.r...'...6..?x.....'..H5x..?...XDsv&.x.q1..8Vp....r7.%.`...2.W...5...I....Yq/...w.|1..4.....Y.V....N.......#m...{......m..`......../..:u....U..8.n.... .}.o3..|.s...O_)..;g.w.[......g.hcv....KA..#...B.#.......0c.#.).s..9[.....C..=S......kU"B U..@($w2..;g...6Y...............z.........?........3......"..|......T=...".xxpDB....#. .JD..{h..{/.k......9..g.........."..#....0Tt.W.g.....FL.>..E....x...|..|.<...`Y.....$8....g

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AA1gKAgr[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):370
                                                                                      Entropy (8bit):7.036297452390412
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:6v/lhPkR/C+wU15vp57ygiduQlBFDjETtBzPiBcawkWZqUGxZPqp:6v/78/s8kgGBU53aTses
                                                                                      MD5:8B229647FF0AC4FBD36E86C337D9A581
                                                                                      SHA1:1BDBA358DB108064DCCD6DFADA47205DBE38DC29
                                                                                      SHA-256:893DB7E356871F99082DBEE4473027968AFDA138411DD270C72E241BF2570E8C
                                                                                      SHA-512:4E0C4237AC052C2A74775CD9875C17632890D25955C74343222D5B37A66009C95F961ECA29B63E28A44EA86CAAF5554F4A77664580B22038605DF8333186E636
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O.J.A...Sl.`!V.....B,..Q..:X..fv/j.D..s..G....3.r..2.,.......O`}.%\d>M..J_..D.......S+...q7#ml....A..$.s~.>....2.Q.<.m.Y...,..L7..,{#H.8.c..2....a............z.5..!.4.%/ =z)o.,...m.X.......?..L..H/?o..Z.....Do..H...v.j.,./3..E1.D.a=.....m.J......IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AAMzyrj[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):8734
                                                                                      Entropy (8bit):7.930109868825126
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:MIIHUCD4wazJ/qJMRwHHPfqDiaeQToilTMYtEO:y0wIZ3CHvTgToiVCO
                                                                                      MD5:3D402AFC82D8413CA8204D90C5C0CA1E
                                                                                      SHA1:ABC2288CB213054F1F5A00C43DC963BD7B3F3F68
                                                                                      SHA-256:7AAA4C4484A5C5592B4976FB99A22555FF503BC18245DE0A2E1AA7EE596BF421
                                                                                      SHA-512:25D027C1ACC075CD602EA9263DC17EDCB5638460E89B1C232DF8F6CD463D4F52DEF66F358F0B84BDD55377BE72E6C7E3EE02D329FF46194C728EFEEF491004AA
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`.......G....CiCCPICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m....... ......O......:..L..$R...J5e?

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AAVBy9F[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):364
                                                                                      Entropy (8bit):6.975285406473478
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:6v/lhPkR/C+zqZsa9lOiIm7jErWGEohF27TgZrKOLCN3arE+hyq29wosCkf/bp:6v/78/HUsC3jUhF2QxKO2xarQqa6CQ/1
                                                                                      MD5:12CEF64509879059B676F4F231839E8A
                                                                                      SHA1:09A9668C599A17D8D43D83AA92246E20E0094068
                                                                                      SHA-256:58878B947D2346766591CF94194BB2D5C89242BE0636C7176560C1D9E96DA683
                                                                                      SHA-512:A0B4808C496D10E55B2BB51B64CC958125E4AE21D0D375EC31067A0993440DBDC9CAF61611F88C944BA233963C83E4CCD4A57620A0F19BA8418E86E9016B6D37
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O.j.`.....'q....]].K.....A..D.Rl.Y..%.I..Ek.!.M......_.~.-..........s8.~..._....<...;.D.A....8.8Kn..|o6|,...)...y....A .f3.J%..B..F..\....X...xh.PJ%..cL..0.TU..}2.h.}..U6.Z.ct.<..i.2.gU...j(.2...]..4-.a.......e.egY|....N.$.v8...%.Nj..dEi.............,.z....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AAWTbPq[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):6926
                                                                                      Entropy (8bit):7.906745244520129
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:lh/Jk/aHBL27rxHGMr5kNDa9EGG4glnHb31RPxB8TWl:Huecsc5kNO9EGG4glnTT8Y
                                                                                      MD5:3AF6FE22820F9627937BE331D93AC67F
                                                                                      SHA1:C6E1A0DA0E5DC518C472DA612C4B9A2822F36162
                                                                                      SHA-256:096719062DDD704A2E998D1B8226B15B79431CE9FFC7BE585F013B729B168B62
                                                                                      SHA-512:D4CFB9E76C16ADDBDB0693661CE7B2765995FB4028D4E4D28096BC68FCAAB51FF73BE50AADF9F7DFCA8325EB8D9A4C2FEDF60090664B8A67D925F2EBF75159E7
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......w8....tEXtSoftware.Adobe ImageReadyq.e<...uiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.164753, 2021/02/15-11:52:13 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ddeabf0f-a46e-489c-806e-76d5e49f7eda" xmpMM:DocumentID="xmp.did:905D497D7EC911EBB6FFB5E1B43AA253" xmpMM:InstanceID="xmp.iid:905D497C7EC911EBB6FFB5E1B43AA253" xmp:CreatorTool="Adobe Photoshop 22.3 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3ece29d3-28ed-424b-8cd9-35ce51f12eaa" stRef:documentID="xmp.did:ddeabf0f-a46e-489c-806e-76d5e49f7eda"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..f..../IDATx..].|T..?..7.fK2.g....$.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AAXL7Uv[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):5765
                                                                                      Entropy (8bit):7.923984876084066
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:CSDZ/I09Da01l+gmkyTt6Hk8nTN0MuAoKSA92eVU7NMQTbvJylB:CSDS0tKg9E05TxuFA92JNMQ/JylB
                                                                                      MD5:C64469BE90122B439E5E71EB4355D97F
                                                                                      SHA1:51B8FE00B807ABBEC07B1D9DC5C89370C4EAFC5F
                                                                                      SHA-256:339B7DFF4B089F3A1257EFF22E4C4042B5B7BD0CC57DA1D224DDDAFDE4475835
                                                                                      SHA-512:26D0580B853190CAC374F93BB4069FC25CF8CFF412284120AEA23FC993F5BDD014EC270906005BD492F992F9508770AC5102D1AD789C10B018A7FDFDAFC74417
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......w8....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AAw0aqB[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):18952
                                                                                      Entropy (8bit):3.3252742166443197
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTpWvkiGd1fFJOdCNGQW+GfNXrNXVhsc5MvHesuA:bSDS0tKg9E05T0kiGdtFodCg15glIK+C
                                                                                      MD5:6885A0AF4422B4C5AA896EC042242FC7
                                                                                      SHA1:7068369CDAFD4D81213F24870948A978BA7B59CA
                                                                                      SHA-256:90342C53E8C6F87DD3006015246C2EC7659FB25D0E9DC8B79A6C12E8F6C9FCDF
                                                                                      SHA-512:6293665DE44752A06AD1B900D664FDF12B395BA7DBE77F7C5029478BAE461105242436FDEDCE486DE0D1F5E7C7EDE90A0CA8ABAB300869C9B35E03100F0FE358
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AAywOab[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):18737
                                                                                      Entropy (8bit):3.2627728137161602
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWmHjxNXrNXNsc5MVNkvBs6c3:bSDS0tKg9E05TKk615UNa7G
                                                                                      MD5:030939BCC37975289457F6A19A301A35
                                                                                      SHA1:89D55A45787FE9DD547BE9CD1D97C9A8F641E338
                                                                                      SHA-256:D5D6DF229AC67CDE4B39D275955E4A279BBD7F922855D10B44F5701E6AA3CC64
                                                                                      SHA-512:21973881EF4C8EE777A1EA5570418439DB32EEF3B83B1FE468749B5C7669B82B19DF6568531C0155ABA929A2928E88DCDB654E1DE8F3966228C279E91C120E9E
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\BB127ztF[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):3898
                                                                                      Entropy (8bit):7.911010874015237
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:Ko7FQSWPRyWaP5WjY6whZWzs5RnKLkAe/suge9JHFei2:r7FQSWpxauihww5Ee0uv9xFN2
                                                                                      MD5:E198B236B56A4D8D09C8204CD6DF6C16
                                                                                      SHA1:D3613C8F46C1035CC096DBF433E0D972EEBBFC06
                                                                                      SHA-256:17D55FB2B61C55BF0F743EA5F35D39D97E46E903B87E1ED74320053B68AA8FD3
                                                                                      SHA-512:EA6087892CC4EBEF4BAA63CAED9DCF87506D24E67EB32C1F5DF53BA3684D76DE7E1A1E761AB6A4098F30304459644F348690B8BCCB84CDFCBFFC40B403241406
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...@...@......iq....KiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about=""/>. </rdf:RDF>.</x:xmpmeta>.<?xpacket end="r"?>..`.....IDATx..ytTU..?.m...T.(.!ak..mQ.....E..[...V.3.C..c.+: ....:.q..F=......vd...BV.*Im..-..+*....9......sr.w...}..~.{..?p....?.....4.bU..ta@NM.....t.+....].M...}...\...\..k...k.r.>.rm@..G@...5.....F...6 ..#..sp.v~.Q...{N..V)..I. Y..]9 ....=. U..+=.K.;..!..,.......o..X..q.. K.;...HD..!....4.,.D<.q.Hw.,.)/D.%,...B...G.p.a@.`Z..PC.4U.....H...<.{.4dI.......n.$~q.d.^.............i..mc..J.=c..e..!8....j........{0S&....f.fpY..i!K....fO.x54Uf....6$t..>.FO.P]..i..n.xt......E.4...(.7..w.$.....`...A@8F.. /<07S7...Y..............Z#.|.FS'...=7...u..7.../|.o.|....QI.F.._.3i|Y..7.q..+..q..Y.e.@..G.j."..._

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\BB1gUy0w[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):1709
                                                                                      Entropy (8bit):7.6452094363642695
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:1c0ardGsJas0NW8w/yScyItXGiWsjoslfe0GN:20aLJaab/Nut2iWsj9xGN
                                                                                      MD5:4BA35AF176E5E7B75D6B8347F39ABA8B
                                                                                      SHA1:41946BA8C9CB7D744742D3BADCF0AAE37B9E2DB3
                                                                                      SHA-256:BA61A3D3BF01B39F1C48B4EB24D87EDF241E25A2983ABD3D2FD43B74FBD7743F
                                                                                      SHA-512:B39A8E7257DCC73EE49338DD4D34C80703CE41AC09AB5B5F4287D7C3179D8FEE06D495FFE38BD7156C8A2B4397394B07C15130DDE0FA69F6F53A1C2E9B8F36A7
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......w8....pHYs...........~...._IDATx..Mh\U..OE.H.l..$...I..t.|....H...Di.f.L....b....l....ii1.....7..4q...4X7)).F.T..s^..y.M.t8?.f........s.}.}._...1...E..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F.....o.m..g.....E.M_K'.U........P..StB.}...7.....J.k....k....]..\X.I..r......@.W.B.=.r1.~.no...+..z+I....;......9.~.b?m.l.]...m..#u(..s..E.h..f..[..m..............o..x....5.6....y.....}<.r]g.9.....]..yv..A.<.6w...O^O......FuU/z..Sz.....$5.&..Hw..(.w.4....'...DK.N..8nK4.........C.2@..T..G....As=}c..s...o^...{.9.+.xw.I..G.....\....^.\....s{+@eF...S.[...p.I_.S......h_.L.'x4*......8..v...t>.f..I.6>e......v....h......pP.+...6...Ug..L...D....e.9.y..3.'..{y.'g.....y.e.h.p...a..`p.=.C......@..I...?f.iA.8...4...'.c.......?.*2.M...i/[y.I,.p....u..u.....WD......U.8[/..D......= /...."....&f........X^_....0..L.;..%..M.....G......=..6...f"...y.....q..I.>.j.b....8..JSVO.....p....=.'>..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\BBNvr53[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):592
                                                                                      Entropy (8bit):7.578589676001941
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/78+QOTZD7cechojiorckcpFwDSAFGSEpMFC2Cmw8qTavN+M8MIQ7LLiQp:jsZbchoj/4peK6FDBwQV98gP/
                                                                                      MD5:4124D5FD304564D77589DED83FE598BF
                                                                                      SHA1:8AC689BD506AF7312E8FBB06AF3A215B9A609A23
                                                                                      SHA-256:BA66F541FD81AC7C99D86BAC4CF071C9F0000F408B7487AFC1BD5E35E20B87FC
                                                                                      SHA-512:4F490E4ADE3C0AE6C117C92BDF8266D29D1B1FB2A80510EFD447BA228B9939DF3C70320FBB5ACF1CE6B2D5646B6CC45EB2C45DC7D26CB28C002CC4C145016BFC
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....gAMA......a.....IDAT8....kTQ....e.IX...F!Z...H...`'.....`ai...`!v1....(.`t....V#Y\.....5Q..y... ...f..{.{..v#.$K..1..i....U.\t.[\s.trB..v.v..4kU?._...&.l.Qy.n%..n...V}..Q....)......q5.W.U..-...N..S....>..a..l.....`a._..d..q2..c.G...0........xl'\.......1b..UP...BF.v.h^.....:..v....VU..MQL......[...w.awV.._....+...T.<o^.z..'..vt..AI09..9..J....U.Y]...7.Q..@......!...v3)y.z.....>......T.WuF...H....U...g%e..<y.....b.O.6.]7l.5/...o.E?(.5..]..;..1..?..H.t.D.u?...........Y.0..v.ii+y.:..B.2.Z.j.{...R...u..[......r....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\HY6USKOC.htm

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:HTML document, ASCII text, with very long lines (57699), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):193100
                                                                                      Entropy (8bit):5.463432593953561
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:f8kgFLF3xsDWH+BCDheFhWNyhxpAOukO/xY2:kkwF3xsDeDheiNyhnAwsxY2
                                                                                      MD5:530D7B558A691AB50E5DC9B7A08E2E38
                                                                                      SHA1:933B0C1D7EB07008A4D3C3AA4C70648648E50516
                                                                                      SHA-256:F59C1971264B8280FC99474B9EEBA085E3A59E6133D2B0ECC3E268E8DF3C60B4
                                                                                      SHA-512:49C11C3A147BF354B563162CFBC161118C1306DCA1F767325FC535496BDDEB073516EA94DE6F9776819F02080C7ED1B17B0AEFC3420D7410DBBCED90E1FEE237
                                                                                      Malicious:false
                                                                                      Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-shop-staging,prg-hub-staging,ads-controlcbceleb,cprg-rvr-ads-dl,prg-rvr-ads-dl,cprg-ctrl-viewspage,prg-1sw-sa-ntf-ddp-c,prg-1sw-sal2coldctxbc,prg-1sw-spdptcf,1sw-esprt-shlnc,prg-1sw-header-event,prg-1sw-headrc,prg-1sw-cdelay,prg-blck-web,prg-1sw-mebc81,prg-1sw-tbnewicons,prg-1sw-dibdgc,prg-fin-cl3ad,c-prg-1sw-curff,c-prg-ad-more,iframeflex,prg-adspeek,1s-winauthservice,prg-1sw-haltmmcall,prg-1sw-nommcall,traffic-pr2-news-cf,prg-pr2-widget-tab,btie-ad-ctalog-cf,1s-ads-ntpcta,1s-ads-ntplogo,prg-ad-cta-logo-cf,1s-fcrypt,1s-ntf1-flupc,prg-ctr-pnpc,preprg-1sw-sadwf-c1,prg-upsaip-w1-t,prg-upsaip-r-t,prg-cg-search-api-c,1s-rpssecautht,prg-1sw-p1wtrclm,jj_fac_c,prg-1sw-ofett,prg-1sw-ofet,prg-pr2-icbdgtt,prg-pr2-icbdgt3,prg-pr2-tbnewani,prg-pr2-respsection-c,cprg-ad-dtag-agv,prg-1cashback-logo-t,prg-unified-pclick-t2,1s-p2-promotedondmd,1s-wpo-pr2-promad,prg-2unified-exp2,1s-wpo-prg2-sdmr05-c,1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ast[1].js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):133876
                                                                                      Entropy (8bit):5.364587768227969
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:pCUNqjfSM5k+e35zzBpYQnx1tMUgaWXO9k4MZuKr3ahS3bLzpnvoJXxkmREpRrjU:5Q35kzBdnx1NAtWhQpnCkm+pRxXW
                                                                                      MD5:1F28C68DB0C484406F97CD119323F701
                                                                                      SHA1:AFC48D865FAC9C38B44F80608283D0935FB061C6
                                                                                      SHA-256:522AF4DC04539244756FEC45673CAE34A7CE2E023C20D728410C945B94B55A83
                                                                                      SHA-512:591C44295B073F1D7F1E7EDD9D5A769C185834CE5F872F314FDB0D44CEE1DE49DC4716A98FE326DFF85C8A657578E93D689EE37199364C94486804D6975E27B1
                                                                                      Malicious:false
                                                                                      Preview:/*! AST v0.62.4 Updated: 2024-06-10 */!function(e){var t={};function n(a){if(t[a])return t[a].exports;var r=t[a]={i:a,l:!1,exports:{}};return e[a].call(r.exports,r,r.exports,n),r.l=!0,r.exports}n.m=e,n.c=t,n.d=function(e,t,a){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:a})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var a=Object.create(null);if(n.r(a),Object.defineProperty(a,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)n.d(a,r,function(t){return e[t]}.bind(null,r));return a},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=12)}([function(e){e.exports=JSON.parse('{"o":{"UT_IFRAM

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\favicon[1].ico

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):758
                                                                                      Entropy (8bit):7.432323547387593
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/792/6TCfasyRmQ/iyzH48qyNkWCj7ev50C5qABOTo+CGB++yg43qX4b9uTmMI:F/6easyD/iCHLSWWqyCoTTdTc+yhaX4v
                                                                                      MD5:84CC977D0EB148166481B01D8418E375
                                                                                      SHA1:00E2461BCD67D7BA511DB230415000AEFBD30D2D
                                                                                      SHA-256:BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
                                                                                      SHA-512:F47A507077F9173FB07EC200C2677BA5F783D645BE100F12EFE71F701A74272A98E853C4FAB63740D685853935D545730992D0004C9D2FE8E1965445CAB509C3
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D.*.M.*.............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ie-image[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 1260 x 293, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):39155
                                                                                      Entropy (8bit):7.8985187905985486
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:c3+SnZXFurjYW0X0RJ/Dd18i72A/qcQ6Nj2CG+CiTZ2co4IXnmDt:DSnZXFuPSX0f837cQnCG+3WZXmx
                                                                                      MD5:E161E2045A32E4513E81954B1D83B953
                                                                                      SHA1:0A06306203C286B8C342CFD856C1EE3F16728C7E
                                                                                      SHA-256:7A344D69BC6657592E6041F0ED4F53F56ABA90B97EBD94559198B1D059DC7F64
                                                                                      SHA-512:7C7E5C2D2A0DF749BB4B52F2E8042829AE8ADD4F242674E13C14FEC436E56D7B173318D8408DD5A33462D38BC1FD2AD932B2060994B5A0C46F4B4BA89922437F
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR.......%.....W.}^....pHYs.................sRGB.........gAMA......a.....IDATx.....diz..}.c._..W.7..Nc\..,@...]I w..")..DI+.!.6......A?2......pI`....{.........&.9...s2o...2Y5..0;.I{O..|.<.#...?. """""""".............&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........&..;"""""""".............h.0.#"""""""". .........

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\me[1].json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):116558
                                                                                      Entropy (8bit):5.338597619286181
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:eM/mGROAcUW3eM0oj3sjMTWHWyWiWXnuictMiJZrGZrhZrIh:ePBYTntpODUh
                                                                                      MD5:8115B1272187DC3887681861582BA0A8
                                                                                      SHA1:9AA71352A9AC4731E9A2B9AF9717D7E46B5756EA
                                                                                      SHA-256:43E8C65A26F7E677B0B339C3A2AB929840B804E434708C1C1B63287AD5163A1B
                                                                                      SHA-512:3AE4D202B7AB7AC5DC142649EA1D179ABE4D24F88F015BA08230F400800AA8CC1B6C79A01129439299815D055F95887DA18CFCED40C172978605ABB7AAF700EA
                                                                                      Malicious:false
                                                                                      Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=2892d62b-f33d-482a-8587-8ca4d3782cf5&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1pu9Bo","type":"article","title":"Kevin Bacon used prosthetics to experience life as a normal person: 'This sucks'","abstract":"Kevin Bacon has been famous for decades. He once applied a disguise to experience life on the other side of fame, and he didn't enjoy it.","readTimeMin":3,"url":"https://www.foxnews.com/entertainment/kevin-bacon-once-used-prosthetics-experience-life-normal-person","locale":"en-us","financeMetadata":{"stocks":[],"sentimentRatings":[{"topic":"wf_sentiment_posi

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\me[2].json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):95862
                                                                                      Entropy (8bit):5.368596373556542
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:eMek33sNAewSvSnFiK3ZEKTQjH/DMZGfrmy:elk5ewSvSn/3ZEKTQjH/DMkfrx
                                                                                      MD5:1BB0F4A2440C7DBDEA17396E5E9BBCCD
                                                                                      SHA1:66CB3109C22BB99DBE2879CC4F62CED619CDDE9C
                                                                                      SHA-256:6E54827801C1949B2AED7B9925111E5A8755C85D243A96EC2F31F95A6D5FBC1C
                                                                                      SHA-512:84691A2C953E5A59984111221C1AB4F1F6A6AF64E3A6DEAE3E8270B7A1750F4D7C29B24DA64E9B69DA1397B55C6845A9CF62A29BAC79CD39BC439353EB821CC0
                                                                                      Malicious:false
                                                                                      Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=c46cdf1c-2a52-4119-b9b7-57e2c456cd35&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1psk3d","type":"article","title":"Salma Hayek Poses as Statue of Liberty in Fourth of July Throwback Magazine Shoot: .Latin Heat.","abstract":"The Golden Globe-winning actress posted a photo of herself from a 1999 'George' magazine shoot","readTimeMin":3,"url":"https://people.com/salma-hayek-poses-as-statue-of-liberty-in-fourth-of-july-throwback-8673998","locale":"en-us","financeMetadata":{"stocks":[],"sentimentRatings":[{"topic":"wf_sentiment_positive","score":356},{"topic":"wf_

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th4D38JOGX.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):72575
                                                                                      Entropy (8bit):7.973488615508574
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:RDKicL3n6O9EtNv4ChGETmlNbWufg+4ooSaBKfFU5A:pKi2nRKNvrhGMVuY+40aBKfqA
                                                                                      MD5:1D882ADCE5D6873027A4281E9D443DBF
                                                                                      SHA1:53CBF13FA7510F83790E5D2F5E9B3FAFC83D5CD2
                                                                                      SHA-256:96A110D8A66C5522E01DD4CF891D8FAD102FC52C65E37E599C4B2D6588DB3B9E
                                                                                      SHA-512:E04099A6EC01EF7271BD4F5D27AB6E9DF70FC3DBF0400F422CC19AC081C9E16B0B9333FBC1968FFE3DD31347E049D2F54750A76297A09DD5E5599D011E90B3A8
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..GG....-...k.......l....|...Q..0N.L.}.x+...M.S.<|<;..6...D.E...2..$d+.7..W..I.z._.......n.....`c..8.a..*.8.g.`.f..mgwm..X.<1. )o.F~.n.b...i.r..7.b{...n.y...]X...8.......p..sp#.....J.._.Va.4....h......Z\..H....V..?..V...._h.*....MJ.R.K.'W.........s.N..p ..*5...%&.'.M[..mb?._.m...Mo}..;.....g.}..~V.T._Dh.N...d>..ot.F.M...<Sq$.sjb9.6...#f....l.....~..o4..-o5

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th5E39TLK7.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):20398
                                                                                      Entropy (8bit):7.970645207127052
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SaSbist9FzRbncwHD0VaOafPb7jOhCfwKL1xx2fSDwzo:SaSm4D1nBIQlHb7jPrv2KAo
                                                                                      MD5:C551EE5B44DE8FC1D77E8E77D94FCABE
                                                                                      SHA1:8252A96C02CC73E632AE52DD9467F4E81534C929
                                                                                      SHA-256:A0C3541D9AE5706FC49155C25D4A34A8F9E52FEC7DC173AD9765913DE877774D
                                                                                      SHA-512:2E2E927DF2B3B9F53C047F622CFCF8C95648E886F52B34A6B4174785512B5D4EF4AB48E9A8BB98DF224C1C85D333735F52C9CD1D18A220C84979F8C8342F8EB7
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..{H.,.....V.a_....f...V..z......zT...._.um..k]H!..F....v...p*.RN~o...$......TdfT.A.g.......#yeL...!#.&..KK....+.sI.T.}Y.'..B.yD..rH?..m..Z..fT...5j.Q..-...~tr....[..t.Kx..c......Z0..S<z...Tp.X.....*h~....t....qI-.......4.u...>...H.<L. #.N.$+.r~S..K.D...FU..x..:..l.........=...^Bgj.u'...P>.L{.mZ@..$`..&.....j..>%.>..r!.?&.. *..:.O.J.+...n..o..>.w*..t.O_.\..M.2

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\thKWOOI29D.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):20102
                                                                                      Entropy (8bit):7.9636237504708145
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S96CGHoBKGFhUxcvJk5DYWlcJdkT5iPSncFphPi1Y9vDnobh9epa55dgm8geIqoR:S9WoBrAcxakzMnkPfcLUzm8VDzjA
                                                                                      MD5:064177CDEC583035B8EA9B85C36BFF6D
                                                                                      SHA1:C5E2AEC11800E00FB4DA6222F11348111D7CFD5D
                                                                                      SHA-256:EBBCDE3C0FB67B9333E77E1D5686E1B2F5A1AF29919EBC09D97C1716DBA735CF
                                                                                      SHA-512:AD3720371C44E1F6656BF184F3A376CDEEE6EC268FE7B1327DDB13C239BF597AC8BD8F6B34D2A67CA6390A035910E21AD51D95DC9978255C33BC88CFA51FAA89
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..;...wLR..2[.}.^?:.O......B.../...+.,|.........?Z.P]..r>aN...L....5.........+4.2...b@..M.J1m.4.9......j..Zl..Q..../..8.9..I.V.>9.........O=.+.|o}.jz...y$..}..1....+.[Lr..c.....*Y...V.g.<..7..u...3..i....;.y..,N.[.B8.R2.|...k.>.j...7p./...-z...|.?.;..J.K..Hm..d...`3...6....k....h..[......i-........~...\N.......m|=.`,.....y.<y....;P(,p..8.n.'....63.|O......W.<6..)

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[10].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):22051
                                                                                      Entropy (8bit):7.970525768798373
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SXbdssZ6Xqao/Q9OvviQ/oCTiNLAdJnw4KXUMRby47eOmTfyA2k2Ftb2j:SXaiEqLY9Kvr2+TjKXUMReUeOmWAUC
                                                                                      MD5:131085F5F26A2BA8D8125AE91A1F3154
                                                                                      SHA1:97B8D1E26EF9DD269352A0203E3754DFC0FD7386
                                                                                      SHA-256:01FA84270F9662DBD5D1CE440E1C1E4E4CBDBA5725DCEED43FDB8A28EC9CEC6E
                                                                                      SHA-512:80F4D40642D3D77FA9577D053E2754A62B34B8D558B21A9A4BC5F3CEB87C0E0578BDBF879193E34A96FA29609087038264E9ABA01D3F42C53DC5AD0DEFD0AB78
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...|Z..k....7R5..Mb.-...6M$.Q.l...l....)b........[[...o.qu;.......Q..u..r....W...n.k.?2..K..h.[.AF..K.l.4.j.../...>..X.>1..%3....B;U.S..K.'oJ....7&h....D..,Q.Y...XJF...V.V!W.G...).j...1.s...G.)c..S"dVR..A.>.2...,1..;.VM..:..=.XPqDq..UI8...S..#M.ou.VN.F|.....qXT..+........vi@.*.j...K3t.d..u.....b.ls$m.......z.w...x._...n..R.a..Wf.;..{88.<.W.[7...|........(..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[1].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):43686
                                                                                      Entropy (8bit):7.974039809322384
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:REMvvcPdvypyJCLguinHCkFMpQjczA7ocbXvCTChaQ1O6L7kOHfKkgnve/G5Ae:REvQWukCwPjc0scbXv3ha2i4SRve+6e
                                                                                      MD5:1AE6EC16B69D101962B1D0FAFD415E85
                                                                                      SHA1:06075577FE70B0E830726693DD3E2E6F609B0D2A
                                                                                      SHA-256:D69D6B073E60F30B53720255A265346C858462CEFD1FFD747E41DBED95712693
                                                                                      SHA-512:39CA606C254DBD05F25759C6E1D4F55BC9C730B369E09365618DC061D5EB78C4F97C3B8B8FF2073D6F4D5488C3EF3A13002A38AAF21EDE449A18E3FFE5B60651
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....V.?....#.u........{"..D..M.[../......I.q\N...N.qc.X.X.X..\...........R1.<.Tt.....k...9..2[.cl..\.{S..K..[.d.Y.]..3.ry5.mY.....'.K3.Tv.t..u.I.-5..xnc....-...NZ-..(q....L.g...n,lWO..gh,.F.m.,J...f...nN2j..C.....&G.zv.L..ERZ...#.?AV$2Ck..j#...+#+88\.x*....9.j.v6.p..Z......*F6:H.....NGL....im.Z........b...iFff..q....$.....G.>../........S.KX>.r.G...w *..V.A..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[2].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):8710
                                                                                      Entropy (8bit):7.943568472526573
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:SsL9HKIq34yXRznKYdBTWd9bfCJjpupVZFhHuFeIE+bwqNLWmps:S+yhznxHTWd92JUXZvAFtwqd2
                                                                                      MD5:C402993ED9A552D4AF0ECB469908ECFB
                                                                                      SHA1:196429CC07BBD85C4E6960BD4518FEFDA1061D1A
                                                                                      SHA-256:7F7EDD2848B9BE8CFC68F49A628D3493F20CC55D7B7CCF5780623DF8414FE94A
                                                                                      SHA-512:E52B3D9A762560F26DD7F716974FA6A963FBB78BDD59A93C2D8E96FF7B3A4255A6BEACFC9BAEAAD7E4D1761E3DD6CB906EDFD909D1321BA3E776277D4A6F188E
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...S...xT...'A4=*T...S..=...i2).0j.H.......X..#....$.~/i..K[i....8...........M.....Ke.`glu..v......~....7^)....v_&.?.k. ....?EZ.9..BbG...~QG.....Q.....K.....Y[.J.h..<1..m~.G..^...8.9.'..Vk[..X..$.v...G.N...M.....a.J.....~U..Kq...tq....1...v.&......C..}p..o.j.hZ]....Awm.....U%Cc. ..x.=...>.+..G.7u.An.n.F..~..}..7o}.......p.o...P~.c.t..@....:0m-Y.m..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[3].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):8234
                                                                                      Entropy (8bit):7.929116488822897
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:S+4JbJF5qreueM5uOgv39vaF+HN1LL0zjBtKmyUhmqnteKEu:S+kJqrenF1NvaoPLatKzyN0u
                                                                                      MD5:1F5C190489BA76039E0B17FA733DD016
                                                                                      SHA1:A748D19C5C7E8C15863A550EE9C0126A5ADC93A1
                                                                                      SHA-256:CEC01721DCEA8A0C31C2CC3DFAB4E6DD7AC4CE4E24906CAB99E5DD21CECAE1EC
                                                                                      SHA-512:780ECEEB6D18883C1DF29257D840B6D77B8FD21A6D42D3E48E551375523B78A9B82B6EA48CEB6846189A202A031F2379BBE411E886B27066ED8191A7DF864AFE
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0}h.....W=..$v............z7.J(`h.P.F....W.Q.6x4...b..0h..No.K?......My.........*..I...I'.W.|d...o.4J.+4).j.gc2...$.....w.7.$...Z...x..._.....N.t.2.yn..rqxi......4'...<7.......$C.x.M=.c....p;....[.3.b..U....8.s^.*q.....:..;.....4..f..U.d...V-............9.P}).. )#$..}..>s..5.s.m'D...._2c..i1...?".a..^My..so..<..+........\.e`.wz..N......uGj../$.O.......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[4].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):58772
                                                                                      Entropy (8bit):7.973176183169745
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:RNUHHMukwnKO2kv7vsEwEk+H+wqS55R2V+xnPbe:3wswnV2kvxwEkQYSzR2VwPbe
                                                                                      MD5:148C95F3179702D82E61801ABF477087
                                                                                      SHA1:2D6F07B27206470C5E822FB4B98E7492C446F939
                                                                                      SHA-256:767861D0742D7B4CF86386100581FBA54C738B4DA01F23957F28D3F393212CFD
                                                                                      SHA-512:5C1C26CFD32BD3C0827647716C6F9A1B76795B87EC4608EE0FE56EE5E32B05ABF03ADC12BED56B480A3E2200D9878D2474E419E250C11FE362559C7060EF7C5C
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..~3i.......9R.C.......y...T_js..+....tk...S=..0In..2.}y..J...!a3.eH..ce.t....R?.@.-...=.p.m.xc...y ..`.V1....U.5...?.8.G...|1..Z..4.^V.x.y.Y.y..+..k.....x.^...+X...mn'.>..<&{.k.t.j..4Zi.Y.r....5.....l.Q.$[r.8...S...aQN...A....'...1....I...:..I.$.2C...C..\...m..N.^....^_Mb.gV.b....}*{.^V.I.Q.....6..*.z....E....{.omg.y.......y...Vu.Ud-..?J.+.R.P.)qu21]....

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[5].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):10098
                                                                                      Entropy (8bit):7.952630443089302
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:S0/MxBe5RKLihNWNvQwfBQezzPBcMmutgDpRf4myZF7V6Hwa:SKMxBDuhNWNIKZBZtapJ4j6Hwa
                                                                                      MD5:6061463F6A91ED49DDDC67870D9E2B49
                                                                                      SHA1:37AF15D861A76CBE841A6EC711ECBCAF8C1A567B
                                                                                      SHA-256:A5574DB9596357C36D53DCC64D590903D7EB15E06B50DF777AD500555AA70647
                                                                                      SHA-512:9A1F9F9DED9E934356EE0AD00F58A0F1DAE6C1F631B165B3C146BCECCCE932042E8E3C75AD3AB36D747FD751771500B1EBE352E62B4FD464F6FCE0ACB4895748
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..>{.H.3.C..3..B.{..&....au.*.>...B.jM.../6x.G... .Wu...j.ym.Q.k!..&.....g.=..y..U....F...-.n=..n.3U.7.....3eP..2.Q...[k..i.+.......o.a-......V....^..#a...UF.oDK.m.1.S..7..W^....t].4K.....]M...5.g..F+h..I...S.n.5...[7.g.)..S.5U...r.V3.EFI............4.....U....G...)X..<Gu.BQ..}.9.F.N0.*.<;....}..g.....9......J..#.dzls...t....w..f...M.y....|...F.\cn+.,.&.r

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[6].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):18680
                                                                                      Entropy (8bit):7.963054635085045
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S4Wk1ABtDR7bL3YUi8JoIT2Mi815ZolaMmXn7umbzxtZ:Se1MbrtBZT2MiM351
                                                                                      MD5:D5C03319D4D4D776A1B7DA5A8E2BD696
                                                                                      SHA1:1F346519FB42464B7DE15C18466FDB4C12F17A23
                                                                                      SHA-256:82F796E108E4A36159F5156DC7D3FAEA9CC952E633D77EF4060E3AEF71B637CC
                                                                                      SHA-512:9A32DE1FF645201DA7CD1754B2C08DE84AA6B7D3632F79F44E519D376CCF6FE5FBB739734D6A4EC370F50130B39A244EF8CF68529458B393E4CA200534487EC4
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...P...K.6sy..]QC&.W.. ..{../.V.P$RG..7..\T..jw3..-.2\K..%..?.~n.z......\.y..)m`F...._.p2@..r..V.=...c;Mh."u......3]>...(.b..e."..y...G.Q.....[:5.A....=k...Z.FQ..g]..G.......Z.#....q...../a+%.......j7.$T.....b...(.....S....1.:.V%....?.E?..tD..c&T..$..p:R...c....1.A........T...T......7k.....4....BF?.5b..A..\......O&....P.T7.u.<~Ur..%.....@U.2.%.D.7..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[7].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):22792
                                                                                      Entropy (8bit):7.9636665372840065
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S1MMXKIHue7bZlRw1GqP07nywla1w6NjoNnllEMutCG5ltzxrzT+ymNKV1cU8ENO:SXXRbxy0byvNjojqMu3txrBmYZw
                                                                                      MD5:15B8B9E88F3B5A575EB4215D142B8E4D
                                                                                      SHA1:C89D443F42FC4CD6476DE37935786C447AE3E8F0
                                                                                      SHA-256:1D3F55F6D4A458DAB23169C1DD9D51079177E3528A682881FFB8E9B6C8FE32B2
                                                                                      SHA-512:4FAD502236A3612FB49045157A5414C8E3FDBF25A3A3935E29CD1CA9F7236C0CDC17D5CC819641BE77059EFCE43C22EDA366CEA25FD5D9EF220B00F851ABAD83
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..|E?....G>V.d^?....H..t.......,bT..1.*....&...(...Ly....L..q..S9.....m-..<.^.Zi.2.f.\...6.#.dj......Im..Md..o.i.......s.S..\.'t.!..n..6k....=*..!......pH.F{.6".....,..cU...`..%.~9.?.n./.hX.@%L.5..Fe..5...9%....&..+.g.tn..wp..,.s.....Sv....y...k...j.gr.Q......6...j..S.......T...TU?.]....lV..eN..<.F....Q3..~......<.i.W...o.G.^..x{N.t...p..&3...........&.-.c.%..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[8].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):21663
                                                                                      Entropy (8bit):7.963809209928386
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S+C3118frDwxnlDlU2DItz9UOMp+Ew7PfHZAVj/DAxeGm61L:Ssfvwxl62Do2OYoL5AhLim61L
                                                                                      MD5:CEB9E6D875DBEA5B863BC04967B07F2E
                                                                                      SHA1:2BB2DC4697CBBD3446A69A802346B59BAAF1B78C
                                                                                      SHA-256:6AB733ED2A1FD4A41BA2B78C8EB0FEA01784C11C7C2B4F6A7C758E8A6A3A6961
                                                                                      SHA-512:D5D577A6D79AF6EF592566839EB274AEAB19A31CDB810F745779F96902D590A1F0A822E806AB5BCA7282B03996C738346017EA9D0B81438EC7E31D6E472C5885
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........sj:t...,wv.>P....pA..=k..U."...................kX.Bmn.r.3..q.6A..!...^.P+ekmy.6T..F....~..g.n...s..5..#6D....M/.^!....h..(nN=....,.!r..D......Ht....3..#.|......ytd.;+G7.2......[.n/....B.*...^.}...:.....l..!Q......Pj........N.o<.....i.B}.n........=.Jo.?(.,...!.......N+OI....g..m..L..w...NX.U...i.U.$.l.....Y.`k.d...r..5...3D...... ....1......@sV~...,j>

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\th[9].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):18070
                                                                                      Entropy (8bit):7.963410061286022
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SKYfdfM3YsT/cSjZNgBdyGZmOv42lOsFHVgHWRKFWU6pRs4Rc:S5dIxZNrGZ9v42lOQ1sZFWU6jJRc
                                                                                      MD5:941CF5DC414641B976E2C66FCA803E43
                                                                                      SHA1:1BD2E357D1B64BF49B7012A10BF03BECC2891A00
                                                                                      SHA-256:13EF2E7A9DB07E0E30148EFCE333E517551735912339B281335E83DC709109A2
                                                                                      SHA-512:7280AC828D8EFC781BC3099215A13687CE749013748EAB9A339059AEDB27A9AF83B411F5B75B4B462D4C16BC267CFC97023648E00049874A54BF089BD48C0A4E
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....J....._... ..\..7..>....[$~..R.E.~}.T..Y...8+.V!.k..f_~k....P.4..R...p..S....:c.V....`O9.-..Uk.....=.s..t~.ni..g^...a$./.0kcj..w...?78.,VH.,...u.\.jW.........M..qP]...1....O.)...B..\.kR..H...j#..xv.J.Be}j.Jn.).,*8.....i.Yw}.i..Nx...../...k..12......N.....J..@s.h.bH...TWS/.v7...bVa.4.u..2.l/...Z.Q...$.=...0.....KR..D.Az..!W........I+J..z..[jLG.})...y5.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\845RA19F.htm

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:HTML document, ASCII text, with very long lines (57699), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):193100
                                                                                      Entropy (8bit):5.46336452301461
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:fMkgFLF3xsDWH+BCDheFhWNyhxpAOukO/xY2:0kwF3xsDeDheiNyhnAwsxY2
                                                                                      MD5:FA2C25D0CC9DB3827C1C6E15D9E0ADA2
                                                                                      SHA1:AEA36669AFB98CFF7B2A961D7613059A2A26FE98
                                                                                      SHA-256:6CF41371A7CB131581DCB58868467F61A5CEB4D40830C4B254056A5C20868AC2
                                                                                      SHA-512:027E7162F7BFAFBADF5BD037CCEF791F323399BF319A723E4565936B7C6249931F8D7D4B8634AA56F6772EF76E2975D744FB3A6B52070C77E816C037EF300CEB
                                                                                      Malicious:false
                                                                                      Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-shop-staging,prg-hub-staging,ads-controlcbceleb,cprg-rvr-ads-dl,prg-rvr-ads-dl,cprg-ctrl-viewspage,prg-1sw-sa-ntf-ddp-c,prg-1sw-sal2coldctxbc,prg-1sw-spdptcf,1sw-esprt-shlnc,prg-1sw-header-event,prg-1sw-headrc,prg-1sw-cdelay,prg-blck-web,prg-1sw-mebc81,prg-1sw-tbnewicons,prg-1sw-dibdgc,prg-fin-cl3ad,c-prg-1sw-curff,c-prg-ad-more,iframeflex,prg-adspeek,1s-winauthservice,prg-1sw-haltmmcall,prg-1sw-nommcall,traffic-pr2-news-cf,prg-pr2-widget-tab,btie-ad-ctalog-cf,1s-ads-ntpcta,1s-ads-ntplogo,prg-ad-cta-logo-cf,1s-fcrypt,1s-ntf1-flupc,prg-ctr-pnpc,preprg-1sw-sadwf-c1,prg-upsaip-w1-t,prg-upsaip-r-t,prg-cg-search-api-c,1s-rpssecautht,prg-1sw-p1wtrclm,jj_fac_c,prg-1sw-ofett,prg-1sw-ofet,prg-pr2-icbdgtt,prg-pr2-icbdgt3,prg-pr2-tbnewani,prg-pr2-respsection-c,cprg-ad-dtag-agv,prg-1cashback-logo-t,prg-unified-pclick-t2,1s-p2-promotedondmd,1s-wpo-pr2-promad,prg-2unified-exp2,1s-wpo-prg2-sdmr05-c,1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\AA13slaS[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):678
                                                                                      Entropy (8bit):7.549466969667681
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/78/uAQzm45uU7BTzRHZogsxGQZ+asN9cQyPrTEJqa9zK4gMRUYsrpbwMj44HM:wAQSlUVT3oTxbSxIEozb4kpsf61A/
                                                                                      MD5:B9A6161B4DA6AABCABE306AE2AED7DE2
                                                                                      SHA1:01FAD80083112BB98F8F051AFF01EFBA9C5C71DD
                                                                                      SHA-256:D0A862E121F1F61B8E6A4FFCDFBFFDC63299D6DC91F15B68BBF00B62C7D6F118
                                                                                      SHA-512:8566DAD71DEB6906BC5B431B94BC8B9AAF7CB4A14FC173E7D13B0D8A910ED1B8962ACEFAAE41AAA732341D9F3DCEA4525DBD5C7571AE4007875B4BCBCF7E4110
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...;IDAT8O...O.Q...SZ[.u...].E[KGo.fn.jK{/[.P/...Jz1RY...D6.=.../a....#....7.......>....~.}.9....'....&....g_A....G...6A:.O<EY.~...H..y.:.E.y.a....<9A:...J<.....#a3....e.Z.it.[h.%'P.r(....|.\2..D....#..=.!..l..UW9.f.c.`m}.e.i.qRW..k>8#68.l....../Af/.W.@...*g3..g.$.L..P.N.7..F*!v..>~..x.2...wa.......hg..{..w...n.1.......l.,..`d~...v...g..5.Q.W..*....?.'.)..wJ.........!..A..^LE.....}s.,.1.e..$~B.#.B.S@.>............E5..2......h..R..\8o<..].~*..+.c...-w.,....9A2..e..*w....j.....0e......i.%'`.2.Q=.D...P...c...@..=5..r...{..<..Y.1...x.mF..V....((.w.?9"....0.....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\AA163mal[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGB, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):4532
                                                                                      Entropy (8bit):7.847005861375932
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:Qp2+NlFQVjo/c/Q/Zb3PLhZXQhfoebTRZnn+6S4jjsLY:QFFSOcohbDhMfoe5ZnJS4jAU
                                                                                      MD5:A55A58D6DDF9EF87C36C74C67A18A717
                                                                                      SHA1:112CCFD2DD37F29261F2AC8F3478EE348BEE2539
                                                                                      SHA-256:F84F1688EC909E41E861551E4C6A2282685BB6F0BCF09FA6AD3B54466C8CAD2E
                                                                                      SHA-512:99B0ADFCF6CB5A7548379E9E4FE12AB8AFBF6FFCE1F1D94899878D75F27B98DC3444BF07329235A8DA68B0EEF1B2F3D703F3B5C370E323A87CD87CC4B3E9FFA9
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`.....m..o....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c000 79.171c27fab, 2022/08/16-22:35:41 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 24.1 (Macintosh)" xmpMM:InstanceID="xmp.iid:7438F46685F311ED8499B917C1DF055F" xmpMM:DocumentID="xmp.did:7438F46785F311ED8499B917C1DF055F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7438F46485F311ED8499B917C1DF055F" stRef:documentID="xmp.did:7438F46585F311ED8499B917C1DF055F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.E...."IDATx...X.W..3...!r.(..b.E..U.O..b....j[.um.k...z.n[].V.s....k."...xq......&3./...d.$.~}.|.....7..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\AAJWBHr[1].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 800x800, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):17025
                                                                                      Entropy (8bit):7.3506001851756135
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:zd07QkNxvyUF8scALa3/nE8UoHAbCcZ+OEn:xI5Nxh8Ym3s8UoenZs
                                                                                      MD5:EDB17E70F4972BD8277E868EBD33CF8A
                                                                                      SHA1:071864D39280E456149969382C7493C6A5B6B26C
                                                                                      SHA-256:59FC5069156EB30E170B45262914694F3CD2B98CC53810A40842A63E95D3290C
                                                                                      SHA-512:B1C42E0E502D0674C49E7057FC4F47D61402F12D6DBDC2FAA6EFE5F3BA03898B5055CD815AD65E3D2749C6818079982E6773303277F44375CD48EB4C07C065DD
                                                                                      Malicious:false
                                                                                      Preview:......JFIF..............Photoshop 3.0.8BIM..........g..6ERxT3HzlnDbaFoQwVoF..(.bFBMD01000ac00300007f100000da1600005e190000851c000061220000cb29000062310000ec3300009f36000081420000....ICC_PROFILE.......lcms....mntrRGB XYZ .........).9acspAPPL...................................-lcms................................................desc.......^cprt...\....wtpt...h....bkpt...|....rXYZ........gXYZ........bXYZ........rTRC.......@gTRC.......@bTRC.......@desc........c2..................................................................................text....FB..XYZ ...............-XYZ ...........3....XYZ ......o...8.....XYZ ......b.........XYZ ......$.........curv...............c...k...?.Q.4!.).2.;.F.Qw].kpz....|.i.}...0.....C...........................".##!. %*5-%'2( .?/279<<<$-BFA:F5;<9...C...........9& &99999999999999999999999999999999999999999999999999...... . .."..................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\AAUzf9j[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGB, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):3285
                                                                                      Entropy (8bit):7.705080384196564
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:QT2HmAJ81sGZxBXaosSrVJd8XIlJeOh4eb:Q4LksOrXaosSjoCJeOhRb
                                                                                      MD5:9C2E563A6D004BC3AC3ED6EABB787730
                                                                                      SHA1:6F714001D3256BF24DFB1301BE7A520C5189C92D
                                                                                      SHA-256:09C2B661E297ECD44D1BAA8E11F7A919B1F5DB134F5C8849A7BFB109B5389464
                                                                                      SHA-512:589570D5DFA10EBA18AAC0724A3A42BDC336DC9EBEBA175D5276D801790800438CDB2A8A2B320DF2E8CCFDFC9B06D348DE4A259D08D88380DA0BC79F82B67AF2
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`.....m..o....tEXtSoftware.Adobe ImageReadyq.e<...*iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.2-c001 63.139439, 2010/10/12-08:45:30 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop Elements 11.0 Windows" xmpMM:InstanceID="xmp.iid:F1BC41989B0411ECA518C123D09AFFBF" xmpMM:DocumentID="xmp.did:F1BC41999B0411ECA518C123D09AFFBF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F1BC41969B0411ECA518C123D09AFFBF" stRef:documentID="xmp.did:F1BC41979B0411ECA518C123D09AFFBF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.:.O...AIDATx..{.\U.....s..ngfw...ni...7.Ha.V....J....1&..C..l.... .E"*../.$..J...........nw;3....s.EK.cI

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\AAVmfsD[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):2963
                                                                                      Entropy (8bit):7.889847209280111
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:C/6SJvvvvvv5cLXWPue1/+sNXV6FTRkGbVBh0dgGuM319Eh2wu/QhiAoDkURg5tu:CSSJvvvvvv5EmNXQFlDMTUiAoDkUq5tu
                                                                                      MD5:CC3EE1B924415DFC5C305101D1A430F7
                                                                                      SHA1:BA60E771FF9AE0A1382195B0DA97B5C738941FBB
                                                                                      SHA-256:E580E1C087DAA1885D8736208E5F03A573F77733F975E3945F90A5AF16909D77
                                                                                      SHA-512:6305FB83BE747701B5DDE39D304A73D6EF003C70260BDA4B16E34E7AF37E1F5AB3410447E49D26321DA5343845622F4555F3CF0B434B3C247EB3C05082F43403
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......w8....pHYs.................sRGB.........gAMA......a....(IDATx.........==.....a.>.9..(HD"..A...3.D..E@$r.(....".BQ*..).FA..9J..( An.F...g..7.=.3..n......f.M......}.}..\h]W.D.6H."....@0R..H..#....@0R..H..#....@0R..H..#....@0R..H..#....@0R..H..#....@0R..H..c......g..W?0.D..i.....M...T.[.*P.5,.j..pt......5...K...n...z...@...7#...t..C../F....j5.a..C.Z....gp..Q.b..#o`/.....p?>..C.mY>.5r.!..M.A....~...7...w.......~....Ek.VN.....D......@.Z.L}.sg.=|.V...P.z....p.....5.....:....c..._.(.g..P...-..}4....3..f-qut.L..............m..'G.*...[.Z.3.`...p=..;.m..r.A$.........E...`O...f.Q.._?d2.....8..I`.".W...Ox.?..b'.$...r+.S./.}=..B. ..s..L4...F...N\...;.YZ.63.];.$.Z..W..`..T.A.....k.r..Esi..`%....G..iET..m.......L*6..={Cm.$./#.d>..D.ED...rU8...t.......~.fT.=.Ft.n.%q.(.,.u..'.a.R..=`ox..F....)..<CF.....O................F&..y..?|.i..?.M{..-5VA.....;....RO.(.mdV.2l.=z..=q=..2?m.vs...5....N.L d....sD.|cj..n_.Jv..a3.FM..J...:...gj.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\AAqPeGY[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):18952
                                                                                      Entropy (8bit):3.289177745744127
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTpWvkijOFnNGQkeGfNXrNXVhsc5MWZrUWIWrlS:bSDS0tKg9E05T0kiSFnCV5lxU2xS
                                                                                      MD5:F4E3E7B756FFB9E2DA841B23F2A33E98
                                                                                      SHA1:89062564FF18819712311F25CDF274C15B41E0E5
                                                                                      SHA-256:975F1C0897F5F262B091B13DABD3136B6D1B7E04CC22845B1C013DBBA084B219
                                                                                      SHA-512:9490987A8FC87BFD539DB7DDA79C6553E0D0BF2910265DA9D2536C6C0F71598E2DC59DF7307AEBA65E0C76F7BA02953A8F75C502679D3CFA71FC27F5F1969FE4
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\AAywHbG[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):18737
                                                                                      Entropy (8bit):3.264222984888402
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWmUoMAYQxNXrNXNsc5Mt4tCHaZIgr:bSDS0tKg9E05TKk68Ar5btCI
                                                                                      MD5:8FCCB64CA012C151FA2F490513AF4E78
                                                                                      SHA1:567ECDA93342324A45FC4C84CA0E7243787B0902
                                                                                      SHA-256:7A97E24CBCFA529B2781C919396C4E64CA73D6703242193D9B125010D443E07A
                                                                                      SHA-512:781A8CE4A791E64BA4E2B3E14EF37820F10A845ACC46DA3413293A49939F0BEC27095FB1A079664617BA76D544047A6708F2EF92A1CF12A2DA6BB88BA5F50795
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\BB1kXpez[1].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):32768
                                                                                      Entropy (8bit):7.247381939128456
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:fe4guXWAi3fJrePjdAsVpb1W2UnpZkcZv6lMGA:fpGAiPZyxpBwntZSyb
                                                                                      MD5:704EB4A423E787E2F4EF1E16DC1A5752
                                                                                      SHA1:51585056CB96F81338E4BE0C338E40F5F4A1C494
                                                                                      SHA-256:00B64CCDEC67167CEA94866FB0EA92D83F03C9CB4CCC66B15FF597F7645B8A0C
                                                                                      SHA-512:0D25EAB649AD422AF23DAFDE8142DF5B3C477F779DB09128B0007A7673C2CA09A5788F9525ADF058F1C74C883B2288BEECC12B8A2FCB253031EAC22511F346A9
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`..........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..........................................................................................................................................................................................................................?..?...N.5..K.o...Ooj.ZY.........09..3.....G..7....>!i..d..$U....{.j.....v.I...I...w.S.Z.....MYo.>ZH...v..c<.K.pkx.K..)..KQ..+....77E....P....x...I`+.p.k.....)..d.......N...;...f.6......a...u..._......Cn.......>.X.....:W.xC...%[|.....C%H*YH.AH.A...4<A.I.z.."..o.C....@.....E.CW.....{\..J...''.V.I^rK.....-87...}R.'..K....G.y..Z.h.S.k..*.%X..=.(...V.........KQ.V/Sd..D..;.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\BB1o6mSt[1].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):32768
                                                                                      Entropy (8bit):4.946437165330794
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:f+2A9bXxmNAsfy2jmfhzkgVS3Xr7n97tkd58PHNkOH0VKO:f+d9oNP1Kfh4gOv5tkd+HNk
                                                                                      MD5:14FB57F15E59D529A5C2FBD70E4C1873
                                                                                      SHA1:534A6408E508F4C04911E43788077E07067A4B19
                                                                                      SHA-256:D5613886C9B48984DEABED183FDB3755AFEB2BEE92EA8F8E6724A80D1583D4FC
                                                                                      SHA-512:2A3CBFF5A09F3EFA23190962A61D34F652E9E1F8E8E49C0683394581CD2D8351249C1D3573711C0640991A2FFD509CE631020932F97DCBDC619A3DF5EF7D2BD9
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`..........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..........................................................................................................................................................................................................................?....H..k..~...vw.f...WG..U.g$........6....mq...[Gb....k!c...Tfh....[#.b....,..-..U(..YH..u.*9FZ.$. ..d..G.xS..V.}DX...MSMt........]"e....N.9..m..|...Y.'.;\w.!...>W.JQ]G.YH..~..$...{....}..S.s...".._..i.9v.....f?t.T..............4{.........?.....C.W.X{Xw.i.D.......T*..+........8...W.z..=.'.._G....O.d.....eY....v...xZ.(..>.U....6...L.....`.-i.xW..e5......U'...1.h._^K._...Y.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\BBACBCB[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):18737
                                                                                      Entropy (8bit):3.2062466761310993
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWmIKJHxNXrNXNsc5MVNzhpA:bSDS0tKg9E05TKk6L5gpA
                                                                                      MD5:23961A289D57B15CE78E725C8DB95124
                                                                                      SHA1:AD22B0DF2C88DCF74C75618042809EC228660100
                                                                                      SHA-256:0B428DC30D2F11B851BB4790799644079FD5102F760496BCEE1DDD5447B3233E
                                                                                      SHA-512:D90984851193DA69AEF3FFA6F5F2710D230533205A190619A47F006EE9D6CE92085B0E04C23BED04269057B3620B3CA732679A1EE4F1134B6C60C7498672CC53
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\BBI4MeJ[1].json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):4630
                                                                                      Entropy (8bit):5.318915974157827
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:YYP1rokx0ecBKXFFaZuVKIqHuzj/+Am0rVKIqHuqKXFFWkL6VxIqguqKXFFGEVc1:rwecBC6cj/+Am0rsCVL6ACsE8DuVRmR
                                                                                      MD5:A07D1ED6FDEB8FA6CC0F66124A9C7546
                                                                                      SHA1:80DD6995092AE8A721D970D4C351A945CDE295C0
                                                                                      SHA-256:2E4A8D9236CBDF966C738B93305DF27FBD209B74D2DCD588A2D951FB14446DC2
                                                                                      SHA-512:9C734B4F5F8D1014974662DDD7141EF054AE8B40625326BD8B29519263F7B4E804C654514A865B1A81036A6E131AA9B714D97356D55352C4399B9E9646CD5038
                                                                                      Malicious:false
                                                                                      Preview:{"$type":"list","title":"","_isPublishingLocked":false,"_id":"BBI4MeJ","_name":"MGXStoreWebPromo (old Backfill list - DO NOT DELETE)","_sourceMetering":{"isMetered":false},"_lastEditedDateTime":"2024-07-05T14:58:36Z","_links":{"self":[{"href":"cms/api/amp/list/BBI4MeJ"}],"parent":[{"href":"cms/api/amp/section/BBREXz4"}],"children":[],"feed":[],"provider":[],"references":[{"href":"cms/api/amp/image/BB1nLk51"},{"href":"cms/api/amp/image/BB1pieth"},{"href":"cms/api/amp/image/BB1kXpez"},{"href":"cms/api/amp/image/BB1o6mSt"},{"href":"cms/api/amp/image/AA16OGZj"},{"href":"cms/api/amp/image/BB1pmK2t"}],"section":[]},"tagEvaluationGroups":{"_tagsHash":"3145739","tags":[],"vectors":[]},"_locale":"en-us","sourceId":"BBlbsHE","keywords":[],"facets":[],"labels":{"category":[]},"list":[{"link":{"href":"https://www.lendingtree.com/?splitterid=home-equity&cproduct=homeequity&cchannel=content&csource=tradingdesk&esourceid=6475206&mtaid=2D09E&rcode=10000&s2=borrow25k7125_whitepickethouse&ctype=sponsore

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\BBqlLky[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):18737
                                                                                      Entropy (8bit):3.2351784453736747
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTmJkEWmFmNc+vxNXrNXNsc5Mvos13/8Hw:bSDS0tKg9E05Tgk6A5Z8PT
                                                                                      MD5:D32C9524DBC9E77D28F03E91E9F0EF41
                                                                                      SHA1:2207C259F0867F226E59E951EE8CF7489E3E17F0
                                                                                      SHA-256:483BE445C9063E252030650CCA0C4612999B4B62BC64D9EFF360B17A7914D149
                                                                                      SHA-512:28745F72FD74FE61B99595857637C4E2A4E9F30822D59122CA6EED2B336C1E3A94A71EFE9F700B917E257A55E13D36D9CE91A7E8F92C45A09C7F38C67A1254AC
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Icon[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):533
                                                                                      Entropy (8bit):7.415663553371965
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/7Ya7/6Ts/o7hJW8/t8oX8qUkUGGVIXC/zoZ3VYZwWSVR:E/6pzWK+q/UGGMC/zw3oGVR
                                                                                      MD5:B6162D100379E7F4EF709BA5C26D1BA8
                                                                                      SHA1:AEA4244C56F00AA26064134863157A6EE9D7ABB9
                                                                                      SHA-256:DCA74022BEBB4F12F8EFADD226C9413CAFFF9193420D604DE8A398642172AACA
                                                                                      SHA-512:CC64207C45F85255F34A157C9370A46EBD4A2B3A674E639838EF7582FD93D68F91A275C577E2FC9A46674EC765D8CC43A5BE28B281FCD5006D38D0C6F02E2058
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...<... .....N.......pHYs.................sRGB.........gAMA......a.....IDATx..=O.1....$....1..7.....p32..)..Yw..p..IL.$qT'......1.#.h..j.5...9...~...w.....oe.....]8,..|..........``.$a.K.&Lq........D,D..8e.c.....fQ...u..%.(..b..8A......,>@6....Y*...9.(...d7........,!zr.N...T}.....j...NY'..|.=N2Q&<?3....@..-.e.h....F#..2.v...n..!-.e..&........%.e........y.c.y,.e........4'40.t"...B.........D.../[D..6j....^>.....g...3...5<Hv.H../M.+Y`.......OXw<a.al..aF.@.../.E....=;S.K....s.......IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\WH2EF8GW.htm

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:HTML document, ASCII text, with very long lines (57973), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):192826
                                                                                      Entropy (8bit):5.462736146402045
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:ytrvggFLF3xsDWH+BCDheFhWNyhxpAOukO/xY2:cvgwF3xsDeDheiNyhnAwsxY2
                                                                                      MD5:5CBDDC12CE4BF583F715DCD2E1107A6D
                                                                                      SHA1:4F9B35D2B714EAAE194D1573804BE54A61CAAB7B
                                                                                      SHA-256:516D524E04728F59005B181D1D631C08E9849E05E35141C1E97A850BB37D5095
                                                                                      SHA-512:CEB611D5AC7679E6F3DBF0C3E87166C44277448FCAFA62E0F2C37E25FBCE1CE2E3FEBBF7A6A8D4F38AA6EDFFCDCEB1B05A296EC2F34622263A396A351C41C7B7
                                                                                      Malicious:false
                                                                                      Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,cprg-fakeci-kill,prg-vad-oovp,prg-1sw-sa-uiev3at3,prg-1sw-saqpowerincglbc,prg-1sw-spdpt,prg-1sw-rec-ttvr,1s-wpo-pr1-noreweight,prg-1sw-header-event,prg-1sw-tssctrl,prg-1sw-sdcards,prg-1sw-plholt,prg-1sw-rvplhold,cprg-c-blck-web,prg-1sw-anicomp,1s-eaop1,prg-1sw-bknpani,prg-1sw-tbnewani,prg-1sw-curcf,prg-ad-more,iframeflex,prg-adspeek,1s-winauthservice,prg-1sw-haltmmcall,prg-1sw-nommcall,prg-pr2-wcf-c2,prg-pr2-wcf,prg-pr2-widget-tab,prg-1sw-evtp2-ctr,prg-pr2-rtcon,btie-msanrr-t07,1s-fcrypt,prg-premier-pr1-t1,1s-xapentprong1,prg-1sw-pro2pre,1s-ntf1-prdnoth,prg-upsaip-w1-t,prg-upsaip-r-t,prg-1sw-tt-wsstaging,prg-1sw-wsstaging,prg-cg-search-api-c,1s-rpssecautht,prg-1sw-p1wtrclm,jj_fac_t,prg-pr2-headcon,prg-pr2-respsection,prg-ad-pdedupe3-cut,prg-ad-pdedupe3,6jcbh698,prg-1cashback-fulldmnd-c,1s-ntf-fyworthc,prg-pr2-cb-pricetag-c,prg-2pricetag-c,1s-wpo-prg2-sdmr05,prg-p2-dailysmy-c,1s-notifmappin

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\desktop-shape[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 7 x 13, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):197
                                                                                      Entropy (8bit):5.986656121330302
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:yionv//thPlyyta2/uDlhlp8Lts7CX9/2yx24lSXqU3hjg/BFCb0cCHxlbVdMaW9:6v/lhP1b/6TsR/R0Zjgz89CXVdMndp
                                                                                      MD5:34760615AB0C180EB4B48739297FD0F2
                                                                                      SHA1:789438D09CC27A08879B1A9686C82527270E7C24
                                                                                      SHA-256:360C33D59E7358579601909D4CE91F1BCABF9E07BEB8F69D50C226D7D8F91260
                                                                                      SHA-512:1CE7E574D45D123C6B52119907E74D71B842F1CC380D79AEF876FDBC9FDB663F385BB4191650813D2E66EFE24265FD36EC944AF95F372C0413EDCF11361CA666
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR.............e.t.....pHYs.................sRGB.........gAMA......a....ZIDATx......@.EA.`...U..1\.......X]...G..{..HU.4Uj.`..O .3;..\..!3...q....[s./.@@..p...>.`(k..2.....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\favicon[1].ico

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):758
                                                                                      Entropy (8bit):7.432323547387593
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/792/6TCfasyRmQ/iyzH48qyNkWCj7ev50C5qABOTo+CGB++yg43qX4b9uTmMI:F/6easyD/iCHLSWWqyCoTTdTc+yhaX4v
                                                                                      MD5:84CC977D0EB148166481B01D8418E375
                                                                                      SHA1:00E2461BCD67D7BA511DB230415000AEFBD30D2D
                                                                                      SHA-256:BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
                                                                                      SHA-512:F47A507077F9173FB07EC200C2677BA5F783D645BE100F12EFE71F701A74272A98E853C4FAB63740D685853935D545730992D0004C9D2FE8E1965445CAB509C3
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D.*.M.*.............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\jquery-3.6.3.min[1].js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:ASCII text, with very long lines (65447)
                                                                                      Category:dropped
                                                                                      Size (bytes):89947
                                                                                      Entropy (8bit):5.290839266829335
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:ENjxXU9rnxD9o5EZxkMVC6YLtg7HtDuU3zh8cmnPMEgWzJvBQUmkm4M5gPtcNRQK:EcqmCU3zhINzfmR4lb3e34UQ47GKL
                                                                                      MD5:CF2FBBF84281D9ECBFFB4993203D543B
                                                                                      SHA1:832A6A4E86DAF38B1975D705C5DE5D9E5F5844BC
                                                                                      SHA-256:A6F3F0FAEA4B3D48E03176341BEF0ED3151FFBF226D4C6635F1C6039C0500575
                                                                                      SHA-512:493A1FE319B5C2091F9BB85E5AA149567E7C1E6DC4B52DF55C569A81A6BC54C45E097024427259FA3132F0F082FE24F5F1D172F7959C131347153A8BCA9EF679
                                                                                      Malicious:false
                                                                                      Preview:/*! jQuery v3.6.3 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,y=n.hasOwnProperty,a=y.toString,l=a.call(Object),v={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},S=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||S).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\logo[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 1633 x 708, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):27928
                                                                                      Entropy (8bit):7.701164569435742
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:xSufGKAfaoovahBv4apFM4lvzDpqFosGd+Up9FIK0B:jfUMve54E//fCiIK0B
                                                                                      MD5:862D29153222B9B15C3C73B61B930335
                                                                                      SHA1:391BEBF4BA8910B718C5516491EB1C7D32D4C187
                                                                                      SHA-256:3EC8FA41DCE2684102F4A7B2D993388809CC2F6AE0616807CA9E3D94E6D19AC2
                                                                                      SHA-512:6FFCB08DE27DFA571C8EF35E7F017F2871482581308C10CF38EFF9A507D02325222B899D667FC86227C2985ACA05F17C1CD33EF4163BE3442F70F8907BD78404
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...a.................pHYs...#...#.x.?v....tEXtSoftware.Adobe ImageReadyq.e<..l.IDATx....u.7.0.A......@...T`o.f*.SA...T`...+0UA..BU.X....a,.......u..:.%..`... ..........a. ......................N.....o..z..=.....r!..^..Rr.....J..b.{..x...9^....u.^.?+.......!..kQ`.....$YNo\/..km.4.n...........1H.0\e.$]^w..K.^....r{I......0.I.v.@!...6.r\..JI..n..9W......<.$.O.0.3]...W.|..n.B&%c.)......cI...e.K.^4....ZX!......C$a..rl.x....|%..I...x.]........I..m..a.?.vml76.O.:.lW........0|..!.M..D4.%..Yt..1+......h.$........w..c.B......&I..._.e..R.%c......#..b.K...d.....@c$aZ*....&..R4.F2........0-.r..n.|y#..H.Y..VB.....P....n!......MZ..W,.E.........>V..Z.!..E.ND#{..:...\(......!.Sc..0....Dq....eK......(.$LM.i.K->t.d.g......(.3a*.~.......x.b........\V.^..C...A.....Y......@Y..)X.a.?V..L.R.^.~+......e..)T....x....2.=..y..............L./..!..:^..}.........Y.S...i.Xv.0-K.b>.p&......y.......r..~./>u.U1+........0..!.:..x]...Z(......#.....<~.....s..........

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\me[1].json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):144542
                                                                                      Entropy (8bit):5.316586265819039
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:eHRxMCRpypdplRX5tj/SVy7no/z/KJZrGZrhZraCJey6YrIc8RokO+:exxMCbA/ZWy7ormOD+Zrc8RDO+
                                                                                      MD5:9219A1DD17391F48E3EC05439696BC8B
                                                                                      SHA1:80705F60E6CD579C33C9276A5968D75B61CA3410
                                                                                      SHA-256:675C50140C96336007B25BA5E744A874A45AC9EB20F01141C5678DDCFE84175E
                                                                                      SHA-512:15B5E07B2CEFD6F2F212990E630EDD60ADFF43C994146F7901CFA4D8F061A8611D0E1F6C139EF61B0F23541C4DF38174BB957090C42C86C5A1140498F972BE4C
                                                                                      Malicious:false
                                                                                      Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=1deb129f-8730-4bf0-b79e-0e4b11ee3de3&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1pxuzQ","type":"article","title":"John Cena announces pending retirement from WWE competition in 2025","abstract":"The 47-year-old won 16 world championships over his nearly 20 years in the WWE, going toe-to-toe with the likes of Kurt Angle, Triple H and Dwayne \"the Rock\" Johnson.","readTimeMin":2,"url":"https://www.cbsnews.com/news/john-cena-announces-retirement-wwe-competition-2025/","locale":"en-us","financeMetadata":{"stocks":[{"stockId":"a264hw","score":80000098}],"sentimentRa

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mobile-image[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 375 x 180, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):23972
                                                                                      Entropy (8bit):7.983082688064765
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:OQCmhN3Hqqm87sSOvS8PJKCqedNV7TMzNjdpNQsjtHnUSQkBmSfYuoq9Dgt:dCmr3KqmIdO68MAnnWNjdpBSSQVfWDgt
                                                                                      MD5:64C4757048F068394817EE126FDBA8A6
                                                                                      SHA1:3610DC2EB5E3C09809E94BD0694A06C7A51580FF
                                                                                      SHA-256:A9FEC8F56726ECA81D0600220A6B168FFF112A5283741FD5EC63509AEDBB51D5
                                                                                      SHA-512:373EE45E16D231B2FF8A897A357A52A58B63430E0BCF728867879F2E10E55C631589D6F63C1675E2E40EB1EF7CEB59B15DF18013EA0F3FA352A3B36296F14DAB
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...w.........o.lP....pHYs.................sRGB.........gAMA......a...]9IDATx..g.$Wv&....H_......n......1...g..r.IQg.]..?:gWG.;....s.#........;.!....a`f..n.h...].dV...{.......j.C........|..}......................G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 .8lh...5.Hn.R......j'R.;|j!..I\7...Z..G...BhB.<}.....G..X..-...w"..]f.v~..+.HI...#._.k.S.k!t...n..;...6..`...G...L...../...1...Hz..:.....j........a.."..M...(..u.L..+m.3.">....i..pq..v.!..p...m7.gH\.v.{.....j,@...w:@.......v.....>).w.......G.r..LKmE.@........K...v0^........v..b...ja....@t`..u.......{D...}./}...}g.NN. 6..]...PS2.q.Ge<..v ..D....B..B.V...D!.T...@>G.....u.m4.Z.XZ.\X...j..F.Y@.... .."z....

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th2WC4A0J4.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):16245
                                                                                      Entropy (8bit):7.971147241868404
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S1QrrG7UCAh/8X2aMB5l3i1EHN4XF3lAVQ/+FF7D5aW3I5:S1QqAKqY1EHurkQ/+nD5aW32
                                                                                      MD5:E6C70FD855FD811D35A19C65D75F7F9C
                                                                                      SHA1:1FC04E202B22CC7B393C52B1CF02111106589A48
                                                                                      SHA-256:878F3A4A6B0D00F49D90A1D068C06487ACF8748CE267ED74C0E0C71031A69057
                                                                                      SHA-512:10AECD33D7040EA4140D291E9C2C2E6F2FCA8014A705188CB80FA8D2E1FFFB95668A4CBF9053847B318B9E43ABD49A5448086BBB3809015552C5AD049403CB6B
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......jM.m5.Y.${i...v.6g.0!..N.R...B..:h.v..*.g.&...F.LW.p)V.).*P ZwZ..9S.&.....S....v.J.".P......).- ..NT9..b.E.r++_.d...".f...=..........q.....*F.y..F.n.m.vi.\.q.F.....$.....q8...W.h....VTW.......Z.~...^,..ou.M#.......,..O.O..`.m.......I..5......D.?C..h......y.v..m<Wy.F.....R..1.q...O.iv{w..#....O...@\b..5$h6.)...... a.).T..v.....C.(l...SL.+[.[.W.<..T..X0...

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th4HYDLNY4.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):19981
                                                                                      Entropy (8bit):7.963241111751169
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SZQ2ZqY48/J1Z4QBk6h8nuy0tEnZd/cMOVHWy68GUBmaZk+Or7wWfHJYX:SZQ2FJ8Qouy0enDrOV2KTORHiX
                                                                                      MD5:D3F2052296D7EAC07CC134A637A7FBD9
                                                                                      SHA1:9867D7568C237DE77F04916EB89BCFBF4C51D781
                                                                                      SHA-256:573ABF680BA90814DE4F7B2EEEFB18563817B48E8374D3500C3163BB47F8FC18
                                                                                      SHA-512:D790F1C872597A495C85BB4184656A7EC24E91C840424B2C9F77EC00A6B5FEAA481B217364F785CB6C1E326CD1E503A9D6399EFD964CC5B86904987569753987
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....W>|..........5...>$..V....Ns...'......=...,M...H...U.h.~.K3.[...v..|#..,...$`r:...E.p..>g.h.......a..J...}{.|/.\>...{i..e..y..D...g1.f......}n.&".T.GS...I.[...Hc..o8.cRi0.N....o....;..RFE7......I....0.......2.y0....l..Io....G..f&..+.c`Xg..EX...+..C.C/..cv.@l.=.}.t.XJ..a.+.o........U..J....+..kO..z...|5q-......6.<..........N1]Miu...$..t#.'.k..Z...

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th5FS79CQU.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):12950
                                                                                      Entropy (8bit):7.942186191602206
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:SE2ae9K6GqUnfHIyT6ThS6Bs7hA2WzE0ueNd1Ps/bjmt8RsEDvxmwYjf:SSek0xy+w6BYvWzE0uozsjKtxamwYjf
                                                                                      MD5:B2A0604D733E05E2BE54CAA6AC2274E0
                                                                                      SHA1:E03AA0C0212250F6010722FBCABA6E34E7A7D75B
                                                                                      SHA-256:57D28A287CF28D36B7152A08CAAAA67C87FA6409F149166A0076505997CEAD08
                                                                                      SHA-512:2AAFBD2ED0E758E43390DC9CD63130B02DD8E388DB24816D9BE5BEA90C8EA7E96AD60BCBB712085B55734F3E2167F7C8CA449CF600369B9AAC107DE91D728FB6
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....2.:.w..I.....\.....K...~..-.U..|.m.K.6..9~O.........~Uv...7...v..veG...?..6...*...r.....8j...;ko4+.@.{..m~..$lc..U..?.^.....?....=k.'.7....h.q.3N.\.P.o.X;.Y.$..u...-...,}+.4...d....../m..FXu..-c.d.v.Z....s.....M.m.L.oL.......( .y..bS..Nv.j.rS.....4T#7....[_..6w....W...d...Z6...?Z...M.......M....^.....`.g.W.V..V...0)...Fi..t..v.c.T...t.B=.\......|.W.|0.^.PO

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th7PSK3PHE.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):19081
                                                                                      Entropy (8bit):7.96400463284842
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SQFQS5Sn1Pi+r/HrdxP9BD0/nqLg24NQucdf4FujACp9S0rF:S3PICDdxPzDogzNJfQCp9zJ
                                                                                      MD5:8A9DE01EC4664B945E22AC8AABBB222E
                                                                                      SHA1:8C9AA3ACF800571FCE2CA7F077430DD449AD98CA
                                                                                      SHA-256:763A6B019999B185D53E33C73101C49BA4C42E22FC851C293929338EAF9D182E
                                                                                      SHA-512:2C4676A8C7F9D213DC3A96C397804835254EDD85520C86AE2BF15B31BE62CD0BBFE6A7F5336D95CC7E5E54866D08B06FF1C3AACD6DBFA2CA8CE6906469A9BEC9
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........sZR..O.Q2g.._.s.......&..~.|...w7....5....z..4...`.N2.....z.r.$....Z.,0..n.b/.7{v.rU..=.U%4...3<....Ac..G0s...b..x.L...+AaO....5.v5.%......8#..j^B../J..7]...L....=.(..<...rz..Yw...T.,....mx....:.y."....c.[..T...U9.rk?1&....I...=+.......q.5..._e.....g&.s4........e..S.Iyr.......>.._.-.DSf.W,lh...G.WP....z..R..d?QT.$'..#.5.c............o._.....W.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\thAU6WBHCA.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):38107
                                                                                      Entropy (8bit):7.969493052319302
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:Rn15U/OAWna+3rFcvuqOPsqva5gjjgAER42BMLadQoStdAZ5:R1+2n/pcvuqOPs6aCnE3BHStd05
                                                                                      MD5:9D35A1D88724D4CC1BD11185BAD1B722
                                                                                      SHA1:5057DF59233852E51E6209D48154E5945F04A028
                                                                                      SHA-256:2C3E37A0A85410FF6B69FF4E594D8F2F75FA0FDF9D9625BD0A7917E962123FCE
                                                                                      SHA-512:5200C154A6486ED3B3F8501704AC3C0CE32CBED6E7744FA9BCAC0A0682D45EFDE143041D23C58A471EC599A3583AA747F1C2CE1090EEE8458352EAE9C06B40B5
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..r)r=j.......G.y..U..)^.MD.:.j......q.X...Ol.~.+..]..n..k.....)'U.....h.w....L.i.....v.C....i..-....I...#_...;.......z9./c}b>{.M....m.g...]]......g....c. .T/C.*.,_...L.~..R.f...0zrM|..J..r.k.Z...I..x....D.......x..#......*.............u@W...fS;.,..>Dy<..9.V-.?..........T...M}.G$.....WO..^..u'.t.....[{...P...S..-l>..4...l.............../._.&.jS.<....L

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\thWUI25KC4.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):11560
                                                                                      Entropy (8bit):7.954344291665877
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:Skct4QW+Tf3P8DzAudgHVlA0BWsKS4IUV15OfvkQPhMJZ184Ii66drEnlY2on:SkcSM8AmgHDQ7S41P5lQZMJZ184IUECr
                                                                                      MD5:837BAAE9511023BA002F8106D9B64A93
                                                                                      SHA1:507E33CFC7ABA8B3D0E08D4AB0F94347202DB4BA
                                                                                      SHA-256:979478B4755B4F683A3038E2C4EC8855CD4B31067CBED29C88B00AC1FA407A2A
                                                                                      SHA-512:74467D47BABB58455FFD43AB7CC9A78D84F102EB477ABDECDB861697BE7292533FCA8D557CE6F49B5B9DE73C43C058B15214CD0490A1095990C53806391E7AE3
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...O.y...Z..].pkCE.Ee..].).....u(#........}+:.%..5.j~X..F@..[.....A%.\.......J...H.J..Gq)?*.k...6........n.zH......q\.o....oi01.Y.\.5.h......q.W.'..qY..\...b.+.U-.!y.{V.0.w@.M...N..O.^\..z..B.*x..)..9.#$p..X.,..t.[....u{F@.].n..... .:..<........G.O.x.u........ow....../,..+....4_...}....c.......R.......rO..rMxk.......O.U...xn..5:..j..}.....WO]:..Vi.qV....V.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\thXTDZVPGD.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):39371
                                                                                      Entropy (8bit):7.968658784845569
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:Rg/MgJYPRGEZrtjrGX4BDi4IMUG0oII550JiRnn09Dqv9h1R0O6ojfiapmNa:RgUgJogEHmIBWTMUZoL5acRn09GlhvEC
                                                                                      MD5:E3EC85FB31A999D90E95523BBF5B6BF5
                                                                                      SHA1:5196784D0A666A4ABD9D391FE875D319864F7579
                                                                                      SHA-256:44AC6F1DA484099F10EB74E043493822789C3964F20765B7B487937FFF228147
                                                                                      SHA-512:8C34A17AFFBCA47431F6FDFB7830210C948A5DF930774354DE5860A0E3516896E52DB82964EFA954EF1C1363A1F93416E2EA5CD3C32D751E227F3F353480B001
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....NU.c5,q..].(...`.B.sSv..yG.u.#...:.S...J.Y....*....(.I.s .U..O../...v3.S...qZL.....S9....x.*...P.\..&.H.b...s.N..3G..F9.Q.R....J....Qq....1...@..1.1....5G.;.E........*.tg.vF).8.....n..w...Q..rM...Q.4.sBAv;._.G...*d.U..x....?.4.h.M....).q@.-....IK..@.._.....@..&.zS.u..5.7..c..N.....@......Q.4...G...*...p.t.m..qE.G.jpCN....=.\...6.N.*.4.)..<.<.S.6.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\thZIIGK20U.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):12729
                                                                                      Entropy (8bit):7.956876797744331
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SsDXhsSjJrKB7f3RFU/j5iios1/f38W68VDEYiPq3kOjtoBRK:Ss11FKBDOMioU68Vgw3xyfK
                                                                                      MD5:D8BA0D670C3468B4648270542654B8D2
                                                                                      SHA1:63DFAF70304D73E2B271CB5250A7B7DBF29045F3
                                                                                      SHA-256:00F25C389EFA9826805D1216FCFDCE2A76F8C7EEB055D88EBED2A6AA2130BD2C
                                                                                      SHA-512:F719017A88B7B2F99B5F02D5C95B0651702B749273996211BE256D9A80586460DD0F782DF651EA687A64B16DEE7B65B73D45D9D111A184139F70A6A6F706106A
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......q.*.ki0\...*?....2.0PV:.p..c..,.\[K.!..+.DA!...R.$B.....{...4..Es.5FUl...T.]...........o.X..U....i.k...&.Gk..b.t.U,....4..c...OJ..7.t..m..._...~6....*..'.....[..i...K.S;EgK.....RQhW8..S.....-.*.L.z(..a.U.....Z....OJ..I..k..KEl..h...`......8\..5..xOU..s....1\]..h..PY.......J.Q.....]..`Zv....A..Vs....z...xG..>....}Z..y.....Y..h..../...ET.b.....M8..rG.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[10].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):20972
                                                                                      Entropy (8bit):7.9649162586722895
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SEF3PuLX79jBiMVfLOeuiysC8kki6LCBggyNxfY8lZdAYLFKtKmJUiwZ34QQ:SEF32L/DVpdyt8kc7gUxfYe2EwKmJURy
                                                                                      MD5:06750658210E9760E2CF57CA880695C1
                                                                                      SHA1:EE438608C9440EAD7ABEA131981EB494B4959C37
                                                                                      SHA-256:0A4706929BA0DFFC4476A9C101B0450B2BC4739F668B8C8571E06E9E5CD4E6AB
                                                                                      SHA-512:10D03ACC4146E4D9D856FD1CA188E127F19EFB15DC110F57E1E2FB619433DA94B58208CCACFEA40A31610DA6ABCF062A8851E2B7B0C6BA3BF463BED1C6F4BDDF
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....5.>.?.5._..."...}v..e,.@F{9......~.....2G.m..._...s-..?.......}....[x{E...wV.qjuFk.g.[k.j.......:..5...A.}/Y./.$...^..=-5+V........)g.....b..1..m....6...-.d...n..,#....u......}....SY........./.x.Q.|9.[B.n......f#..rH..0cf.z....._.<O./..x{T......C{%........g..v.n..m.......i............E..]o.Kk%.....$.t..$.v.fm....+X.}`.B....N...#.O._.M............y..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[1].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):9089
                                                                                      Entropy (8bit):7.943605423884429
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:SGerF4c+QrudWEbpIuW+rdg60L9ah2m+u0kEALoX9ZvzurL:S7rF4QiL9Iuxs9a0m+FNfvzuH
                                                                                      MD5:715648C3C5708A1BBFF59D97A308A133
                                                                                      SHA1:CFDC75A91324D1812834F1E78696C963BBB4C350
                                                                                      SHA-256:088BD4F5653FDD9BC46F83C728A79570B58373E42AAEAE05CC51E5368C74AEBA
                                                                                      SHA-512:A2681CB46927A403118577F5A3BFC7CE31AFC8A3EBBA90E3664334876D24A815B4B4E9D287817CF6A25F87B99056AC7DE3C1D8E2690A513C7C72A8715EB2C6BB
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...ht.....M.du....#..).z.)...@..>X$rz..l..aT.I.qD<|...l2.......J.N..].P.H..B...*D.5....b.m...~..4X......W.{8$.s.^Su)}.NI4....WM,.X..U.l.J.....L/......y.............+.U..R.j.......5................7...&........?.n.M..F..,.)...V..'..5.m..6P?...%.0......g4....7S[K....S..)K.6.<S..+TC.....M.:....!......t.<..t..$...Yy...}j.9......z.([YQ.F*.(....5.~.?:.m#K.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[2].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):20861
                                                                                      Entropy (8bit):7.966190859070986
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S6BzFccaTZ7ak1KWKpfzHNLtr4h9Ua13l//HXJuCumN/Py2/dlUto0Zkhu:S6Hc5Tpak1KxZtrwJ3lnHXmj2/UtSY
                                                                                      MD5:1A707B21963521CCC94AF585925A9526
                                                                                      SHA1:15F2F20CCA8218693E516F9385E1FE3E1B0BB6BC
                                                                                      SHA-256:2956E3F6672CCF169F4F33169FE8F1CE1CECE6DD205E73546D3EADD42D161823
                                                                                      SHA-512:0A1AA4364232CF8B1349B8C67ECF59AD372A7A80B6B5FB16E7AF43CF06B1A2C6A3E4567AF6D3F65D87034DAA21D0064584CB11D852541584D7E3BBE52AF688D4
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..U..........[.=........<md...ww e..|...#/.Gr1k&6...[.N.}.......~...i{%..l...M.Q^.4...C1].c#..b..a.i"..Wi....X..RN.d.q..^......U...h..u...nM....,..l...k......8..........j./.,...4.V...k'.d.Y......,.n8U%.x..:...%>...S.....W./.j:f.l....w.v...L.G....e.Y.%w.1l.9#.uw'.....X...........F.8....[...1vb@....ZlVm.2h.P.....6NM......q.U6.......-....hz.....^Xh....BLQ....

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[3].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):15536
                                                                                      Entropy (8bit):7.9573129377305305
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S7vUZKIeg3iCrB9Sj5bLTwySxaw3Gm2ooXb9AW:S7vkKIcCrD8VHfSf+N5AW
                                                                                      MD5:0D61215E03E5EC4A560603CE3AF7A7A2
                                                                                      SHA1:6091B48291BF3614D88A84C8BED22E4690AB5B3F
                                                                                      SHA-256:B953F9F2B4652DB46B2AC7DEB8C2DEF4C3DA80A2C8F8A584CFD2AE869CEAF5A6
                                                                                      SHA-512:32CE01D8023A5949719DF6A833B0701E9C6B15D1F737A806556A76047D6EDB033522FAE7C9114B75B44C97CD9E9EE8524E6A04CD72E57C996E2ECE202469AE62
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...rZ.]..*..n.l<.q..#[.l20.....hK.V...4..(.R..}..I..-p..5].q.&..>aK$h.jV...#.+}.5.{Uy t...b.r..h...Q.^ih.S...7;.>i..@.,..g.AH...w,.Fz.M'..>..iW...,...@Y.!.;..^`...'....O...V.G.|C.Mp..;M"yZP:....#>.......J....x.OU.-s...vb..q.4...$d9....a...y..H.<...N..mjpS@....*.4....J....F..R....... Um..j.Q.94.u.f.4z..0.Cg4..i..@...z.c.D.M%+.3:...x.O..H.s......I...yK......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[4].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):13663
                                                                                      Entropy (8bit):7.954550476362902
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:St+fw6Rn366Wz4qZzTNt5+SmunWEmFy15m:St+BNBUxzTNtoSmanq
                                                                                      MD5:31D6AA193844A53A08157B7E7671E92A
                                                                                      SHA1:54B6EFE460948C78293AB8508DCEC34C8979316F
                                                                                      SHA-256:4086C4B450D524CAFE5F4210CA899B3A07224FA50B2042B7A4685E7275BCF304
                                                                                      SHA-512:6227076DFEA8EF59880B1A343987ACA94E2840CA6C8C6F420E6A23EE97A9C982CD04B8A0AE6C16EC9752D55B843613E3EFD2D70DD22BCF24CB034B2A2948F59B
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...U..7..gYLr[.g......7p.....+;.cM....n o.r.?u..2..d....b.[.Ks.k.....iz...[..v..9.....C.\te....+..,.M./...i"..$.<.....S..a.I.t.&...Z...$.H.M..A$).D...B.$...B...O.-^v..Z...}..7..mRqvH......3...........V?....6....bv.+.2Vb6....v9........}...O.4...1.]^\.r.4...P...."...Q...T..J".9....T.#5...o>..s.Q...#..f......e.Q...H..^k.<#..o4.+.5m@..H..q..........y..y.1G...R.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[5].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):7429
                                                                                      Entropy (8bit):7.875071815092228
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:SQncmFiCPLVHJNwIorLo/BoVG4C23WF7cQvIMeMC:S5OTVkIoS2Gz7TIX
                                                                                      MD5:FAC4343FE2A05CB224A9164CFEC74908
                                                                                      SHA1:70DF12DDEBA602A47F6D3830C3CF9D9370B545FD
                                                                                      SHA-256:CA32DE8C5136D8095BA771DC5CC03E3662F14E26DBEA8E2656C0D93BBA1A516F
                                                                                      SHA-512:B69E484627D9105748B031B599C32D791369A040129E6862883702772DD80B7D05216E920FE3C46D387BC0E18064878A4699BAAD3D706667C0121A45D9338831
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(...(...(...(...(...(..k./.....g........*.X..& ...=..|;_[|.d...O. *..<......'ZW.....$.F6..3..t=%....p...Va....~...>;.?....N.;.).w?(8...}/$m...].JO...-..h'..?..^=....m.?.o..y^.cxOl....k.@..q.o#.c........*?.E...j.>!...s\.......:.n.w*.}..<x..}(.q.W..c.WV..^.`......Z....$.....#^..DA$1.%.@.Y...........[.7....r/...Mx2..2.l..~Ur........M.k....m/c.R....m...%.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[6].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):18633
                                                                                      Entropy (8bit):7.959597219430649
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SKGXz/C1UmShCNs/fL2KffiEc+b4ibXwP6mwLISf65zjWjvymX:SKSC1UhC67RffNtiEf65zjYvVX
                                                                                      MD5:AE1CC7AE31975B328BD492141F42606E
                                                                                      SHA1:5926112ABD0DADD6104DB16ED7BDACC313EE1239
                                                                                      SHA-256:B4E4257885B08297FFA48056CFE5B532C3A80D1B84507D0AA7CB4A6F30C11A25
                                                                                      SHA-512:A604EB0BA3FCBB6E00D3DBCA0CAE20945E3DF365C68C17423EA339AF99017EA390EF642ABB0E8CED192236DEA8B468CFD33B47EC3B6D73AD9678E60236111E2B
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....JJS.(....(.y..\m..o..L.K..^6*.... ...A..=E|Q.o.........._....9t....#.{.....v.m....Y.U...[.)(.I..7g{....fX.-Z4..F...}@....(....H.&'.T-..R.|m....VC...g.{..Z........a..............g.s\\.$0..L.N...'....xR-2.\..P....s....D....n.)..5.b...z.)...Z...WK...]5<....Ir...}m...3.y>:|&F.x....m9.IM..?.@..G.ep..u......xfm..O.?."..y.....}...w.h.v.6...A.A.W.;.g..|..}

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[7].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):17852
                                                                                      Entropy (8bit):7.962225166539206
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SfJjMsrFJxfAviOIZZau7MfaPZmo9kMa4IAiqNhj8dZ2ebmt6kk1UjtAH:SfJjMsZgKzyuNsqHesm9r1UU
                                                                                      MD5:698D591B470FDE80FBD8A37E060A0D87
                                                                                      SHA1:F7160E2FDD5BA16F63D36DE2A1BBD6B17E425CD6
                                                                                      SHA-256:4800E6019A79F3E07EB4955CCB894AA85661A232FA29A5946DAB2588BBC476F1
                                                                                      SHA-512:EF38AE04BC4101198029158E997457AD8BFBFD943A26A820634AA227D80BF48690DF8829DC25D85574B21EC271D802750AD71F1BEFC4E47628978C1D81156046
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..F."{V.6A... ...o*.S...m...z.O.....I.h2d...V(M....4..Q..aO.`. .v.W..R.).z.t...\(.z...>.cZ..0=+H2..._j.j....c...n.JA...f.G.....?.}R.C.J..7...&a.....6.gc......b..v..T.jZs)".?......Gm..F....q.YQ..H........SM......4...2n[..d.qF.N...9c.w...G...=M..gi.....n....N.....}.OO....R..n....8b.}..Z..W..F...*/....}95-4.E.^.f?.p.k1.....5....;.4.+;....{n?..J.!E....V.U..;..z

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[8].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):12824
                                                                                      Entropy (8bit):7.944814999831512
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S7F54w916UMtC8zc0zxIyIp6hrBP5BV7W:SxiUt8zJGXCBDo
                                                                                      MD5:F6AF4365AB1FD00B290DB1B923249437
                                                                                      SHA1:88EBABAF1A7E31AB498AC7CFC092CE6CFBB90088
                                                                                      SHA-256:09D2DCDC25F8A114837812816D30F63FA93AD19DCBB448DFDD96779F5704E615
                                                                                      SHA-512:407E4AFE79C58BD135CE157A05AEE81AF543BC7558D79126F9B7D35E4828286382A48A65C896C6FDC1F0433DEE0C91A11DE731B5D406468E8EBF702C7D573BA8
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...?..w3D.. l.J..?.uZ..y.l....u.U[.:1.C"C.I..>\...Z..*.....P.e.9H...3H.z.".0e..6..r.sX.[..w7...rj.!0#n...j...Y.....y..y#......l..=....2........^.B[.li..S.....Q6.zqR[0<Q~.K#...1..q~....P.4e.........R]........y....L.,'y ..v....].z.U.R.:..M...kwD.#.].U~...o._[\,RE.r..g.....<!`u+5.l....3Nm..a.&..P..*-&C.....[.V.....j=...z.]N..E....t..1......+....!..r..q..*.s..,W.s

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\th[9].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):16672
                                                                                      Entropy (8bit):7.965358206397123
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S50GLs2oZlZQv57Proai/UuPskvhjv2IeFDlty523PBnHYKs0:SiZlZQx7PE595jv2IiDlg2RHYKx
                                                                                      MD5:C9D5D8DDE585F613344D0F69FAB8AAD1
                                                                                      SHA1:18A3A21BBF2914279695566A8F702376E03B00D2
                                                                                      SHA-256:E6FA130C592700B75042A65E2ED1D1090C21E6D083C91F98E8C4AF9338AD0512
                                                                                      SHA-512:A3678A438A2B16DE0145E075A1CDF0556819D6126F80C1658CCB96EDBF66F57F13C2200D24983F7D5204860F591BB7DFB4EF4C7758F93EB70FA1A6839995A7C6
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...Cr.....=.|..=q.....!h.....G#.\sL..{.r.....Y[.m.{(.v.....)..0.^....[.....w...)...W.f...'...xJ.....6..4.8.-+..k./r......?....a..s......<Yx....*.pp......26...c......:c...F..F..|....XH[.'....(\....j.f.%%C..Y..s...(..D.......z...l.|..#.7z.j..>.(y..p.T.v..4...i#.&w.<`.._..eM.n.t........~.._ei..A..z.?...khiso7...Y.v..zq..b.....Y......._......{..,...p9..]..m...

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\AA12I8qo[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGB, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):1287
                                                                                      Entropy (8bit):7.753286328828527
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:Qkmkb13K52UTcyiUJlRq85hww6qJyPGbh166BaK23P:Qkm613KsE+oLDBrJyPGbD66d23P
                                                                                      MD5:9B8059391E9315D157357A18A6A0191B
                                                                                      SHA1:C466111C02D867C05CD522F2F362CFC23FA22B9C
                                                                                      SHA-256:379BC8D28440A12EA8A540917610C7B6A2B865CDA7275285FF922D69CF46B5E7
                                                                                      SHA-512:CB19000C7425C1CF8DDA9A8D10DC220D4961D34AD9B837E4DABF2C649D57223F0497D344671782E4F4782BDAD82B06CE702E27D67F2176168DA619985BAC5848
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`.....m..o....IDATx..]l.U..........MD.ra.h-.c....?.F.T....@..ik......6.......pC....x%....DJk.......x..-.......$.......w..U........ :R..)....@.b .1...HA.. .R..)....@.b .1P..P.<.,+.nB].p&H].rI....G...D..<..V...~;...z..w..?..%V.~c.z...B..=(.z._V.3.=\.)..-%......w1.]e..8.P7....kC.j.......nhT+.H..B4(..Zg..$J....I.W..:{..S....VC...74.....^,..6X.....8.jX.W.._.~E.....w. .....e..x...kB....z...3..?..m...z....d.......g.D....n...q;GNo.3N|...%.._V.i~.....!.@p.E.k.[.(..D.lW......$H..Q$A./Z....jz.K........-.G8A.B5....P........q..-.a.)..u.U.a."..../..4.Q..X.....{........$, . .....+)...^..+.U..fz. ...-$.....#n..j_..z.Pe..O....ts....w..B.........F7..(Zq1...{.q..w.._.,.Zk......T.H....,.<.h.g.>...........f......%7...l*T.&..ykrr:Vo.S...f....S..~#j..A1........C9I':.......t..NO.......,..b..e}g..I[c..7..Y...B/.@...8}.....!...7.b..N.c.......m.pz.E....8...... =p$..A..s.K.......M...B:...q..W.O.`...;....E.......{.P..... ......-.....

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\AA13rZME[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):436
                                                                                      Entropy (8bit):7.18858527233746
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/78/vX/5q+5UqmyzAn0TBlJPgk/AwL7jCCDsoQ:NX/5q2XvTBt9L7ZDG
                                                                                      MD5:5D148DE03EB9EB2C6297C4914C674EB8
                                                                                      SHA1:C5B7CC2436A49E5C0A92E05EE18B0FBE75D61FDF
                                                                                      SHA-256:BEA40AB0237ED221B313DEE3EF74594B8369C5B8F52474D87EF0BB6F0D40C997
                                                                                      SHA-512:9841B2B22E883ED8DB5CF79A4E04BB61723DE82AC1085BEA755220A2EE5A43D8C2EBECCC99000A4E5774F867AE99BF36BAD8C96A57A838AE90A83C05C7DEB95F
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...IIDAT8O...+....q.*..R.....e9.....e.J..d.....+..(...l......,?Z..RB)....\.Y.........y.4.Z@..._E.....A...ae..y..QD..".m..z.e...y:.3..T........_..d.r......~.|.1)..ih.NR.0Q*.c...i.v.J.........%*......~....~........+1...x|.y..@.h4..0....:CW...#<.^iv...x.?:.$|.tA......xoAy.....Qc..L...C.a..e..]...-.....!.M..O..~A..g...S+>c.~0>....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\AA16OGZj[1].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):65536
                                                                                      Entropy (8bit):5.278844126769258
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:f2IjiDpTUpG8zAJ05ofmKjqlzSjeCbQGO0jLVbiL4ia176:f2IjSwYcofmKRFhvJGL49
                                                                                      MD5:DCB4C9EDCDC8B5886EA09CEAB5FCC537
                                                                                      SHA1:924295DBD9DAB65763269E5939288D34F88F198D
                                                                                      SHA-256:8F18BD7B8AA1A4557FAAA98CF6D53B9302F24C95905B54F820964CDC484FAB38
                                                                                      SHA-512:F45807B60F824440172FC55587DD5C0501E71154616BE611734F2B97CEF065D6B3B8CA12AA87B0BE729FD63F9666E387BF90A0273B3DCB037FD1641B8F5803C2
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`..........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..........................................................................................................................................................................................................................?....m.;Qy/..,S.0.....0...,6..{~...%....Ft..)7+..........(+.'.--.............W.............rpG8.5..*.....+....g..jG.F..7.K..FK.V.c.qx.......q.S.j.&8...5...n......)..._....#...9S.3...6...N..^...e9......i.e...)Kw...z=Y.j2..At...9..#.....Y..l.pP..l.h.O.v.~.......`TS...]-,...c....j..]..C.!..L.Y...4x......0./.....t...oe..I..{.k.oP. ..0..h...S..4.1E.1J.-....~%..t.7..k9....

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\AA1bFuhq[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit colormap, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):2111
                                                                                      Entropy (8bit):6.333845510737657
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:muYQ/B6OAyunnPjg8OrQlgM8SqvgPffSgplHxoYh/ZjdK5BpriV:6w6XHnPjg5QlLqvUfRp7jdd8BpOV
                                                                                      MD5:9518AC4B01AFAF7341297523A399C22D
                                                                                      SHA1:9C11496B19C9B53F6D446950B12B881FB8CCCB93
                                                                                      SHA-256:997F30A58EEFBC8CD67C4E9B193522BC8F13DC5B70AA846D7F1ACC0720434B08
                                                                                      SHA-512:7AA66FAAD5E92DF7425328D257CE5D640FF3DA7E139179B99CA66A26450BCA4848ED179088104C97E979751D4D1123D682C7F1B23B80B8F783A437BA056D39C6
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......F......sRGB...,.....pHYs..2...2..(dZ....yPLTE... CP].....tRNS.N.p.:...Q......L."....y.^...+..W.V...k..5........|....X.Id?R_7...uB.....!~....CA.F.S$j.{i..Y'.....l.mr.H..E.c.].-.o.x.J.8.P........s.=..[.......>...Z.M...G.1..,.w.).....f*&.;\@...K.e..q%U.D.T.../b.OngrJ......IDATx..W._.E....-^.w..E....".d..........D....#+1,E.| e.{.d.C.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\AA3liuz[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):764
                                                                                      Entropy (8bit):7.536488877186863
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/7wMpambfk83Esq/Ej2tgb9H8PNa1ld8vbdOAp6yxccEq9dxW:XMUmbR3Eu2tgZ/PSoAQeEiw
                                                                                      MD5:E19E4562B3B7168DC5A0BC56CBADCBAD
                                                                                      SHA1:9F6641B5B104E8F2890F8DA9A5A006C2F6762E60
                                                                                      SHA-256:682F067279F4F69F15853E6DC5BBED671BE9942CA8E3486DA1516A5C3E567F8E
                                                                                      SHA-512:4EFDBBEF1EA5D77E7CF68463B6D9061D55462C42784BAEFC282AE0813D2215625F09FE4ED673170E5A75EAA669BB551810C89CF9769C77FC20E88DB84AABC0E5
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.09/28/12.$.Q...TIDAT8....KTQ.....C..M.....h.DF...e.E".5A....E .hS...E...L...@.YEPJ.fF.I..3:..w.{..1.*/..........s..&...Me...<.....W.wK.x....~...G/F+...k......Th+.9.cr........3..Y[.J..i)4.8K..2.E...U&...c.....Z...92M.&L.-V..#....OA....&V...8..".#aJtCH.ap.j.......x..%...(..$..Fo.-N.9...."a.OF0.D...4.... ..y..u....l.8.O....M...fkq!.#.HC L....%........G.T......G.... ..Dsl...B....V....*...T............WO.....4Eb!......%.JQ.k;.5..j.ho...9....{.T....y.x....~..q..W.-..sm..R..Qtt...f.....RqZ/....GgGz-g..1..X...."1MQu+..,f2...<'#L.nZ..Tr..c..u..*.....h...*`11..$..}x...)>..)..r.[.k....M.._x.[.X......IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\AAADLcm[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):2028
                                                                                      Entropy (8bit):7.306500356096832
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:f6vnL+wuJ3wnsFJCI/zbSadl1V4iyyUGoZKSd6/L9:apLOsIZdZ4ihUTZQh
                                                                                      MD5:9C91E2926EAB90A81E459E40E0FA1BFA
                                                                                      SHA1:CEE86668D768D0FEE993D28FF27773485A317A9A
                                                                                      SHA-256:55C49CD89E92A67BBAE6EDEFA5C8149776CBF878A0770ACC74F0A85CA09F7E50
                                                                                      SHA-512:4BAC165C0F22937A1374A601B9D9F59309FB0C6EE2785314BDFE81537B800B69F58F5F9FCD07C1CD14942638BA9BE0D3E2E9799F2541A29FDE95FF3AD982F85D
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...ziTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:da9d199c-5da6-4bd9-8b51-825c36c876ed" xmpMM:DocumentID="xmp.did:BA39E74AB90E11E8812E96E90AF5A761" xmpMM:InstanceID="xmp.iid:C0940E64B90D11E8812E96E90AF5A761" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1bebd310-2b95-4f81-82e6-b4f255988ba5" stRef:documentID="xmp.did:da9d199c-5da6-4bd9-8b51-825c36c876ed"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..6....IDATx..yH.A..wsM3.p..L.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\AAKPPN8[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGB, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):2809
                                                                                      Entropy (8bit):7.648045069741479
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:QBzNn2Hj6J3hJzVsFMhGxk0pVydg0xYqL+D6xur1bwyyJOlpQ:QT2HeJzV7hIkuVyyGYkVur9ZyMlpQ
                                                                                      MD5:86C1D30807A289826EFC0A05DB7702A7
                                                                                      SHA1:154754A7A46806A9D1B9A0A3B9F71B11852B29CF
                                                                                      SHA-256:FD535E91479CF3E9CC393937130FCF7FF0E6B59B02B995BA9D2F9B10228369D4
                                                                                      SHA-512:B11CA353751EF07EC780DEE450019786ADA5DCCE757825C2B4E738EAA82227C2A65F13719BFCCD431642052FB035B9C18BF8A66DD06572A41962240AAA271510
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`.....m..o....tEXtSoftware.Adobe ImageReadyq.e<...*iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.2-c001 63.139439, 2010/10/12-08:45:30 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop Elements 11.0 Windows" xmpMM:InstanceID="xmp.iid:CBEE6106567B11EBBDDE90E4C457305B" xmpMM:DocumentID="xmp.did:CBEE6107567B11EBBDDE90E4C457305B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CBEE6104567B11EBBDDE90E4C457305B" stRef:documentID="xmp.did:CBEE6105567B11EBBDDE90E4C457305B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.D.....eIDATx..yH.Y....k.v. ..R......h.,........"..?.h...,..Zi.l.L.h..}3[.g.9......f..s.....{........3)Z

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\AAQ1nEo[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGB, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):6883
                                                                                      Entropy (8bit):7.478801597773908
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:QYknmWqbOa8/tumb9NIaHv+HfSH1gdHko9ZS9hdrqe2mMgBdhsPuzKhBHreebyOP:QYkn04ZG/SSEd9hdrqeLMgSWzLebtooT
                                                                                      MD5:6047615D9A6F527362FF781C8D6CD119
                                                                                      SHA1:CD280C5F385E40DCB27C39D141A934ED29EE8530
                                                                                      SHA-256:6C30DEE7197DB304E255596BFFFD998F46BF265B44886E65F22C110CE3057858
                                                                                      SHA-512:3267999376FF017503D4B676BEC0C9FCFC60B94EB7EF981106F86E56BB27A86C17CA8044D69A28EDB24CC2669CE5219AD956B4A3C0E9007C2A0E721DBF15D1D5
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`.....m..o....pHYs.........g..R....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop 22.5 (Macintosh)" xmp:CreateDate="2018-12-13T15:54:49-06:00" xmp:ModifyDate="2021-10-11T13:51:40-05:00" xmp:MetadataDate="2021-10-11T13:51:40-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC619

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\AAV6pJN[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):396
                                                                                      Entropy (8bit):7.096895732454424
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:6v/lhPkR/C+j5oDqqbfhYAT79D9p2CjDukhe/z+n4FTS2hMWzvct48pjJup:6v/78/X2D7GAFhpx/q7+KS2yu8pm
                                                                                      MD5:2711B13307455661EE0E114CB96550E3
                                                                                      SHA1:4C2FD840B5446D36CD1D5F9941E8B141D8D01D83
                                                                                      SHA-256:902D2F981164EA4DA638B57BC0DC598A458DACD6D32B09A28AACDE9FC0CBDCCB
                                                                                      SHA-512:49EB9228411D4B1A823BA571CBD5525C20C9A9CD17AE95796ABF86A2D41BCB596B33A526AE730CAAA640AF6F0A1C8D0B4227E5924FB98C63D88FB03C74FA4860
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...!IDAT8O.=k.@...}..&.V.j...5fj.8....n.+.:..._.KZBZ..dp..%......."...{....^....i..v......!..M.M.!....{\&...y.b._.%.<......\........I...S.4...J.N....&.A..%.W+J.EQp+..{...'.u..e.V.,..f....=.i.4..}..X..P...9..1.."P.$..w.Y.S..(P.i|...~.F)....t....Z.D(.......3..j..(bg../..w.B)...?.)......X....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\BB1d0ujS[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit grayscale, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):1113
                                                                                      Entropy (8bit):7.727456978400816
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:6CdYQBAcBrSJs9tION6Gvx8nwpIZ/YCq46Ru3Nqm1NL4nz:6cYQBnPtLnx8wY6uJ54nz
                                                                                      MD5:AF5A688C4ACBA6C2E57518F2A93A36EB
                                                                                      SHA1:0FA67A1240915DBC819962263F2EFCC4380AB4B9
                                                                                      SHA-256:F5B1B30384C129ED683EC4B26BDC18D8EA02B58155B816CC1B646ABACFF06E53
                                                                                      SHA-512:4B17038A0CD1CC6491FBC9F13B090E64D0B99BF55CFF69CDD85BE73E9784CC55CCEF7EF39E1BCF6660AAC6763B98D1FD6F840462C0E85D857F9CF97DCDBB6204
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`.......(.... IDATh..IlMQ............J.....",.......Y.Z..HQ!] .....!R.`.j.M.t.hZ......g..n.p.;.yz....~....w.s..,.HC.+#...vt.y..?-(...{'.v.g.;`.2.6G....o.v........Ne.t...mr.:..1..P.s..N|z/..*a..&..'A.x(.l#.............*.|......3]......*..:&W..AG..L..&.Ep...1W........O.,@`.......9..vX.....t..{R.W9>....`.y..........C~."....=.7..#&`h..V.O...Z..Sv...SXs.D..].P...L..].w.4.:.......t(..T@.,...l%L......*...b.%8..Ze.T.U..X..,...\..9...a.\..{u..0....x.[gY......R.#...:.U`......."..yR..c..*H..q..0B...."O......*...q.L9....x....+..b...j.B;Cj.....I..@K.u....u.2.....a.@i..=.......N.....S...=...z..}v.....*@..P....S"...P.|........$..@;..1........&@C..*.......0r....p.3"u.+.!..Ur.....~.*+...YdW"C...-#"Z.....g...+.6)..3,.p.6.K6..5CA.qx!=[.-2...3..... T ..w.OY..t.`r.........m.....S^m...`....L..i.4.........l......G...F.%..I.5G....w...x.....o...v.....n.l./.(.........u.9V.....Q..Nu.@.i.......?.T..n.{.}..x..e..rGS.o..>RXL..f.3@.......u8....yGS.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\BB1e6XdQ[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):5249
                                                                                      Entropy (8bit):7.949396418132118
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:Qgm8H9XfA7trV8p3i6UuqVkHd1z3jQNoMGCeqbmKFufB2tmMAXdz6dFJmQQYbYa:JmoFIJapZUumsx3jQNve3B2IMWt6dFca
                                                                                      MD5:3E5D0184ED75D472C6F58208B3BE6089
                                                                                      SHA1:2DEA4AE4F8069405DF9C5D6C6482AAF6EFDA5400
                                                                                      SHA-256:3FEC3CBC019F5765EA864A1E7E18FC5A387C8AE6B75258F875E025DB005F5E65
                                                                                      SHA-512:84569BDB5AD72D5DC49D9D80C810309029154341538BF889A16CB23D2F4CCB278DA5718F27BF0300A5890D9531C903816DD20BF3A041608C24B4E19524CEF923
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......w8....pHYs..........+.....3IDATx..]..f.Q...7..m.....@.(HC.=R*.D....."..=].P..QE...@...D..A.U..........=..x..|..HOX.{........>..5...`....:.o'*?.W._C.q6]Sg.KA........zpy+<.gmet=.5.}.4t.jL"...3.ER.....5..x..T..U.*E+`.W6..*..x..{F<!/I..+U...9j;Sw.]....`%DY.._.......o23...Vz/..+..>k...........T..I.JZ..LWj.h..:J+.......-uCxS..!......w........xu!j.:Af.@ ..8.3..I.3..p.cf. ...2u|*....r.........6....=.$.%....w@....6x...y......vLn...p.+.:...K(.=.;...../.."cO...Fl.]L.....a)w.U..Z...'.....x.......@......;@..xTT.......X..M...7......a$..-.8...s..I~.......]J.T>_...6v......M..p.<.R...$f...:....%...6{.yf%.....}....J3`..Q7......M...L...5pB_....[{..R..a../.../.S...........c...u&QRw.#.Mu.&.r.Q...5.6.@.Z.2..1.*..hV...".zxC.L>..P....\VAF.A..l.[.g...T+|.....S..F7c...V[....0....\y.....6ur.3.~.#2..._...Z.13.G>.....W...#w. ..Km..:Z...S.....2.&.....\....LN.....(..L..n..2...s.....o.d.......WC...Q..nt..Dy......]...TK......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\BB1nDkpC[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):1658
                                                                                      Entropy (8bit):7.767837652733948
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:Xw8WI243QHVdjhphUyJsVbMAUBUj1EfDkn4a4gvvJo6fkMah:gE3QHHdwp4AZjNnxvBor
                                                                                      MD5:4B45D34DC543DB82D642F2B3DDC4F290
                                                                                      SHA1:794CE3CD1E4E29682A7B3F5800ACCFF745DCD738
                                                                                      SHA-256:6F36EBC5D76C2B6C03B584DF109CAC2C34222CB86C3DF81A4427C06873756DAE
                                                                                      SHA-512:C22280F3CC0F6A5DC6CE9BD74DA4832F0DC3F076098D7A32B5E46EF0E693F59EC77594A878D99837DACAA3ECE59596515A1B9F5709CC06E1646A6CC621B5266E
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......w8....sRGB.........sBIT....|.d....$IDATx^.klTE....n..m..@J}`... E.....5.A0b......D....j.#....`K..M.!(_...!.......6.&.Bm.....z.....dfw.i._..g.....{.......#.....`L...............V.p~..0....N.....+`8=W..0....\.......s.0....N.....+`8=W..0....\.......k....X[..a...:.[..;#i9n.........%q..$...h..t.?6,A.....kidd...Zq(...GW.`....E0QG./..74!..A+..].;6..B..]6x.6..](,..j.N.!xx ......'00..__.3.4.....Kko...xf:0...n.%.$..K....1.I".....Z.....".|..v..V.g..N.ww..}.....r..I.<...^\..0AB..I......|;.P^;fy.XYU.g(...%F..4.........&...Pn...Z+.Z.Y...W.I./....V.8...H7..|...5~..+.v.Y|..QM.U...p......J.K.9.;......`L&<cLA...v.@..n.v.C.<..4B..M.1i....~....3...l.5..Q......$...~,..+...!<.F3..5>.\#..p..^..nAH...7.Xv..P.....Vb.B.W.J....6........0V.\......M.+.+ ...W.8ex.......6...p....1..a.Z..S..P.V*Z.....4.^.#as........i:......x....1..,*.LK.[?l......hFl..?..+.zR.pJ&1).H.q....Iy.....@.!.D0....s....Y;.h-P...a...o....-[..H..s$\./.._.1.\.>.gM.....x...

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\BB1nLk51[1].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):32768
                                                                                      Entropy (8bit):6.8604777894261755
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:fzsdpD0WV750VR/20jaY7PuWKruL4MT7:fQD0b3FWY7PBbLt
                                                                                      MD5:A3BD5A9CEA15A3085943DE6066B61600
                                                                                      SHA1:EF5D07721C0B02EA703990D823444BA74AAC854A
                                                                                      SHA-256:D41B133349655D2A56ABAD5AD077A6956E267114CB766ED8808CC67BDBF1BA81
                                                                                      SHA-512:6181FA534765404E4F32B08EBE8EC39D24A54D261219F60BEBFDCA63FD6468EFCACDEF883A668839CBBAF0DA836506150DB73622EEEF046A875F2F3CCF7A0FE5
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`..........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..........................................................................................................................................................................................................................?..<;.....&....Kq..l..IprH.N.aCap:..U.....\...v.7g.t..=z.&.].,dC}{m.u ...Q...g#'.k*U*E.&...C8U.NJ.........v..cl.....M @.`$:...q.N{q.e...b..jJ.JjR..N..W.n...l.go%.f.I..p.......(...4..{h.].k........"R...m..e...[.....$......=O......a..(.. ...<A.@<CHd...K..oE.p..1.g....(....9.,.f.,4..J...o........6..ko..M8....:.ia.B...+;3p......k.."....%...8z........Piq\....I.^...G_.e_.z..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\BB4kwAp[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):224
                                                                                      Entropy (8bit):6.3996615625377125
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:yionv//thPl9vt3lUkC9/gnbBnq6iW2KrDkMQuwRn2zdqhDnOur9dwsiAJjnRQw3:6v/lhPUCnFq0P62xqZnNH0G1QqLp
                                                                                      MD5:AC370205FBECDF515D209C1840F11F73
                                                                                      SHA1:7E5C86F49AAC87EEAA85AC0C3DBD278FBC7C9B80
                                                                                      SHA-256:69417361260FE0333D180D084AB0A6F6DDD81448B144CB7272CFE5D3C91FCCEA
                                                                                      SHA-512:37179F6F8C40529C9CA95AC04E0B6C0137A84CCFD15221B27836F8C3104E889C0D96196B303611D515CA59FF0C6BFA76D3BDC4C277C2F4AF84A52F35850B6C54
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....gAMA......a.....pHYs..........(J.....IDAT8O.RA.. ..C...S}..0A.....A.af7......#8,...=...X+.......>80y.-....S....u...)...K4(.g".LKf!.......h.F.H.y.....$..n....R.=W.7pc.........IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\BBiuKxg[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):297
                                                                                      Entropy (8bit):6.617858604874786
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:6v/lhPUCnFL/cIKL0gsQ19o5Lu+HVINRVwGtdFndldp:6v/78kFkOdZugINzwcd39
                                                                                      MD5:9350CE442A7CBC0F24C9540AD2329629
                                                                                      SHA1:3E89935D84A696ED8B3CE27156FEA1DAB94D0E99
                                                                                      SHA-256:AE7AA0C66D4CAD0C94EBF8C88A48C9F526305315ED35AB8A3E5E211B7662A4C4
                                                                                      SHA-512:2F3A44CC961988F3458E3976F5843B187AF7931F1F3C57440C5C52A4FA0332BE80574041F0FBDD5EEBA01E6FB555A83953FD84B7F2CA8287834DDC502320893B
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....gAMA......a.....pHYs..........(J.....IDAT8Oc@......qk..Y6M9...V...h..5..+........j.G...Z}.r..`........]..^."'.=....D^.8..p....dLK4.A.#.....y....rX..<.....D...dq`..5!.Lg...m..b..M.}X5..>......T.D..J....f.(.b...;..tt..%..........>8``......z)......IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\C3Q7E7X5.htm

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:HTML document, ASCII text, with very long lines (57981), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):192818
                                                                                      Entropy (8bit):5.462805569077971
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:ytruggFLF3xsDWH+BCDheFhWNyhxpAOukO/xY2:cugwF3xsDeDheiNyhnAwsxY2
                                                                                      MD5:34E083C37ADB651DF3138DD5F040E8DC
                                                                                      SHA1:7FB188C41FBE2B9A073E5B0B54C94DA2D79DE799
                                                                                      SHA-256:AE9FFA2BB0B9390C462AB6BB38CA366F40CBCDC539BB0F11AF6607B4BC07C046
                                                                                      SHA-512:72AEB554312B54FCEB60883EFFE06E399578AC0A63181995F55AEF0F2509D0A530BD2973A4CE8877005CE01679BF14DC411FA1711050429B2712F3335D7CC79B
                                                                                      Malicious:false
                                                                                      Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,cprg-fakeci-kill,prg-vad-oovp,prg-1sw-sa-uiev3at3,prg-1sw-saqpowerincglbc,prg-1sw-spdpt,prg-1sw-rec-ttvr,1s-wpo-pr1-noreweight,prg-1sw-header-event,prg-1sw-tssctrl,prg-1sw-sdcards,prg-1sw-plholt,prg-1sw-rvplhold,cprg-c-blck-web,prg-1sw-anicomp,1s-eaop1,prg-1sw-bknpani,prg-1sw-tbnewani,prg-1sw-curcf,prg-ad-more,iframeflex,prg-adspeek,1s-winauthservice,prg-1sw-haltmmcall,prg-1sw-nommcall,prg-pr2-wcf-c2,prg-pr2-wcf,prg-pr2-widget-tab,prg-1sw-evtp2-ctr,prg-pr2-rtcon,btie-msanrr-t07,1s-fcrypt,prg-premier-pr1-t1,1s-xapentprong1,prg-1sw-pro2pre,1s-ntf1-prdnoth,prg-upsaip-w1-t,prg-upsaip-r-t,prg-1sw-tt-wsstaging,prg-1sw-wsstaging,prg-cg-search-api-c,1s-rpssecautht,prg-1sw-p1wtrclm,jj_fac_t,prg-pr2-headcon,prg-pr2-respsection,prg-ad-pdedupe3-cut,prg-ad-pdedupe3,6jcbh698,prg-1cashback-fulldmnd-c,1s-ntf-fyworthc,prg-pr2-cb-pricetag-c,prg-2pricetag-c,1s-wpo-prg2-sdmr05,prg-p2-dailysmy-c,1s-notifmappin

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\GP3A9WZ5.htm

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:HTML document, ASCII text, with very long lines (57699), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):193100
                                                                                      Entropy (8bit):5.463445241712471
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:fPkgFLF3xsDWH+BCDheFhWNyhxpAOukO/xY2:XkwF3xsDeDheiNyhnAwsxY2
                                                                                      MD5:A38A5963FCD02A32F432E183FF8CF715
                                                                                      SHA1:E98696D2237DAD7BC512239B0E9D21F3C4C1BD0C
                                                                                      SHA-256:93807B7595EB4FF47949AC7689E0E2E930AF06DC7CFAE993A150A966E04C7EAB
                                                                                      SHA-512:A724FD49939F8C463F85827644544E99C3C94934F8DC8F4429AE234A84234EF71C28435196B4BC2898A8C311118EE404D57832D8759C7D5CA52494844E4776ED
                                                                                      Malicious:false
                                                                                      Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-shop-staging,prg-hub-staging,ads-controlcbceleb,cprg-rvr-ads-dl,prg-rvr-ads-dl,cprg-ctrl-viewspage,prg-1sw-sa-ntf-ddp-c,prg-1sw-sal2coldctxbc,prg-1sw-spdptcf,1sw-esprt-shlnc,prg-1sw-header-event,prg-1sw-headrc,prg-1sw-cdelay,prg-blck-web,prg-1sw-mebc81,prg-1sw-tbnewicons,prg-1sw-dibdgc,prg-fin-cl3ad,c-prg-1sw-curff,c-prg-ad-more,iframeflex,prg-adspeek,1s-winauthservice,prg-1sw-haltmmcall,prg-1sw-nommcall,traffic-pr2-news-cf,prg-pr2-widget-tab,btie-ad-ctalog-cf,1s-ads-ntpcta,1s-ads-ntplogo,prg-ad-cta-logo-cf,1s-fcrypt,1s-ntf1-flupc,prg-ctr-pnpc,preprg-1sw-sadwf-c1,prg-upsaip-w1-t,prg-upsaip-r-t,prg-cg-search-api-c,1s-rpssecautht,prg-1sw-p1wtrclm,jj_fac_c,prg-1sw-ofett,prg-1sw-ofet,prg-pr2-icbdgtt,prg-pr2-icbdgt3,prg-pr2-tbnewani,prg-pr2-respsection-c,cprg-ad-dtag-agv,prg-1cashback-logo-t,prg-unified-pclick-t2,1s-p2-promotedondmd,1s-wpo-pr2-promad,prg-2unified-exp2,1s-wpo-prg2-sdmr05-c,1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\common.6d5d678f527e16a29f78[1].js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):278129
                                                                                      Entropy (8bit):5.425376220245997
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:aeZoOPQNspVnDKYPv8QSPG86hf2FN/0DZZXdQ0d:a8oxqpVDTPv8QSNX0DSg
                                                                                      MD5:0F85073D63E128408566039B1D627770
                                                                                      SHA1:748271335E2554CFF4AE4089B9D3B6448025E110
                                                                                      SHA-256:8A87D525D1FEC055062F1C29690C554B2F1BCC4E064BB7125963BD7D0CA95B88
                                                                                      SHA-512:40626432C780F623A702E22E12693690D598DF6196D9C57D5ED2899FE76E249A588641518BD0E5F2840C1841F1E0C7887D8FE75879A8CAB6CF39815D7571A239
                                                                                      Malicious:false
                                                                                      Preview:"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences||[]).push([["common"],{54085:function(e,t,n){var r;n.d(t,{p:function(){return r}}),function(e){e.Desktop="desktop",e.Phone="phone",e.Tablet="tablet"}(r||(r={}))},21290:function(e,t,n){n.d(t,{GB:function(){return u},Km:function(){return l},Oq:function(){return v},Sp:function(){return g},Wc:function(){return d},_d:function(){return p},cm:function(){return h},e_:function(){return y},kJ:function(){return c},oH:function(){return m},r7:function(){return a},yG:function(){return s},yL:function(){return f}});var r=n(45331),i=r.z.Alert,o={build:""};function a(e){Object.assign(o,e)}var s={id:22010,severity:i,pb:o},c={id:22011,severity:i,pb:o},u={id:22012,severity:i,pb:o},l={id:22014,severity:r.z.Critical,pb:o},p=(r.z.NoAlert,{id:22021,severity:i,pb:o}),d=(r.z.NoAlert,r.z.NoAlert,r.z.NoAlert,r.z.NoAlert,r.z.NoAlert,{id:22027,severity:r.z.Critical,pb:o}),f=(r.z.Critical,r.z.Critical,{id:22031,sever

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\experience.d2b31817482080b4440d[1].js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (62058), with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):232444
                                                                                      Entropy (8bit):5.7571438892711875
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:z7c/ckbS2b/EhrWjhw3dJqWnQHdzJg7hJ5BjHnatGJNyWVzskx+jlqAGu/oNxKIk:HvkbPjg9MmyWsMUd/sJb1rNA
                                                                                      MD5:1BF998F38446F87CFEF275677F9BE4D5
                                                                                      SHA1:C6E841BE7A772C2C068D246E6ECABB2DEDBABDB7
                                                                                      SHA-256:0DCDA32DD103C931D48CFD55C4FDEADE2D6DF3B4AA7FFBDCA5A4EAB46D582606
                                                                                      SHA-512:A08901D56E3906FD768649E2134F33F1F557D04D5F7DD15ACA48F4D485D7D722E733FCE8B143656B3218510B5D75E7E6E828D245B2394FC8C5880E84FF84B738
                                                                                      Malicious:false
                                                                                      Preview:!function(){"use strict";var t,e,n,r={12451:function(t,e,n){var r=n(8460),i=n(2132),a=n(82589),o=n(9925),s=n(96838),c=n(56595),l=n(54616),d=n(82512),u=n(98182),f=n(8488),p=n(30786),m=n(4108),g=n(23159),h=n(65212),v=n(27310),b=n(54085),x=n(3460),y=n(91898),w=n(42390),k=function(){function t(){}return t.trackCallbacks=function(){switch((0,x.Bn)().currentColumnArrangement){case y.K$.c1:case y.K$.c2:t.viewType="size2column";break;case y.K$.c3:t.viewType="size3column";break;case y.K$.c4:t.viewType="size4column"}return t.viewType},t.getTelemetryProperties=function(t,e){var n=!("false"===w.c.getQueryParameterByName("enableTrack",e)),r=w.c.getQueryParameterByName("ocid",e)||"hpmsn",i=u.jG.ActivityIdLowerCaseNoHypens,a="0",o=!1;if(d.Al&&d.Al.ClientSettings){var s=d.Al.ClientSettings;"true"===s.static_page&&(o=!0),a=s.browser&&"true"===s.browser.ismobile||s.deviceFormFactor===b.p.Phone?"1":"0"}var c=u.jG.CurrentRequestTargetScope&&u.jG.CurrentRequestTargetScope.pageExperiments?u.jG.CurrentReques

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\favicon[1].ico

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                      Category:dropped
                                                                                      Size (bytes):4286
                                                                                      Entropy (8bit):3.8046022951415335
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
                                                                                      MD5:DA597791BE3B6E732F0BC8B20E38EE62
                                                                                      SHA1:1125C45D285C360542027D7554A5C442288974DE
                                                                                      SHA-256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
                                                                                      SHA-512:D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
                                                                                      Malicious:false
                                                                                      Preview:...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\me[1].json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):87672
                                                                                      Entropy (8bit):5.374212660672309
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:e1rAwA+EzE+tWS4N7aHOrdYytFLmDJv5jqcEqdEqbEqHPSdtyrB0CUlXXBE1czyv:ef77aHOrJ+JNEj5DXXwTcCnEFo1
                                                                                      MD5:32A42526645E11AB567D3CC5B64AE43A
                                                                                      SHA1:C600FD8239D2B1AAADE5FAB8E472BAAE6492800C
                                                                                      SHA-256:7F1D4B8BA9DB166B434E9FE0337B7324E1DC716C16FFA29749E8E6E11BBC4AE5
                                                                                      SHA-512:AC12A03DF9CDC92E316DD17DEE7A147659F1834D3D7D3F0724097980B65BE2F778CA30462E2DB1F2DEB2DE4C3F7F39D1931E084A75C89C45A0D4AF4A191365B0
                                                                                      Malicious:false
                                                                                      Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=9ac72978-c397-444a-acfb-79a055414da1&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1pwKhs","type":"article","title":"Travis Kelce Is Joined by Patrick and Brittany Mahomes at Taylor Swift.s Eras Tour in Amsterdam","abstract":"Brittany shared a video on social media of Swift performing \"22\" on the second night of her concerts in the Dutch city","readTimeMin":3,"url":"https://people.com/patrick-brittany-mahomes-join-travis-kelce-taylor-swift-concert-amsterdam-8674315","locale":"en-us","financeMetadata":{"stocks":[],"sentimentRatings":[{"topic":"wf_sentiment_posit

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\microsoft.afc9b4502f5cf6f88cca[1].js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:ASCII text, with very long lines (65448)
                                                                                      Category:dropped
                                                                                      Size (bytes):94620
                                                                                      Entropy (8bit):5.4076498069548435
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:wYqLAnwLD2AFtbo2k3DG5wsxWkNcdJ/r3LLnt9+tISGtOMHiYnEvlwXLnt+79VlU:w7L37ivM1WkNWnt4KClwXLwsoxsE+
                                                                                      MD5:095130BBC3EEC571FCE0F8B59513E250
                                                                                      SHA1:391DFF8E9455FA291AF53500A60BC955B4E586A8
                                                                                      SHA-256:F834D3999811C38EACD96A27AFC0B913B38E84BB68D14D3F6DDF815C7D1ECB3D
                                                                                      SHA-512:35101C2CD26FFF76719977B4A99D769A0713B23BF874E43649F4EB6699E0A01BA74435A870C7C02B56DA1C928417B66EEE019B9B1ED3752F06C95CA8770D3E1F
                                                                                      Malicious:false
                                                                                      Preview:/*! For license information please see microsoft.afc9b4502f5cf6f88cca.js.LICENSE.txt */."use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences||[]).push([["microsoft"],{39115:function(n,e,t){t.d(e,{Z:function(){return M}});var r=t(68897),i=t(44611),o=t(89734),u=t(98693),a=t(38629),c=t(64648),f=t(73966),s=t(64973),l=t(26105),d=t(46540),v=500,p="Channel has invalid priority - ";function g(n,e,t){e&&(0,f.kJ)(e)&&e[c.R5]>0&&(e=e.sort((function(n,e){return n[s.yi]-e[s.yi]})),(0,f.tO)(e,(function(n){n[s.yi]<v&&(0,f._y)(p+n[c.pZ])})),n[c.MW]({queue:(0,f.FL)(e),chain:(0,l.jV)(e,t[c.TC],t)}))}var h=t(27218),m=t(24200),y=t(92687),S=t(28055),b=function(n){function e(){var t,r,a=n.call(this)||this;function l(){t=0,r=[]}return a.identifier="TelemetryInitializerPlugin",a.priority=199,l(),(0,i.Z)(e,a,(function(n,e){n.addTelemetryInitializer=function(n){var e={id:t++,fn:n};return r[c.MW](e),{remove:function(){(0,f.tO)(r,(function(n,t){if(n.id===e.id)retur

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\thUP90HRBI.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):15442
                                                                                      Entropy (8bit):7.958546245417921
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SGgppasHNK+E7QFXaUhX7wVVkFvKETHZrArF7:SFpTHs++QFzvF9qrF7
                                                                                      MD5:CB3DEC79FB33EBCEF50009869B918DBE
                                                                                      SHA1:C23FC7455DA9535F3EF229CD1B3B3D28F90E74A2
                                                                                      SHA-256:652A48CA0DFE81D2ADFE6EDD0FD4B5899AEEF861AC2A48A60470BBC34E7F5DEE
                                                                                      SHA-512:4BC66F5B4F5595E4F85CBA4A8FA9D3B1AF7116801DE2E7696E426B1A6770F3AF87FA83D0E70B8C47A44A3B7E6563A93E6836CD7F97D3797DE31298CAA4937DEB
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...O.&.+2.6..3.+...j..,^"..I.Sv.n.ly.z.j.a.....k...6mD..c[..`Mz..I.+..hu..z(.i,....\yq.~..#..Pn.b.~E-..Q.X.)....S#.M.8.M....:.....M .X ..Z..ui5..B...2...s...MBKi<.[..0.!......yiuv.Gn.F..W''..M...&.ge.2.(.M.......A.1..}...2...,......>.....\..q.)#........ rd\..F..{U]GYI%.X...bBv..~.j.I.?f...z[..A.....^z.......9..r0a.QQ[....m,k*H..... ....Y&.....A.}.6..6

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[10].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):22229
                                                                                      Entropy (8bit):7.970589544361738
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SfFVdfkFp+IOTvNcUyYrT57DCzOnWLXbRxBErQrOBw/CLgrlHuzHyMy:SfFVa+HTny4T5qeqX5KQr3rcSF
                                                                                      MD5:768FCC03DE12068FE4FBAB02883989B8
                                                                                      SHA1:1368A0B3D527964634A659B32E94F9756382AB20
                                                                                      SHA-256:953EC8F9CB84C6B681BA8CBEE4BA71516F81D309741514984B46A53B126445BB
                                                                                      SHA-512:CB22CD80F5A0C3AD6CD658C54C2F04A54CA84FD4D4E19566B45DFB20C8FEE61F889F5870BD34F696FC5EBC683B44C84823275136E96924F738286B0DE361B570
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....'..Y.>...A....X.m5<Gqlv7....B.......i.=.t...6.=...\N.LPfM.N...08..8...ZJ|>....`.......$.lf..9......NN/~..4.....Y.g. ...o.....C...>M..&......9.&.q.....qZ:h7..}i...q...w..1K:.4L.2.!......u...h...h...o.$......0..p.Q..'.+.,..z.....RK...;N/.2$Q,.4.(.(.S<I.KG.....Z.....Z..9#....M.r.4.....::....-.._ASm..j.y..T..vw.\.wu|.......7..$...W5(..........VK..1Y l..]~RH.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[1].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):9844
                                                                                      Entropy (8bit):7.9212731555816065
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:Smp36XLxWphLCvBHp28TOjw5KgnrB2rbA590YKNOPBdy/96I:Smp36M+BHpTTcw5KQ5uhNKfy/H
                                                                                      MD5:7E6ACB52DC7B97EE30F194C7E9C99704
                                                                                      SHA1:9F7582D0E9367BBED852888A2763551DB9BF4F4A
                                                                                      SHA-256:5776951257F84971A0B44C3D6138B0D7ACC399DD0D7FE9D3437127B99E519CEE
                                                                                      SHA-512:1D84AEE972DFFE161C7FD8F3483715CC573FC960C23DE8727FFF332EDF9618E32E478948F599927DC0A200DCC68BB6C8802895ADF6C224AEBAA220BB03E51369
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..$H"V....UK..d;......=...J.<.!z.y..K....&...7.[.9.<`.........7.....7.,~[3g..N.C.z..6..0.B...J..nb.?..lph.l.JG...i..>..lw.....r.~Q....g...z.&..B..{..s...:.8.\!..G.....^>...\.`.=sL..o.$c?(.,jT/nh..3.b~.j.....K#.sV-.q.........}k/..1....<'y......N.b....|(.EQ....I<.v..c..wz..y....n.7wR.$...wc..&.*?nO..P.....d....,..Y...N...8.....V$.....l...T......^..|..O....IO..u

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[2].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):7916
                                                                                      Entropy (8bit):7.935065740021324
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:SMn5+/1t4AJFRzJjwfAz7+F/L43XFk2DNwLzjaleYgc+w:SQI/XXRb4/QXutLz2UYh+w
                                                                                      MD5:4DDD15BE77799F34610FDA55399EC187
                                                                                      SHA1:F99BABF116215581FC024083C55C450B1CDBB2BA
                                                                                      SHA-256:1827DD431264F8C3CE9DBC8E04699AB29D2BC1174D242F488B32E4C54B99917C
                                                                                      SHA-512:539DBC7F0E09C59AD484FAD16D0019DE9A2E789F78FDB23B961A874DAFD77D7071209435FC40C54F16878C4E3484333B7A80392EA9CD3018804C0856B22D1F53
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..w.(...\W...q..8.N.0...S.=.4......H.^.....k.......84....t.4Q...Q.G(j6..7.......3@5...6.m=i1.N..>FQ5.K.W.~....o..>_..i.\K.4..;.7P..~U.0...-d...b>...B5"....rg.~......^4.^.,.......r{..&.....y9<z.......q...B;"....E'Zn...G..&..Z..-&.v..zS.<.\.....J~=..)E..^..Q.d..N3..4...9.e..m..3N.........+...i....~..Z...mu[K.`...K........#.Z....4...:zf.0x..c5R7oo.(.Mr..H0.G.7

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[3].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):10642
                                                                                      Entropy (8bit):7.950167035201569
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:S268YNutQ19LLAVqZGzt++CFCs+lgoGlOQg7/HqLA1GX8eDZ+3l55QfIJIp5zH:S1o8MVy2tlCFboG8QoyLFX/DZNfIJaD
                                                                                      MD5:B748C14E8E982F4CC139066276094A58
                                                                                      SHA1:7AE5F0B3EF5777582CB884FA46FFD14FCA312C9F
                                                                                      SHA-256:9FF9ABAC6221BA293D9348DF149FA09FD3E107339E012F03CC3C1C99F252EEA5
                                                                                      SHA-512:49F14F00E80EBEB045EA210980F957FA2967B99E10E58F0D56581D7EBA82E109ACA59556FE119114CE965A9A3620C14CCEEDA596BF9876DE50F91B0088667DA2
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....O.u.B.295_N.a.].......C.X....h..?>.*../.M ..WE.x.+;...Y..=+k...1W..y.F..:.h5U...c..A...&.Mx..UTp.....\.....>.4W;.'s.)U.RWqVF...d.Yw.*.G".._..)..c..Z..C.G9....V...eh......t.7.g.......;.E..\...M.#.X+W.U.T..9_..P.\.h.M.}.S...]~..{....wm...7..j...bjB.y.B..U.b..T.. ...]..............Q]................f.Y.`d.R..-.->.{.<..Us.h.......? ...V4.....6.o!=.nk.'

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[4].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):15662
                                                                                      Entropy (8bit):7.945956165982003
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:Sh25fhEHQmSKPOsqzauOCkE5iiENhg+O2EWeIunoMkcdSlhvGKuT:Sh2dmHQmSKPEzahCk4ii4S+ON9BpAm
                                                                                      MD5:3C0B7B9172AF92784FB1837F6C44E3E6
                                                                                      SHA1:938EB2FD4FD34A2FBA90B47C8FAE245B3B312331
                                                                                      SHA-256:B276AD67EEADA0B6AA87BAAF6404C44233C2D5822C4487FB56975FF33DED2083
                                                                                      SHA-512:324314FD551CB4D9C0B6F308B6D27A28CE4FD2C1E3DF6A160FC2BABFB94FC316D53CE41AB841AD9DC640F38356A27FBEA56564A338770342AAF1492BD56B63C5
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..v.fB.....y'.1....5..p.9.+......O...../....3....o.=!.j.....w..l...-wh.... ~5..D.....<..z5....2<..g..9.a...S.?....T/o%.....(.#.a@.k..~..5..D8.;K...........(.z}....w^........>...*.....[...G.G.?.X..~...W.4..".T./".&*..r...s..W...|Ok...uK..]9[...C&>a...5......>....Bd....K|uu.........R..2..8q4%......~...R......q4w.Jn!1.'..l..7..S.......%...%....$.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[5].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):24152
                                                                                      Entropy (8bit):7.966634330006894
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SKX5Sn423xvAHdFn8uWR9/EAWMNhU9qDYuB4Xbz2wmFPgxFZmhsL1SFRq:SKJS423BG8/R98AWAhb4f2DFWZ93
                                                                                      MD5:27913BED352C1A153B374AF394E70C4A
                                                                                      SHA1:FB749AD78A94CD2D00D94C4FC398ED1B8FBBC54D
                                                                                      SHA-256:6B1D7CFDB61CB1BE4BD808EE6081AC09E54C94184E89A4B6B2849479BBFA3151
                                                                                      SHA-512:A28B1F82595BCD26A5C4AA42C0FB23F897F3C2D18566C5CE9751D296149D001C34D392A439F6C34DCADD9BCA051D6D55CBD669514FFBB8CC96759EC66970C72A
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.0..d....A.~.gs..e..jr...#...d..?.H;..4...ur....-..5.q..=57..W...z...?..y......Ol....../7..*7ff...[?....wmc.......e]1_..R.......wG........C#)..,@..=.7&.g.'...Q].......x..[..<}.@..t.Oi.q...W..{t....E..7..>.sr...=.;.8.$g.\..>..7....5G)+....|E.F.s.1.\W).j.&?..aM.%......}S...E..F..m.c..e.1..|Go.{$j..W.<..|V~..,.........]]_Y.^.:..p$......^..$......f.-...I..J.W.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[6].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):21334
                                                                                      Entropy (8bit):7.965361577166946
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SjsvNwatUJXOwm29FPiZHnXwSN03KSsGAJeFrpgA5WQBENpTknP2dyXghJo5gcKw:SIvyQUswmgFCXHNOKSsHAfkp4nedyXIA
                                                                                      MD5:16AC41FB5231322577ED81455EF29393
                                                                                      SHA1:DE47BAF0FBB7AAD5F0F625F9BA6B2495CBF45E82
                                                                                      SHA-256:5B3801EAF44D121758B5CD4067996AC99E34853CFFFF734281CA19DD461093AB
                                                                                      SHA-512:5374B7185C9FE7524975C0FB2107C1B14E2BA984091F9D50A81292276C72AB5FDE056145DB6DA73C5601373276976D4A909D7CD074E2B1CC93315BC0AA581A2A
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..ge<FMO.$....Zr.S.%x..iV6...=._......h.Ur...ar....-mg..mm....#\......e71`.1......z......v.Z...d...y=.I..nC...s.....Ig:...Nrx.M.4....o..-..1y.o...s.W..O...m.\K..C.d0<.}.wZ....F..........9.:I.\v8.9..'....n.B.Y...k3.V..S|..?......Z...$.m.~u..w..!....<g...5.-....-H.E....)R...F...N....=..R.S.p)..'.j....e...V....*..O@Ol.nGZ.<.q./.u..T...h.'[s/.3...YVn..W..;0Xx

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[7].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):15432
                                                                                      Entropy (8bit):7.950535552309699
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:Sssg2To2sUYlfOcYnT3aB0+dD9Gu/p2eQdHAZKbESuOyoI9T7:SszaYlmZn7a9nvoJkEESuRV
                                                                                      MD5:B6F5CCB2E18CBFAFF4482E58384E981C
                                                                                      SHA1:00EDDAB14B6F813BEA603A59272CD721C3AE5B3D
                                                                                      SHA-256:C269814C3B6E46260D5F90F9FE04BB908CA0E33ED7D070F67FCB6932CC067AA5
                                                                                      SHA-512:70DF9A2A5ED4F595D4C0C37C61166C50FD6D6964096E4C7FF443466AC20AB8B0274150CD35F3658F94F4759C786C7C29001F1B7EF9C336B51CF0875F4DBEEB3B
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(...(...(...(...Q@..Q@.hh......\.Z>.}.....yV.y!..!G..t>..^.........|I._i..v..k..H.....(..$.G..B...zvmT.a....6...&.Um&.X..a..6... 8(..3d..'.v..k...;F./...6..'..<...u....o..".]}..]..4..LO.-.......I%W.....A~rn.p\6.p......Ac.GS.[V.U..o..=...E....~.}.6\.\...P..i.}..4.i.W.O.M4..M!H.e.....S.U..5....e..aw?.....3K......+.........n.<1.j......<.#.YU ).].y.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[8].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:modified
                                                                                      Size (bytes):24607
                                                                                      Entropy (8bit):7.964657379968208
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:Sim4dLKwHHkAtM0d1xluBcP04GrtLqUKZyXU9n:SO1KwkOd9M4Grt2UyP1
                                                                                      MD5:4DAB284B4A23E0ED9E84A8C63FAB1C73
                                                                                      SHA1:71805BCF126FDD3E95D7D34604D82DABA6170AAB
                                                                                      SHA-256:999ECFE35C02AC5547F43C6122EED563CB97A7EBAC9E32CA59BAB1FD1EA22642
                                                                                      SHA-512:D2C96EEA2532EE35220A44E95087C2A1831B64CBD40A1E9A3E888ABCA967704F9957B323D8DFAF661F35BE76F5CFD15338CF415F94ED4BBFC2A8DCA15487699D
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...O......8-.*...1..q..7t.t.UY...".$..f...pO.Ao.V..r...5J9#KB.[-.....^.G...T......9..qSY..]G......]F.T...*OU...=.....q.o![......1..`.......n;.k+^.MB.tKu....<2.....Ts.9.$...;.:......ms.,!v(.....9...s.r3\.....T...w2....o.F..r....}.p.})....Y...Q.....EG.J.T.\.|..$...x...X.5..W..h|.c.E...o/g.....:d...m..6.\....2[.........{.5O\}.y..kf.[.YSle..o..A.....F;b.5.Q.7t

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\th[9].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):24531
                                                                                      Entropy (8bit):7.971309259679738
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SXM+vIR/3J++oXwDqlmjpV2SATXWqf0dfcQTQIyRiyyUboDSqRsnInxGvPSYrgix:SXM3RvJ++pDqcpV2TTZ0df9TQIyRiyym
                                                                                      MD5:A4925F23EA1F87923E5C403D72534AF5
                                                                                      SHA1:424324AD2C5743760D1EA6F9A12758C4072C2AFC
                                                                                      SHA-256:5481EF439A7F2CD598E16FFAB77CF3A68771B741BCD7DAAA74A85031052497BA
                                                                                      SHA-512:893D85766ACAD9161219BF6BE5693D695BC697BC7580903FB3DB693596B28AE4671F880D3564C8CC54B10E9083F0A387DEDAA3520C956E059935A7AEF98C7BCA
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..|o.k...u.WpC.h.<.R....\...0...(..|.}.c..]j.a.....f..wE.{........C.g......OxT.....~.....z..%...Q.`\F......OA...x.]...&.%...yZ..Lf..`..,X...+.u-..Y.}/Y..&WY.a .F..FGn........[..+T.|=f#Y.=.3E.............V...5.%....'.IG..q....b.H.og.....,.yB...{..V......PJ....?-.g...5.?.../.&...|.v.<6.|....q..f......g.\..6s>-......{k.o&.7...?7.Y.:...$.......M..bO...

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vendors.ceb76f35d860aa8f957e[1].js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (44421), with NEL line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):194878
                                                                                      Entropy (8bit):5.419148582153614
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:USCgu0MjuPJ3dKoxgAQtzbwDZ777/3DwL0s0p:USCgucJNbu5+Z7uhE
                                                                                      MD5:66DEA17B79E0857DF311A6FAAAF8ED11
                                                                                      SHA1:69082E6D4E4F691747E2324EA7BB82ACC3A160DD
                                                                                      SHA-256:E2A2BA0454B5E8152D355A441E9258FEFA16C309C4E59C10AF9C6DD738EAFEC0
                                                                                      SHA-512:682E51D518946CB9282BD6D08DF85612EA01CF2860F7EAF83FB2BCF46AD0D940B05018C5EB6652ED8E02A4989EB70D72E2285476A3C27C5EACE52F0FCE8E0D25
                                                                                      Malicious:false
                                                                                      Preview:"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences||[]).push([["vendors"],{29558:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},74322:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(String(t)+" is not a function");return t}},25135:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t)&&null!==t)throw TypeError("Can't set "+String(t)+" as a prototype");return t}},6664:function(t,e,r){var n=r(23362),o=r(35093),i=r(79549),a=n("unscopables"),u=Array.prototype;null==u[a]&&i.f(u,a,{configurable:!0,value:o(null)}),t.exports=function(t){u[a][t]=!0}},99027:function(t,e,r){var n=r(58306).charAt;t.exports=function(t,e,r){return e+(r?n(t,e).length:1)}},57699:function(t){t.exports=function(t,e,r){if(!(t instanceof e))throw TypeError("Incorrect "+(r?r+" ":"")+"invocation");return t}},45150:function(t,e,r){var n=r(26397);t.exports=function(t){if(!n(t))throw TypeError(String(t)+" is not an object");retur

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\AA1jly9f[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):405
                                                                                      Entropy (8bit):7.210520499858802
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:6v/lhPkR/C+nyke1I1bDhfWTOnJNGflEHdYo93zyW0X22PrmLo2qufrYXup:6v/78/UIFdcOJWad/ycCraq+rYs
                                                                                      MD5:C549DF847E13659AF701C4E359AAF61C
                                                                                      SHA1:88C4025B41357295948213E0F5BA7C95B30731B4
                                                                                      SHA-256:38D0FE0FE42DABD600CD0F434AA7138A11425B0F675EE7C4EE350C2D3ED67CBB
                                                                                      SHA-512:1D3E1A08F171EFE02161F6A672A2DEF35B35967E47E0D58CC71B93FF4758387984A96A59EC99FC8C122FCAC1F7912D9E7685808F9889D80A3A24CA6B15651ADB
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...*IDAT8O.Q.J.Q.=...T"~.[.He..>.RF.:h...|.j.w.n..(b)..J+u......c "..803g......B.N..W.GHv".>qF.s....t|\....l....9..C\.\..c..X.Y..Sm.1.6.g..In^"....H.........Cg..^........A.W0...v.G.d{,.@*JS..T3..zEa....1....?.xt.....Kf.x.s.O..ug......3.~.......*...H.>d.....!...w6c.V#.W...................@#n.....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\AAU2AGC[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):3353
                                                                                      Entropy (8bit):7.899130124969502
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:+JCKKxvfRuX7q3Kt/1sQfDFNVL/klAXHjegxkQhRdo7SKKS:+0KKxg3/DfpPLsOzFaQhE7SKKS
                                                                                      MD5:A2D9EC76C1347D7986A90D548C453449
                                                                                      SHA1:8CBE828A6B8FFB514C7C5666998C310935B0F3CF
                                                                                      SHA-256:3C7A6558CAB24C3DD577AE362D1A3614DDF146E433B897987F18D32A1CFA2335
                                                                                      SHA-512:956174788FCD783F0531DDBCB0B79AF88D9D52F45A57E15A0F9C48BBFD3F90A67CFB8DA9D1E8CA7F6178D39650251272C3E4A780EBF0C12D2C4270EBAB249FE3
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`......w8....pHYs...........~.....IDATx..wL.O....O.^.+..{...`A........c..5....{.b.".b.+v....~.N...{.....'..n.........cLc.i.Q.^.J..Q.....d..$.. .%..(.HF.@2J..Q.....d..$.. .%..(.HF.@2J..Q.....d..$.. .%..(.HF.@2J..Q.....d..$.. .t.....+]..i....../^............2e..F...2f..}....=....)S....3f.../..4h..4..?.u...,X.O7o.d.^.bM.41m....[.j.....jC_...~.j....+Y.$]w..=..g..T.Rl.y...V..W..k.5.g.;{..i....o.>.....Z.-....:..~......g.Q...3...'4777->>^{...~....n..%&&j.w......}.{.6y.d.._.|...l....k.2e..1.}.......};p....]Z.|o..0`.i.Y.....E.........Q}.9.E.H...<.._.n]......)C..j.IZy..q.b.....{.f.1///+].3..9B..o_.~.zC;4.3F.....O....T;j.(V.J.6d..j...~.........k.).S..=.`..s....6d.f.rX.S..d....u........j..8p..V.~}....2.B.......;wn...3'i:4.W.^.k...5k.....~:.T.Rz...k.1..l.2.o..^...}<.?...O..3....r....}...7n..5.]c...c......)..~....E.....w..e.3gf.UK......Y.l.{..=u....{....C...J.*.1c.H}.,i!....[.d...1..Vk..<...D......g..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\AAywGC0[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):18737
                                                                                      Entropy (8bit):3.269694585441059
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTKkEWm+WS8ZxNXrNXNsc5Mfkdi8QIxKe:bSDS0tKg9E05TKk6+Y757di8QIxx
                                                                                      MD5:AD509A288C241C38783057C8C7552983
                                                                                      SHA1:337D2C14AFD9872C192312C4CF5EEFD0E8D034E7
                                                                                      SHA-256:33AEB0E88F6E7A3B4ACB371E092CA813D355B54D3FF1A494810A7EEC1072FDFD
                                                                                      SHA-512:8329302804D661901F70F02BFB4800FF857E07029D93A7D1439D58B62A5F5AB66271F3BFCC37DC9C651877D76AB86FBD3F8EF6A7D2F919801D8FC6A58ABA7410
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\BB1czXkU[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGB, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):15919
                                                                                      Entropy (8bit):7.905791741651181
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:C7nEpon1/jw/aBlJmc6zVZhDvNFRI6RtHA6nkAHYEZ:cEpUT6RTvVIyAqZ
                                                                                      MD5:F93DB6B469386F8C86CD8ACB469ECC56
                                                                                      SHA1:7AD7E39F97554474EBAB276A4DA67C8DA0E3DA4F
                                                                                      SHA-256:3111838D3C59A7A5DEE8A46BA89D52797896A54CD4DF63759AF9893565BD1DE7
                                                                                      SHA-512:BB0EE780ED713E3DAB0EDC25BF83944B04CEB05D92F6E91492D96BBBDCE023E3E88F59B4D339E497F49615DD7EA3F3359CD6AA1850B3F96629D5491E2336E830
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...`...`.....m..o....pHYs................TiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="adobe:docid:photoshop:70ab79b4-1993-634e-b12b-c48ce1d64077" xmpMM:InstanceID="xmp.iid:ee91fa39-aa87-42f9-8abe-3125a8696ad2" xmpMM:OriginalDocumentID="141545B7D36BB1A5C5F9F0CD38B16D0D" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCP

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\BBCleeG[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):20493
                                                                                      Entropy (8bit):3.4821975246117436
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:bSDZ/I09Da01l+gmkyTt6Hk8nTOkY9Wm3FApPNGQmPzGfNXrNXNsc5M/qtZZ76Al:bSDS0tKg9E05TOkUOAs5AqnZ760
                                                                                      MD5:19ACAF62AD617DA937EA316F3C3196F6
                                                                                      SHA1:6B0C12647CDC726FAE295681358BEFADF7E8702B
                                                                                      SHA-256:6A9290E6B7871945C9A435089160CBEDAD0F4A1994B3FB54873786A8B4866927
                                                                                      SHA-512:052E87E8242D55EB2895E809BA6A52356E2268B3D59FFFC7558764EE16FFCD709F1628A949C437F786C5CDE8F93CF9DBA49121C8CD294D433E95CDD69A0DE173
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\BBNSrq2[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):708
                                                                                      Entropy (8bit):7.656867334727435
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/78DUDX4v4w1GsRED0DPZr3ZtrtCwfsH9biYWPChZDpIOHFeeZZYMHu:oLSpREDkxdsdbUqtIOPZyMHu
                                                                                      MD5:249E1475ED5C270929757AA599B36817
                                                                                      SHA1:46E4653FCE64158992416492156C5DE682131F8B
                                                                                      SHA-256:5BA471A61298B0781E558B38F4B4EBC1ECE8450A754528A21BDB0BB32D6FCA3E
                                                                                      SHA-512:008F23260AD21D52FF83D17429290270F95B7AA0DC41B1970196E879BCD5B17BBA3F81B1B58D0A0794E0181B4076D664DA31C4FEDA8BA983E71EA34BC65ACA32
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR................a....gAMA......a....{IDAT8..S_HSQ.....d..?.9....n.F.b...I.Xd.C..K.QP.A.HO..D.I.[...&.z.a.%.f.9...r.....{O..5..%:p.=.......~.C..:.7....h...l.i..tK...}{i .B.~.....A..j.,.Ik..B.:......K<'.890.t....._..!.K..Z...........2T.9..R.'.....X;...t...q.p.HN..%i.....~`.)..{.5..c........j.*.(........A...t.JeJ.FN.(.).CO.#...../!X*...=......Ag......Q.(.T....S..v`...y1..*;..;1?.C.V3.t..c.xw.+.L..vk.B..b....D|...4....Sa..n..0.?../.ve.X.^..N.../^.k.E...v.;..1..;P.....d.1.z$b........&....q.9........(...............%.&....&..S&D.J....J.X%...dV...a!4..9.U}...}.I...G[Lb...=6.MY.\.7... ;.....m~....z.........e.#0{l0.s...i....+....,.x..../._..O_C....I.....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\BBxWcHH[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):3414
                                                                                      Entropy (8bit):7.894566432523783
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:nT2SDZ/I09Da01l+gmkyTt6Hk8nTVfTmrWIt:T2SDS0tKg9E05TwrWIt
                                                                                      MD5:CE6C689434799AF82FEF032CADEDCE75
                                                                                      SHA1:404B397A99261F6109BF1C5328E27819C695E861
                                                                                      SHA-256:0D7C3D30DE78997F1ACF95942B757726AA1FFD7893F307ADC2968046040DF2A2
                                                                                      SHA-512:9C44377B2AC9BEE16C107261D64124288C45FEDC5BBB11B41C95CB19A57092F6CA8D59B0C0ABC206B27FFFC24F5F16AE8728EEF2E8251D2CE9690786CD927F83
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...............h6....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\EEFX1RN7.htm

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:HTML document, ASCII text, with very long lines (57699), with CRLF line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):193100
                                                                                      Entropy (8bit):5.463408617304245
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:ftkgFLF3xsDWH+BCDheFhWNyhxpAOukO/xY2:1kwF3xsDeDheiNyhnAwsxY2
                                                                                      MD5:B82D7BCE9D7E6D8FEE22A849F39DAA44
                                                                                      SHA1:B44C72FB785B9F84F5C1DE859A66A446BD63EF05
                                                                                      SHA-256:70FBA3466777E6DBD12CC1CA1CD1868D1B1C4F27D2B2DC9460DCD047E41B8DF4
                                                                                      SHA-512:C0D289C43E6C5E164ACDBC6E63BB02B4E7BE32B69CF60A3D580F26F835D03F941B608D3BFE02E731A4356D39A6846F02768A4C702BBC26EADDC12766B585D408
                                                                                      Malicious:false
                                                                                      Preview:<!DOCTYPE html>..<html lang="en-us" dir="ltr" >..<head data-info="f:msnallexpusers,prg-sp-liveapi,prg-shop-staging,prg-hub-staging,ads-controlcbceleb,cprg-rvr-ads-dl,prg-rvr-ads-dl,cprg-ctrl-viewspage,prg-1sw-sa-ntf-ddp-c,prg-1sw-sal2coldctxbc,prg-1sw-spdptcf,1sw-esprt-shlnc,prg-1sw-header-event,prg-1sw-headrc,prg-1sw-cdelay,prg-blck-web,prg-1sw-mebc81,prg-1sw-tbnewicons,prg-1sw-dibdgc,prg-fin-cl3ad,c-prg-1sw-curff,c-prg-ad-more,iframeflex,prg-adspeek,1s-winauthservice,prg-1sw-haltmmcall,prg-1sw-nommcall,traffic-pr2-news-cf,prg-pr2-widget-tab,btie-ad-ctalog-cf,1s-ads-ntpcta,1s-ads-ntplogo,prg-ad-cta-logo-cf,1s-fcrypt,1s-ntf1-flupc,prg-ctr-pnpc,preprg-1sw-sadwf-c1,prg-upsaip-w1-t,prg-upsaip-r-t,prg-cg-search-api-c,1s-rpssecautht,prg-1sw-p1wtrclm,jj_fac_c,prg-1sw-ofett,prg-1sw-ofet,prg-pr2-icbdgtt,prg-pr2-icbdgt3,prg-pr2-tbnewani,prg-pr2-respsection-c,cprg-ad-dtag-agv,prg-1cashback-logo-t,prg-unified-pclick-t2,1s-p2-promotedondmd,1s-wpo-pr2-promad,prg-2unified-exp2,1s-wpo-prg2-sdmr05-c,1

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Icon[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):533
                                                                                      Entropy (8bit):7.415663553371965
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:6v/7Ya7/6Ts/o7hJW8/t8oX8qUkUGGVIXC/zoZ3VYZwWSVR:E/6pzWK+q/UGGMC/zw3oGVR
                                                                                      MD5:B6162D100379E7F4EF709BA5C26D1BA8
                                                                                      SHA1:AEA4244C56F00AA26064134863157A6EE9D7ABB9
                                                                                      SHA-256:DCA74022BEBB4F12F8EFADD226C9413CAFFF9193420D604DE8A398642172AACA
                                                                                      SHA-512:CC64207C45F85255F34A157C9370A46EBD4A2B3A674E639838EF7582FD93D68F91A275C577E2FC9A46674EC765D8CC43A5BE28B281FCD5006D38D0C6F02E2058
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...<... .....N.......pHYs.................sRGB.........gAMA......a.....IDATx..=O.1....$....1..7.....p32..)..Yw..p..IL.$qT'......1.#.h..j.5...9...~...w.....oe.....]8,..|..........``.$a.K.&Lq........D,D..8e.c.....fQ...u..%.(..b..8A......,>@6....Y*...9.(...d7........,!zr.N...T}.....j...NY'..|.=N2Q&<?3....@..-.e.h....F#..2.v...n..!-.e..&........%.e........y.c.y,.e........4'40.t"...B.........D.../[D..6j....^>.....g...3...5<Hv.H../M.+Y`.......OXw<a.al..aF.@.../.E....=;S.K....s.......IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\desktop-shape[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 7 x 13, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):197
                                                                                      Entropy (8bit):5.986656121330302
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:yionv//thPlyyta2/uDlhlp8Lts7CX9/2yx24lSXqU3hjg/BFCb0cCHxlbVdMaW9:6v/lhP1b/6TsR/R0Zjgz89CXVdMndp
                                                                                      MD5:34760615AB0C180EB4B48739297FD0F2
                                                                                      SHA1:789438D09CC27A08879B1A9686C82527270E7C24
                                                                                      SHA-256:360C33D59E7358579601909D4CE91F1BCABF9E07BEB8F69D50C226D7D8F91260
                                                                                      SHA-512:1CE7E574D45D123C6B52119907E74D71B842F1CC380D79AEF876FDBC9FDB663F385BB4191650813D2E66EFE24265FD36EC944AF95F372C0413EDCF11361CA666
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR.............e.t.....pHYs.................sRGB.........gAMA......a....ZIDATx......@.EA.`...U..1\.......X]...G..{..HU.4Uj.`..O .3;..\..!3...q....[s./.@@..p...>.`(k..2.....IEND.B`.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\logo[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 1633 x 708, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):27928
                                                                                      Entropy (8bit):7.701164569435742
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:xSufGKAfaoovahBv4apFM4lvzDpqFosGd+Up9FIK0B:jfUMve54E//fCiIK0B
                                                                                      MD5:862D29153222B9B15C3C73B61B930335
                                                                                      SHA1:391BEBF4BA8910B718C5516491EB1C7D32D4C187
                                                                                      SHA-256:3EC8FA41DCE2684102F4A7B2D993388809CC2F6AE0616807CA9E3D94E6D19AC2
                                                                                      SHA-512:6FFCB08DE27DFA571C8EF35E7F017F2871482581308C10CF38EFF9A507D02325222B899D667FC86227C2985ACA05F17C1CD33EF4163BE3442F70F8907BD78404
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...a.................pHYs...#...#.x.?v....tEXtSoftware.Adobe ImageReadyq.e<..l.IDATx....u.7.0.A......@...T`o.f*.SA...T`...+0UA..BU.X....a,.......u..:.%..`... ..........a. ......................N.....o..z..=.....r!..^..Rr.....J..b.{..x...9^....u.^.?+.......!..kQ`.....$YNo\/..km.4.n...........1H.0\e.$]^w..K.^....r{I......0.I.v.@!...6.r\..JI..n..9W......<.$.O.0.3]...W.|..n.B&%c.)......cI...e.K.^4....ZX!......C$a..rl.x....|%..I...x.]........I..m..a.?.vml76.O.:.lW........0|..!.M..D4.%..Yt..1+......h.$........w..c.B......&I..._.e..R.%c......#..b.K...d.....@c$aZ*....&..R4.F2........0-.r..n.|y#..H.Y..VB.....P....n!......MZ..W,.E.........>V..Z.!..E.ND#{..:...\(......!.Sc..0....Dq....eK......(.$LM.i.K->t.d.g......(.3a*.~.......x.b........\V.^..C...A.....Y......@Y..)X.a.?V..L.R.^.~+......e..)T....x....2.=..y..............L./..!..:^..}.........Y.S...i.Xv.0-K.b>.p&......y.......r..~./>u.U1+........0..!.:..x]...Z(......#.....<~.....s..........

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\me[1].json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):125680
                                                                                      Entropy (8bit):5.2981175540624
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:es1cgKkC/ROAcVP0o4A2RhwEM8iiBehWh9:es2gKkCSegZiB3
                                                                                      MD5:264C48FAD6621054D289DFABA5E33E47
                                                                                      SHA1:4CE3B2310680024FD462DEB3DAA8A56660EC6F7A
                                                                                      SHA-256:D305D4C4667FEA9C29E6155274FF8A006472A5E6AABEF450AF77CC41881216C3
                                                                                      SHA-512:2CA01DC39C91DBCB71734769539E2DF3E0880D190EB4FA92496B50B0971625041F4D2DD89FB2DEA28B4C6B7B9CE2D8F0F6FCBF84073B41D817968C5C983FB8CE
                                                                                      Malicious:false
                                                                                      Preview:{"nextPageUrl":"https://api.msn.com:443/msn/Feed/me?$top=32&delta=True&session=912d9ccf-2c16-43b2-851a-d36ef8d54473&$filter=_t eq 'CompositeCard'&contentType=article,video,slideshow,link,content360&infopaneCount=24&queryType=myfeed&location=47.7159|-122.204&ocid=msndl&apikey=Io4orNtwRr08vQQBER8stWzJbGltMJzMwkmiMOv9z3&activityId=7FF05383-E874-420B-A4A9-263700520B95&responseSchema=cardview&cm=en-us&timeOut=1000&WrapOData=false&DisableTypeSerialization=true","subCards":[{"type":"infopane","subCards":[{"id":"BB1pnyvn","type":"article","title":"Christina Applegate Says She Wants to Do .Shots With Cher' With .Days I Have Left'","abstract":"The actress has been candid about her battle with multiple sclerosis and previously said she was diagnosed in 2021","readTimeMin":2,"url":"https://www.rollingstone.com/tv-movies/tv-movie-news/christina-applegate-cher-shirley-maclaine-ms-battle-1235053269/","locale":"en-us","financeMetadata":{"stocks":[],"sentimentRatings":[{"topic":"wf_sentiment_positi

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mobile-image[1].png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:PNG image data, 375 x 180, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):23972
                                                                                      Entropy (8bit):7.983082688064765
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:OQCmhN3Hqqm87sSOvS8PJKCqedNV7TMzNjdpNQsjtHnUSQkBmSfYuoq9Dgt:dCmr3KqmIdO68MAnnWNjdpBSSQVfWDgt
                                                                                      MD5:64C4757048F068394817EE126FDBA8A6
                                                                                      SHA1:3610DC2EB5E3C09809E94BD0694A06C7A51580FF
                                                                                      SHA-256:A9FEC8F56726ECA81D0600220A6B168FFF112A5283741FD5EC63509AEDBB51D5
                                                                                      SHA-512:373EE45E16D231B2FF8A897A357A52A58B63430E0BCF728867879F2E10E55C631589D6F63C1675E2E40EB1EF7CEB59B15DF18013EA0F3FA352A3B36296F14DAB
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR...w.........o.lP....pHYs.................sRGB.........gAMA......a...]9IDATx..g.$Wv&....H_......n......1...g..r.IQg.]..?:gWG.;....s.#........;.!....a`f..n.h...].dV...{.......j.C........|..}......................G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 ..;888l@8rwppp.p............a.........#w......G.............6 .8lh...5.Hn.R......j'R.;|j!..I\7...Z..G...BhB.<}.....G..X..-...w"..]f.v~..+.HI...#._.k.S.k!t...n..;...6..`...G...L...../...1...Hz..:.....j........a.."..M...(..u.L..+m.3.">....i..pq..v.!..p...m7.gH\.v.{.....j,@...w:@.......v.....>).w.......G.r..LKmE.@........K...v0^........v..b...ja....@t`..u.......{D...}./}...}g.NN. 6..]...PS2.q.Ge<..v ..D....B..B.V...D!.T...@>G.....u.m4.Z.XZ.\X...j..F.Y@.... .."z....

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th33ZXWXZL.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):14354
                                                                                      Entropy (8bit):7.96009504545168
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SNMlpcrqwOiQ0U/OE9bFlCCYX21/0l8+2G:SmYrTOFpOE9iqNG
                                                                                      MD5:6D1EB22F97F317D3B1568F528C6E1A89
                                                                                      SHA1:092E4668E8AE120A116F719841713943488619CC
                                                                                      SHA-256:0D1E6A9B4151B49EE1265E83B36DC3C5963B74376337C86C868349124B87E2FB
                                                                                      SHA-512:93F2E18E3530B1E82A481074194EA55BD959334D9254AC1D1F13399E6432F3B73633808482A4CCEEFF9E1B1CDF5C22282C3E3007357302D5DC4916CE988976DC
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..4.c.%..ZSK..Z.jv..sD......@..m...6.........>V..c^.....q.^......5.[*.'.khi..<D.E{..jA..\..6...V...UU...x........+.{..]....m~.lx._;T.;.V:...%.VL...yp.C.ox'NmK[.....q.V.y-..k.n.w.._...J.-/kUD..S..}..W...+;d...Z.?*.?8\j....k..r.M&5.,9.......A._P.dx.;..?|.?.U..Y.E..k.......X..t.s.H...N.#..o.V..........l...X...^w.1.i.....`...i.-U......@..s.j.#...7....._j.y

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th7TA3IDEB.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):9345
                                                                                      Entropy (8bit):7.94644652565726
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:SklEVH54bbtpSifewTkZaUJzwp3DZEaJicKa2A:SklEXFqV+aUOUaMdA
                                                                                      MD5:CD517BF38F789D2C753D749BD2925C3F
                                                                                      SHA1:31B0C94977B77076CE693FA8D02F44873D57E31C
                                                                                      SHA-256:B2B77214FFCC718799964BEFE7D79E766C46E37E9611EB34655F8DD97A6F8B26
                                                                                      SHA-512:65816F7FCE1521E1A816A19CB8885F0139310787A152201DFD33F21D1997EAF896F13BF1828CB85A0D1148E6FA3079998657ADD475EBDF44BF788B9C42746623
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..W.p..E.....L.y/"..@Eb.(.X|.r..#.Wga.{.7....."6.._J......U.^L.....0wW....+..Z...m.../5..G..A.......r..........i.o..fZOk..R...Z.(,QJ../,Ct%O]...kJ..vG%JQ...........:^.w.B.0f..3#.......l.>..7..5M3K....5.8....D....E.r..R....J..tx..9%iYT.#uos_Q..7..x.a.-.......C.......c.M......j,.ZN.Qp......sP.4.H.1X....F.....=d..i.V..}j&?/. e'..).((....Y...aLx.........&.<..rE.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\thC6E7B8TA.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):14010
                                                                                      Entropy (8bit):7.954639456274285
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SKful2GcRs7f6NwvSRJw9fSVP0JVz1KLMqs3:SK/Gcmz6NwvKGo+Z1Eq
                                                                                      MD5:4FC81132CE190310E45AE4AA193E3BE2
                                                                                      SHA1:5745C680C5261AEA060809F06B2C2556A87CBB6D
                                                                                      SHA-256:0822F8D0B601D821804B9B2E3031364C0AEEFCAEFE1861A3ACB50B19E4401B89
                                                                                      SHA-512:CC4A6F50A68DFA35096B42BB5E674A216CA42123A07BB2A597C9556BB5E7EE8C5BAAC738A839118E57AC30146EE89A1BE3C35219642F94109BE8F7138BD72AD6
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...n..T.<J{......m4..Y..... .........kL.I.Z..J......B...}k...9.J..U.\.q....>r..[.~1W....F.hV`.c.g.*.YT....~..:.....J....+..*...}.km...@....M..,.J..j..w.....02;.z......@.7.........@...C.5Mj...H.....W=kz..<.\..|M..rf!.......WF3...TmO...7.Uu.WP....5..-p..z..D..c...FF..^..........~..V...9.Q[..f..)..M3...-a.[w^...m7.N..]aL....Lz....Ga..+OA.U...4...My.r.e(.IY.:

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\thEKV8FZN6.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):11823
                                                                                      Entropy (8bit):7.939717332895928
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:SN3FBIKxCUYsAVUQ7nlrBmyIf87TsBxKVQmfG0o1NEfUql1Px8RA5KYHaX:SfB8UYs+7nOU7AuV7oxwmRFY6X
                                                                                      MD5:E143E61D0E90B4C7BE9F045CF4E587AA
                                                                                      SHA1:FFA29B613401CCD7BB834B1E8FA58EF2AD7E5D46
                                                                                      SHA-256:8EAB990415D37F923B2DBF9571BFE61B80C850B8FAD2AF9C13CBD13EDF66B36B
                                                                                      SHA-512:FBC8B4C7F1A83415AFB87916B42242E238394DF82655A81DF5D528D70BFD702D091AC3C3B654C26AEBAAF191CC541B38866B78C77E66C1FEEC96278E49F63B83
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....E'.....#...+...)...P..[.'..(...G..:.J...OZ.e.>.x.....(v<W_......Y..3[S...J..w7V.T..."V..5..j.N.....)c.....`.4......}k..&..7...X..U$.q.r...r......Z..qg...ny.....}6EFl.q.J..A........$....{..Z2...t....{.k.i....Fk......d...!.^{.._h.K.*.......x..[.X...A5.F.j.YneR...c..{L.....,{........j.j...cr~...o.....i..tN.x.^C&.y.j.4[.F.....3..K.;u.2Uc..`.^..}..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\thKKLWDM83.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):13286
                                                                                      Entropy (8bit):7.960610778708579
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S47QJJny4HX6iM/5DRD9n0wyGEOpzkwYdVpvWgVY:S4CJPHXg/53n07jO1kP5vWgu
                                                                                      MD5:33D4EA65D6DF7F9F2CEAD6EDD316BF81
                                                                                      SHA1:5D17CD52D09DE325B069F61DEBFE3B950B9B6BE0
                                                                                      SHA-256:6F19BC49572877CA10EA5ABD4126826B23AC7B0C64EB4D767C1351739D6DAD37
                                                                                      SHA-512:EAD62D43569378A406E60C4A1482BAD70D0361F34532F6226BAFF6C2E9735DEADF08F5553CD816609B462C66590D2F1278992323A0B858B7581F19F519E1984B
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(V)...F;.PM#...zd.$6A.^G).^....9..]J.]s.,.M...7.......&..._=...2.......\.+B.V].z\,..n.N.dS..+..v.>....ko..I.$.-....-1n.VX.)..z...SY..3....VUT..6..\..b.<....rq.z..5=..^........:l&{.zF....Y.....H.......K..k.[.i.....<.....J......@+......'...x..M.N...?5'..|..u...s.T..MN..I*.$u.!o.I.....+7@......m..\....s.{q].........."M...."2F:t.....T.$.F,....0..v.......

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\thOOJ94ML2.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):12935
                                                                                      Entropy (8bit):7.959088298604041
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:SMhz9T/ZZ6OeGYcnHs6AT220b1MReG7ITuc1CibGN9GDO1LTZt65kPpUU3QHL1gV:SsJT/XnHs6Aa2H1I5IJxb3s11fY
                                                                                      MD5:C1D5F3D0FD02915AF199DCB46AC95B05
                                                                                      SHA1:52952E45C9D6B56547D2E0310057777F5465DC30
                                                                                      SHA-256:FF22816BC6F540F0A7A002A798A541790749344574777712FD514DCC4EB5DC18
                                                                                      SHA-512:3AA366515F5759173D5A51B915448C01C525F6C2C0729AC9835E438DE342ADB886120A5AE84D78288C9604E419A9FFC279E0D1227CE91BAA04878EC66755055A
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......O.\h........0z2.B.b+.?c.......#...7s&a..[Mv...Y{.Xw..G...A....4.J8..!F....$....P...Q....K..".].y...Z..B.....;2.u#....D.~.}.9m..D...<rF.......:..$.......K]..G_.x.)5-.f..e...z3.s.~....C.3_sK.<.T..z..g=*1r.#..fP.sT. .+D.C&7d.O....S..."..B...4r...=..Cd......R>..;....5A....b?..f..3.....N..z..=;R.;..w.].....g..F.Fw,...Z.u}..9...T..."um.......Dv....d.[.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\thPTCTPNV3.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):16069
                                                                                      Entropy (8bit):7.9529382202820464
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SAo9sy50jifwqXbEBZwHZK8BZ10LoMBFuk93JCcY:SLyy5mRq4BZw5B2oMBFb9AcY
                                                                                      MD5:6A8390E754E8C61D7D4B8B807F214EF9
                                                                                      SHA1:9E74FB20045F4DBDAAFE9BA651DC4CA6A3B9D04B
                                                                                      SHA-256:7F0BA69A9D02A15A2C2E5B04D9C1E19EC2EFBF99E48FD1A37F7F0D187E392BED
                                                                                      SHA-512:583B1EE33D7615DCC167F7D14B90DA21BC8C088B25C27293CA369C6FF799CF481AA2CAA5DD6425B9E55A99534EE02EE94264DBA8304E8B17FCDB875F2E0DA4F8
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...>3q..R..b.e......n.....YRMu$..m..sS..<.4..C.e..).._R...W.`.n..G.`..h.S..r7AY.^F.k.../..U.}i.SF...X...9$sZ:}.....b....:..S....5Eu...O.c..B.(b{..>.C..g.}k..'1....X...9.J.K.....k.mMw....[.wf....5.F...z.K.Y.rDq.ZC..m.hW+..:/..P..N9.N...O.x:.|..j.I.a..?.|....U..af...?..G.......U.Zx.t..em..g....n....."..z.[.-....o...F*...s..|.i.}...6.,..19..W.:............O...U.-/]....

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\thTCEDFVAH.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):20697
                                                                                      Entropy (8bit):7.970638555391819
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SNM9DQvadLvITwjOTeyCbO4DVw6fiL/I28gCIvLuCKX+Vq5pQL:S+9DAUzOTT4JHis2ePe
                                                                                      MD5:43D1463F3A1B654DE72481C9707745E0
                                                                                      SHA1:5608D1DA91085487E6F17608E11AA8F75D42BE90
                                                                                      SHA-256:5885F8E86D5A8CBDA947A2739FF5951473580C1123211A304011A28E92EA80E8
                                                                                      SHA-512:A3A564B20D2A9D6B68783C9C176B15218518B6FFCD9AA585836495A983F3FD97E1EF31C3A0483D9410046D5E5F4EC94C717560A789EFFEA5A04C7D209AD6CCCA
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....0ipk..E.(...%.`...E.4b..(.:4wm...z.3E.m.)v.;H.A..\Xl...S....#.OQ.?.*.....*[.i....2.Hp.:.....f..9..q....Cnt.f.0.<.... B...9A..b...d....m...\....4..J."h.i.MF....ic.1..K2..?.2...M?..d.....6..w.p....$`...Y..(.R...T..r.._.gc...K2.[h<..t.I.._O)y$.S.%..c...........I.c...C&...J.\.N9........*M...N.v.w....%pB.%..:....'.............LTn......u9..<....F*..m.........).".

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\thTOT1KUYM.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):15044
                                                                                      Entropy (8bit):7.965390202653584
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SQY0lyVQhNf6JDYz1GnSmc7cVgw3NDjkgCO4yF3R2:SQYhQm41GnSbQVgm3k6F3R2
                                                                                      MD5:E74D937B62386885AF383D09CC17FC31
                                                                                      SHA1:07F4E148F37B7438C8CCF53114B7188A7CF8B74B
                                                                                      SHA-256:63F38183CD99B3747EDA40408B6787D70DD0650015AC1E996F7B02AD86D26B79
                                                                                      SHA-512:E53D6DAF2EF287DD769B9699E9E1511105F8AE2F6962781D205419A356B35C5DB9AB1CEB15934FC03345AB321F48B3FBF50AA4988151F82228DF70DD41494DE9
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......e.m.\p.k......./...=8......e.....=k.........Vm.....S...~......]{....VP........M.D...$...z.{.r..c...6...........w...v.3..*j0j>..[I.T.E`j.T6..;...?cwus...i$~.:.5..jgE.d..c ..|.H.jV.s.'X.l.n*..9.....i.FB.t..c..V...e+.7D....S..9.0.j.$,.j..F.v.........[.q}[.....O...6n..TT.#..+s..Jh.j....E</.....S.k..{...}_FI..;{..KN.WhS......1...K.c...2...1 ....?Q....r.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\thYA8LIKMR.jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):16252
                                                                                      Entropy (8bit):7.960598223687119
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SY3VbuB06F/vo1uGCWO8eagQZ7op6fjguLV3FYAAhpoN57:SYpuBTFY1uGCW5eLQPv3FYZpoJ
                                                                                      MD5:CF7E3D9481EB8E1D79537DF6AD3DA0EC
                                                                                      SHA1:22C4559DFBCE319C83BCCB5FC74F812CF9A8BC74
                                                                                      SHA-256:FF844A346140BEFAB2DDA1E43687001F26E0ADCC9300716223D32C996B9119A4
                                                                                      SHA-512:45E8443C8F6365D8FC5123D364BB7B63EBFF8E97053B3429802033EBD860F0EE88454CB7CDECBA687B5C81582E6EB6BF2A04CC9DA48B563E3AD86A1E27D43406
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..k.<.2X...@c..\.o&...[S...Q..8..&..@....t."...V..W9..[.SRG:..5.ua........*w.......H./99..:..~z.T.......j.z...P.j....E%.K..{...$.V\...T...~.u)W..s.z....n......)..%..u.?\.m..+{W.x........c#..]KD...h..n.EH..F..(b).*.-.....D\..5..-.*V.i.7..i$.....)n......WA...Oz..c.8SrfE..,...-.='..z.....vV.:2......]...5.-o..<.7.....U.K.....b.#..+.Trg[..<r....:./....k........"

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[10].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):12600
                                                                                      Entropy (8bit):7.961191788706893
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SJz459WY9NqDbV5N3K0oei2CXhi9HzmFcu4c:Sa59WYTqnV5N3to1XhImyzc
                                                                                      MD5:953DAE2543912B3B2A88323CCF60D546
                                                                                      SHA1:5E2B057C660A90F5E6608310F1AEB6AA14467207
                                                                                      SHA-256:B8911EE74BA84D41A086042A8F3AA8632C61B0F67C780AE147D0120781210570
                                                                                      SHA-512:A6F4CF90059A9EE05ABA90B3AECA54E3CE4C76EF4CE869D06DE3A1D5868247728AB2CCFFD829953F3DBC682417C1320F94ACF74E4837B442565FB26F24096805
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...]K....z/.cH.X<.......p..I-.D..g8..+.e.L..-....... @...9...T..L.u<....f.A.l:%...*0.Dm.2..\}........~8xZ..d2.%..p.d............_.G.<W.\kv.Ww.,..a{*.o...>....~.....#..3.).#.....k..h....I.q.l..R.A.{o...xNN..{t..c...|/gm.jmo^.XW.L..a.o.[...^J.v.....;.I..^G..M......mwZmk.R.K..|..$V.A..C.......2@.{?...7@.....Y....U.:....Mn.G....P@..fvT.r.9.~...s....j.X.pr..sM...r...x

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[1].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):19207
                                                                                      Entropy (8bit):7.9655385929488025
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SKCSPqSzC7VdlOllGvLgKJEPjLWRT75Xly5xSao/r/dXIzYEeU01mQe:SKCSPqSzC7VWYgkzT1lmWr1XqYEeUrR
                                                                                      MD5:5B9F6CF25FF0E9B73F720683AB86641D
                                                                                      SHA1:7E3E00C4D6EA3EE5C852C7AE5C3CFE800F121777
                                                                                      SHA-256:7EAA66F721EC12E678C678116F83DC4166062B3B0BF8E4C7B42CFEEADA1A40D0
                                                                                      SHA-512:D605625C8BDF65BC81A1281AA67158E0266735AA0C1251B77CBCEDE5F0EEB64C1F4640521AF2C67D55E4A9B51BF8EF7AEF0C1B1CE7EA4A10FFB05A8FA4117A88
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..?x..K".......c0{Q..}:S....#......7..}+A..H.=`...d..9l..2G..W-.....;..>WV ...y.....I&.[..XzS...e.....6.2..8.i#.._k..=.:.jt.7..-....-.YXyG._.6......./..qt....h|./.d%w....w.P.nI`..'.{...(.}..>0|O.P.~..'....'o8*....z..[Q.R..by..e..h:...E.#....-..,N..X.%.......j...)ao....<..........Yg........QK&.@.P.s..md...&~yW.1v|...{.GxO...u.C.q..ye.......'=.k.?g..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[2].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):27258
                                                                                      Entropy (8bit):7.952292077175426
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:ScbKHsiM1s+ikKk1MSLWvx4IqdV5I7a3X3ciB7:ScWkiy1MOWZrgvYAX3cW
                                                                                      MD5:D11E6CD039976A64E009644E591BA5FC
                                                                                      SHA1:CF7237E4479D3CB5A87F5B08ABA47722C9DAF9D8
                                                                                      SHA-256:1C66E8C81E218DD4764B9556C06EAF3F9C36E5B8EFA60C13A7F3939A316A4689
                                                                                      SHA-512:085C2179A143557E9CF740F25E568E5CC57BD151D06D54FA6B121254F047CD21B2C70A8FC2CC32DDC050E25EB162AC0D05EC67687B4A8DA907188F2E95CD58B0
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..G.....G...>..f...*...%.V.N......}...q...sw.F.3..].[....?.....iZ9...v.w./k...C.Q=.....,.......u.......N%.V.&....u..uN...3][..*Ia..}K...yd(..o.$.5.N..d6..9..|]:......5.o...\.M.N..i..}$.;..*..&.......c.5..F_.......O.......g...|Ug..I...z;....O...~)|Z........1.1f.(P.B....x......e..C[.......$h.L.Z5.f!.8.V;x.Ha..R...q......q...A|%:.._.iWV.4.8.H....F9..z.|

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[3].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):10008
                                                                                      Entropy (8bit):7.9310709642509805
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:S3O7NkZeInK8x/t+YfBZ9rw46k1wk20spU5gTfNR3su6S8HtXFy:S3WUm8Vt+cHrZXXgv98Hby
                                                                                      MD5:B9C5962AAC2084214BED31A8A607402E
                                                                                      SHA1:6F52547156B6FE1856365E8ACB4278BAD44C346F
                                                                                      SHA-256:ED3FF7BD6BAE593AC88C838C1243C662AD03A9A3DD89C9D094D2880E976B6AD6
                                                                                      SHA-512:107A37CB803EE104D5500C1201CC13401B6DD7E2A52D60F79BBC53A4B2207BE416CC7DB151772EEDE2B34929DBF9B373EE84C96EAE7F53E717A966328145BF0E
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(.`.(.Gj.\..(....Q.../J(.(..0&......0..S..I%T.....Td..W_..j.Q..J9.I.lV...J..0....|..3....J..?....?.F.?...<.w..\z.~U..{O.k.-.}..Oc..[..3.1..4.....w..,.....W.......\..m.....'.....Q.Ddu...Y&..(8.6.(.HQE..QE..QE..QE..QE..QE..QE..h....q.go....:..4.c..>.{....@...T)..2U.....@.y......#(...=.i*5!.)+&DjBM...3.b...6}F*.1...A.#.W8.....,..J3H)....#..(8......,..

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[4].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):13824
                                                                                      Entropy (8bit):7.954818291608654
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S1hEXTUrgCy8JTLWYJkJ+ku5gIWdbuOQJ:Sb6TAgCy8FLWTJQSIWluNJ
                                                                                      MD5:AB0928C29DD6E53A804433FAAB40136F
                                                                                      SHA1:28EF7C1E83D146D2E364C9F02221712C2EC9328F
                                                                                      SHA-256:F380D5650B0F6F97F30678203EE2FE239321930E8A201AD9042723BC0187E52C
                                                                                      SHA-512:AFC0F0CCBAD1E04315DE88BE5A5B6E79C4C1E79271DF3F5A45C3CC17C0DC746DD95C4E0DA9CF6F4CFD9E3615311A010BCC26AFFE4D35C36C4E79541FB6B62B3B
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...(...(...(....)..M....sO.ha...4..R.=+X=Id....~.&E.z..9..9....]...:...ee.+3..:d.xV.XmJN.....}+..n...2..........v.%.y...x...Z[S...<.m..m...:......lh..U.d.x6........^..[_1.F.I.....h.s....vV..'.&.;UR.....+.......1..kz.$n6..k.K..S...dB..Wa.)..Um.;p{U.*.....@..I..3.......qY.....U...C.P.m..6S..Ia.7..r7w.....a....r.C.k........:...=(..=)

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[5].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):19031
                                                                                      Entropy (8bit):7.949910690747872
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:S5ISiYAiCubd6x/tyCuTJ8pCrXvDe74P69ksOURcRah3:S53iod6xVoTK4XLe6hspcW
                                                                                      MD5:D1681EF67FE4D91EC27EE62D57A7BBE4
                                                                                      SHA1:E87A265A35896A563DD8CE89F26101D031AFFE38
                                                                                      SHA-256:1CF6CD8E3C8E8300094CC0E3AD17208C7D9D3DB21CD6E93ADC12F46EDC9D7717
                                                                                      SHA-512:421C53E91FE8AAD38AAD5FDB65D645E758112063B95BF31A5F06A2CDCC6B37E58BD946DB50869A69A6B45FB339E70AEE63A591D7B124D434253993F08A8B6C2E
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........4.e...B|.?....)..mh.........Y.......Aq)9....s..Tzz.....;.I@>.H....qs;.G.k...<o..t...qd....0.-.....3.w...r..../._.6..H....w.p.6...D.1..2..Q^%.X.6+...px...g...#.m.\...].B....J.,..#....f..Z.X.iY...ei.WNH.O.E.8....._...2....=x....-..[....z.."+...V.Hf....|Gg...D..-....L.X....:.....d?.X.m.o._.ro..}."........ .t.....[Po..a^._..=..4O..fX.;p.....<..ps.W....

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[6].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):23901
                                                                                      Entropy (8bit):7.96556860722461
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SeP6BLYz6IP5L56mZ63HYW6KEk7pRV4g3kK9cPMvz9QOTaX7996JHg3J1:S869I7tfyag3FcPMvJnabEHe
                                                                                      MD5:DAE74229C37341CC56FCAB61E6A8740F
                                                                                      SHA1:4BE2AD550F3E9D0A600AA593CD0365F6318D4A03
                                                                                      SHA-256:1C24BE0F0481870321813718C1AB7D8F31FEDDDACF7AFC6516C278EA3B7B298F
                                                                                      SHA-512:0DA290687D83E44949EB18109CDC0A06628A2DC051611C68B9B824A4DFA9335881CFABA5A87A854E28AFC695BF2D43686B45F0855E87A4BAB2F69196193FB3BA
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....Q.....s..~...u...W.~j+.e..k.u....8.FT.7@i..t,.C#.c.##'..O.I.....f5gH....=.Z....Nd*..#.0S.T.;.q...,.E...3$-..P.`...j%.(k.6..C.V.28.P3..3Xnt.l.q....(..0..L...b.._. .....Ok..A4aU...!9;.9$..=qV.....F.8..~..J.<..3:.a..s.gVr.+6.......e0..U.QX...V..(.H...G...?SZ.l...M......dv.=.c.5./.....(.a...^Xwpz.9.GFM..#..z.r.i.Y...is.m.Z...Kx..z..p..>z.K......<......q..t..w^.

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[7].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):15024
                                                                                      Entropy (8bit):7.965486273635488
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:SuPq2SZQKIWeIwnY53n4D3C4meedh3Q0gx3TQKv+kZZ:SNGtAX+C4zyg9TfDZ
                                                                                      MD5:C9E91D7B4DAA33A98D377CBC20824E34
                                                                                      SHA1:6E974B3932BB7B386719F75A14537CF8FE41F534
                                                                                      SHA-256:44BA2F2510A13C564CA2BE343A0C76781FFAE5532E260940700F7ABD53102758
                                                                                      SHA-512:FE1BBE8D5C6B1024884EB15500D255D8D3485F76939CEA2EB272D12ED0F50AA795F6B0A3657C237745E4F2736FE96D68D6B49EBCA720FE9F1FB65CF60DEF2DDA
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?../~....a..+..r>....Me.F.X.8...X.fQ...lX.w..8.S.$*obz.x..~...s.".R..o..I).u...$_*.n.V#<.9.........C.h... .q...L...b{t.ryn..B.#.........t#*H<(..D@`H..u.r.O.V........d._.........).hq.>.u!.H.<..q...*..h.].a.....R!........D.".V.G.pT.{..u.].T....1.8......7.4PM.J.;.......09.....P.Q".-.I.#..SN.(c.$Uq....@.\.]....W..QI....V<........p;.....8.NnW .h..RFz....^..r

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[8].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x157, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):12950
                                                                                      Entropy (8bit):7.915798487327566
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:SHyQmCFNKzl15rM0isYbLBN49nADxO943vSr30bjL+V4/RjQdA/RITe7v0wKdM7X:SHE44zhr1/yNh9TE4RQdA5IS70wKK7kG
                                                                                      MD5:7ABCCE1F6A36E50FA1E8CC4DF105295A
                                                                                      SHA1:709FFA4C4A8CE91131283199936945CBF62AB67F
                                                                                      SHA-256:5F88E2E45F1D4604DA564ACC27F457AF4C5E7E5400A8537DB634781EFDAD1B85
                                                                                      SHA-512:11F8E5570154DE90F896301A0AA6B2D605A6B8320C88F2D527AA03CA8ACBB51ADB6B495ECDD234B05685C984F82DF2EEBB766FC7395AB4D4699C8EE76C20A44D
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.........................................................................,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..vH........y.....>....UQ..1....5.u).c.._d..~S..!h.u...Zdci..?..s5.{...J.d...9NK_....-?..Eh..R.rT..Z.........S...is.....K...s2.....1.W.f.Z.M../....Q.W|.g.GS4....u9....?...Z1......Q.....U....i....c.. ..O...?....H.I!?...G.......ih>b....Y.>?..>.'.....C......d}w......].~.c...jMI@..'.......i.c..bd.z...}..c.O.Z.._....Hs.....]...udq..'......4.O.2...CZ.tU.\.#.[

                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\th[9].jpg

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 620x304, components 3
                                                                                      Category:dropped
                                                                                      Size (bytes):24556
                                                                                      Entropy (8bit):7.957122400454555
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:RCgtdgT20t1k0IWH1lwsLhJz/C+nFs8gZuP89SxGMYf4L7KydWz+MmukGDL91yft:RCgt21k0zlws/DCsrg889SxW2KydWz+d
                                                                                      MD5:39B622D6B02ACC69932B99A081427FF9
                                                                                      SHA1:571B932246116B530B587DB9BDEE8E4AD7059A06
                                                                                      SHA-256:CC1D84FF449DCA282781BFEEEADC896C44981F2FFD12CEB2F07FD279E1D686BC
                                                                                      SHA-512:A7BD76EF5A69B6A06965F2B417D4EDD729F2BBD2C04361679F7F9043B080FB7842142A84F68B14850B24718936C28D2352B9DEDEF199BEC15A4F5483177C7176
                                                                                      Malicious:false
                                                                                      Preview:......JFIF.....`.`.....C....................................................................C.......................................................................0.l.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....~o......(`...\H.y.w:bt...o.-..c.+.....W]..A........~..+r..{u..5.Q.nY|.}k..Tv&...Y..ekU...G..[..v.._.r:.?{.w...l.J.|An2..29....b...s.}k...H..oR...B..9..s...o.=.|..>lWB0.........N1AB..M.q.).B....5....^3.l..|3._..&Hv....Q..T.W9.s.=+F.A.+..'.$.J.T6....a..i.w.. ..^......t..v...R.UP^;[......R.>a.|..9.m>}...k.._......?.......y..^{...5,.......~<.F>Ym#....F..+)A.M..

                                                                                      C:\Users\user\AppData\Local\Temp\1450b97e-ee71-443b-b7c2-8376be226c6b.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:very short file (no magic)
                                                                                      Category:dropped
                                                                                      Size (bytes):1
                                                                                      Entropy (8bit):0.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:L:L
                                                                                      MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                      SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                      SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                      SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                      Malicious:false
                                                                                      Preview:.

                                                                                      C:\Users\user\AppData\Local\Temp\4a3af0f0-c268-4c91-85e4-6d397c255984.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:Google Chrome extension, version 3
                                                                                      Category:dropped
                                                                                      Size (bytes):11185
                                                                                      Entropy (8bit):7.951995436832936
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                      MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                      SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                      SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                      SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                      Malicious:false
                                                                                      Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                      C:\Users\user\AppData\Local\Temp\66d1936b-e3fa-4d70-9c66-126a7dcd6c5e.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:Google Chrome extension, version 3
                                                                                      Category:dropped
                                                                                      Size (bytes):135748
                                                                                      Entropy (8bit):7.8064882260604795
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:Sb7VdSjxiiW2IPMap2mbnH0zfOd89Hkvn:SXVqxX3wVvjUL0sEvn
                                                                                      MD5:F8E609603D53C701422BBC4E026740C8
                                                                                      SHA1:5D08BA917111A8FCE835BE950477156720E57437
                                                                                      SHA-256:AEA99C066ADDC7157626D59326D8E5589402F6AAC551A0560B92710BA68DED8A
                                                                                      SHA-512:5CBDFC06D076665752B4A1AEFD697F8AF7DD2F673C2A65D363DDE5E27E97451BBF6D6097C0B9003CCCC886B1EC0CC3CD66BE58C57076C181D2749249395462BC
                                                                                      Malicious:false
                                                                                      Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........S.o..g.z..6....L.-....Q.n!'...........w_...r.zy..xb.......+h/+........j+..+....z......;`....AF."].v.br..g'.$.....q..b...........G....i0..L...bW....\.t..g...t.....9,~K.*..rx.......U......|..8.F._.....&....-.A..h..>.#..fdM{V..dX....=.....r....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. `=.I...,..S&......C...EA."p.^ot.!..d..c...,Z=.3..<.|...U.N.Uc.(..".%............o..:..._.0...k....)...W..`*...*.B..w_..h...j.%....~|.s...o?d}.>/.t..?..c...5.6...~Q....q...Z....S=L?...c.T.B....-M...62.i*.Q.....%....+S.......lty\....!..^/..M.R.....,..j..8.....r...|.|{..L.;_.:.<C.....q.4f....0bp......EO.\..!

                                                                                      C:\Users\user\AppData\Local\Temp\SWUpdater.exe59227b (copy)

                                                                                      Download File
                                                                                      Process:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):111000
                                                                                      Entropy (8bit):6.520895887440003
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:VPY5KTfLLX8YrWqY7/pTXb77Kxl4uZiT9XZwoDfrYeR48qy6peTUnZuh6o7YmzUY:a17KmbkGVkT7wuT76B+jXM
                                                                                      MD5:57428456C6E6C2EA328C864681DB5DF3
                                                                                      SHA1:2DC7329E0B346C435B6EA5CF44A3D0A076F8D398
                                                                                      SHA-256:EE87747102EBA8844939352740D0BB6C4A67F10C2656961CB2722CD42BA99F40
                                                                                      SHA-512:40FB34FCE07F094FDAF78C499A21C3F534F0C8AE1246B6CF382EA7E63FA08B4DE56E6C81EB8FADCE8A2E508AE5D03831590A06FFDA3D46026FB894E4997F31B0
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z^+..0x..0x..0x.s3y..0x.s5yK.0x.s4y..0x?k5y..0x?k4y..0x?k3y..0xpj5y..0x.s1y..0x..1x..0xzj9y..0xzj.x..0x...x..0xzj2y..0xRich..0x........PE..L....W.e.................*...f.......x.......@....@.......................................@.................................\a..x....p...5...............)......T...l]..T...................x^.......]..@............`..X............................text....(.......*.................. ..`.data...`....@......................@....idata..2....`.......8..............@..@.rsrc....5...p...6...B..............@..@.reloc..T............x..............@..B................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\_swdelme_cleanup.bat

                                                                                      Download File
                                                                                      Process:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      File Type:DOS batch file, ASCII text, with very long lines (422)
                                                                                      Category:dropped
                                                                                      Size (bytes):533
                                                                                      Entropy (8bit):5.117600029236836
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:ho2Bl4Aeuwkn23fCwkn23fKQmwkn23fKy9QzwXPY23owXPYQwXPY23owXPYQwXPX:/OxfVfJfD9Qcv3LAv3LA1PFHMxAl9P
                                                                                      MD5:BB5CBBCC5B8AABE32C0377305CF66201
                                                                                      SHA1:C8F485824EABE1159294E1E3874D525F2CD20F9E
                                                                                      SHA-256:538A846D14F7FBC23A4B4F7F41CD657C904A23E424DE60B87E8F32B35DE1CD0B
                                                                                      SHA-512:651817BA41715EFFDDF515FFF546F555693BEFAC204759E752FC98E72101A6731AE9385CB2C09915B8475DA1B227A53BD11070E7011D0D34E21E4F40165BF693
                                                                                      Malicious:false
                                                                                      Preview:@echo off.timeout /T 3 /NOBREAK.:Repeat.for %%F in ("C:\Users\user\AppData\Local\Temp\SWUpdater.exe59227b" "C:\Users\user\AppData\Local\Temp\swupdater.dll59227b" "C:\Users\user\AppData\Local\Temp\swupdaterres_en.dll59227b" "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0" "C:\Users\user\Wavesor Software\SWUpdater" "C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0" "C:\Users\user\Wavesor Software\SWUpdater" "C:\Users\user\Wavesor Software" ) do (.del "%%F" >nul.if exist "%%F" goto Repeat.).(goto) 2>nul & del "%~f0".

                                                                                      C:\Users\user\AppData\Local\Temp\bf986a26-4adb-4a5a-8bef-8465b4f1b42a.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:very short file (no magic)
                                                                                      Category:dropped
                                                                                      Size (bytes):1
                                                                                      Entropy (8bit):0.0
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:L:L
                                                                                      MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                      SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                      SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                      SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                      Malicious:false
                                                                                      Preview:.

                                                                                      C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):353
                                                                                      Entropy (8bit):5.298628623464247
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:YEAVNRCEHZ56s/uAVNPP5kH7PQJjDrwv/uAVN0n7HJL56s/C:Y/NRHHZ56s/ZNZkbP0Dkv/ZN0n7pL56R
                                                                                      MD5:F138522E865C5CED1B8200D434C49817
                                                                                      SHA1:BDAC9395AFAA0356DFCB13BDDDD3EC210F493235
                                                                                      SHA-256:64E4DE36F7F834972672A62DEC04D7B200BDCDCA40FBE942807DB73236A5B822
                                                                                      SHA-512:C58E80BD964AC92F1BC25B917C3667553C766DF5B91ACA3328B1F36518520C23EDA96C253A09A9FFDAEFAC9075B8337A8E39908523744A532AAFF3F7214D0D9D
                                                                                      Malicious:false
                                                                                      Preview:{"logTime": "0707/085434", "correlationVector":"uZoNb6RXYLIaNXng9fXut5","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0707/085434", "correlationVector":"6EDE09545AC84B4181760387FE863EEB","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0707/085434", "correlationVector":"NSeoN/oDSwo+Nms8yZSwxh","action":"EXTENSION_UPDATER", "result":""}.

                                                                                      C:\Users\user\AppData\Local\Temp\f9235f80-e8ef-432d-a3b5-1db1e1b439c3.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 276634
                                                                                      Category:dropped
                                                                                      Size (bytes):242356
                                                                                      Entropy (8bit):7.991210403664034
                                                                                      Encrypted:true
                                                                                      SSDEEP:6144:nvRDe2ei//LiBCNBs4vIVeMRhzb6d0X7ayNC:nde2edcbveZRFW0X2yk
                                                                                      MD5:B73A9C52EF76DD9F575BDCF919B05902
                                                                                      SHA1:A7ED2E7B5F85D6E502B538FDEBD91343D811E55A
                                                                                      SHA-256:EF05EE3FA07D46FDDD88DA7760509F7BA658D3A9A5696004404F5A128349B323
                                                                                      SHA-512:01EB2E462F3EDE544A66C0EEABA9172B668B6EA20D2FEF5A3DD2217E60ED42F70523F194B8901A48CDA3E55E1F65A14BAB2FBE3B34D2CB410B1939B9BB7B4CBC
                                                                                      Malicious:false
                                                                                      Preview:...........}.w..._..W.2...W.N&....I..k..'@..Y...c...~K..3vB....#.K.........R.Q.%.4......+.r.M?.\....l....q......Xo\..6.u..q.i.[V_...u..M0...LK......)KcyM.<#....q.$..n<..f5.'..V3oY.v.....k....f.kul...F..4.^..^.(r}.k..[...?.....Y..K.9.VZ..r.c.m..wL.n....L+7.fnY..j.r..v..;P..Xz....~..;....yO3.P.`.]H2u...]...zV....[..m...v;...6.....8.._.l...;NK..W.4...G.....4...>..F.xl.Z..B?.zAcZO.....VI.(}f..j.k..)._...z.72-h.Fj....o.WB..~.gO..5-da+PW....H..n......q......W..5.C.+m..u.~.<.....E.uf?.?...3.......$@+......Z..6..4...&..Mz..W..~...V-}@'.w....t..nx..,.....0b.:QR'..W|#2b.....3}....wP.5.n..j.&...8q-H#O4.{/..G.....%.@(.&...M.5X,3(.d.L3~[.Yp.^.m../4...OB..u .=.7...:.N.k.m......... T..6!8......._. ..?..<...v...X.F.....<,....01.+...H.'....<...E......O..%P..-HH[M.......1[.7@H....eBJw.|....x.....i.....i.&.B.A.L.l..T...6..z....4).Y.F.%.>.o.a6{vw.=..F....e..e|.i.4.n.O-.1.FK.Z+..x@..$...?..C.....t....>...O...n.mN{.R .@.uNG...p.TT......9#=.z.j.....Oa..S.a;.

                                                                                      C:\Users\user\AppData\Local\Temp\gui44D8.tmp

                                                                                      Download File
                                                                                      Process:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (1468), with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):1471
                                                                                      Entropy (8bit):5.650921858430439
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:JmUh9uGlLVu97APktToBskPtgL9THl8fPey7dCPH04B/Q24L3UYYYXzJNK57Zps6:Q69ukLE9c8NoL8B6fPRJm/Q2wUYlFU7L
                                                                                      MD5:D84489371A9426DCA0CB2E83DAF6BF0B
                                                                                      SHA1:BE3E8C9C84D469D2BAE344F8C6F8EE484812D6BA
                                                                                      SHA-256:5E1CEDE4EA5C266FD4ECBD3FEB9F6B7A518705C7AF061CAEA58B71E4833CAF3B
                                                                                      SHA-512:50ABEE7939BFFF66986DA51B890A80018551F9A91286DD30B3CEEBAA6F327BD2E4F66AC5EC6DC9378D001A5A637A69F4F1325D22B19FC0C89C0F573B54FA0F49
                                                                                      Malicious:false
                                                                                      Preview:.{"homepage":"","homepage_is_newtabpage":true,"browser":{"show_home_button":true,"default_browser_setting_enabled":true},"distribution":{"suppress_first_run_bubble":true,"suppress_first_run_default_browser_prompt":true,"welcome_page_on_os_upgrade_enabled":false,"do_not_register_for_update_launch":true},"first_run_tabs":["chrome://newtab/"],"default_search_provider_data":{"template_url_data":{"created_by_policy":false,"favicon_url":"http://www.yahoo.com/favicon.ico","id":"26","input_encodings":["UTF-8"],"keyword":"WaveBrowser search","prepopulate_id":26,"safe_for_autoreplace":true,"search_terms_replacement_key":"","short_name":"WaveBrowser","suggestions_url":"https://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}","suggestions_url_post_params":"","url":"https://api.wavebrowserbase.com/search/yhs","usage_count":0}},"default_apps":"install","variations_compressed_seed":"H4sIAAAAAAAA/32QwUrDQBCGEz1Upi0tC1KbWimiWC/FBE3j1baKORrQq5vuhC6kG91sqn0Er4LvK1WDiZg9LvPN/t/8MBife7bHIh

                                                                                      C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\Info.rtf

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Wave Browser.exe
                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                      Category:dropped
                                                                                      Size (bytes):7245
                                                                                      Entropy (8bit):4.626353932121824
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:MhVhK9nt6A4CP12KmxZIRQf6WeInhV/Z2PjrZxKtctiK6LA8Ze771X4Lt5K2:cVwL6Ot2KmxZgQf6OnhVMCBve771Xsk2
                                                                                      MD5:B19AC2BD095A52FBC10735E05D319D17
                                                                                      SHA1:56A11DBC7E19CC7BE850E5AAE3F2BD0911D13EC4
                                                                                      SHA-256:FA230C84CDAD728A901445D198D9EAAB4D863AC742A870C1D762241A330269FE
                                                                                      SHA-512:CA53E4FD9878E17AE6A13EA3A3ABA8A40210D72FA15334B609CA1ABBE7B46C58363AEFD62C5CF40316757BBE55D4F20262F01C5A818880FDA7F07BE50BAC8970
                                                                                      Malicious:false
                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033\deflangfe1033{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2 Times New Roman;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.19041}{\*\mmathPr\mdispDef1\mwrapIndent1440 }\viewkind4\uc1 ..\pard\sa200\sl276\slmult1\kerning1\f0\fs22 Easily transition from your current default browser to Wave by importing your existing browser settings. The settings import feature is optional from the installer screen.\par..You acknowledge that Wave Browser offers multiple features that utilize the extension platform. These features are standard when the browser is installed and cannot be removed. More information about these features can be found at {{\field{\*\fldinst{HYPERLINK https://wavebrowser.co/about/ }}{\fldrslt{https://wavebrowser.co/about/\ul0\cf0}}}}\f0\fs22 .\par..\f1\bullet Wave Browser is free to install and use and can be removed at any time. Additional offers include a free Wave PRO trial and

                                                                                      C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Wave Browser.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):815792
                                                                                      Entropy (8bit):7.870521754028661
                                                                                      Encrypted:false
                                                                                      SSDEEP:24576:f/RUhtSWUeNXoCPxjyJVhGi4vGuOg9ajduJd/WDj0:3RUhoK/9ecwjd6d/sI
                                                                                      MD5:18693249F3A283E83B8179E692FFBBA9
                                                                                      SHA1:546C0D89F8C8096D22C6F6BE7E843CF5CE08E220
                                                                                      SHA-256:3D828BCCCC628E7096856337B178DA5608A6C3DB99383374E6C49D50A1895E64
                                                                                      SHA-512:1AB246FEA99DAF75831F26930D458A05FF0EFD5F9C71C9C4396681A065FCF9F5C04AF774DF34AD55E140B71D41E42254EE2D9DABBB18009800BDFC62170A8C39
                                                                                      Malicious:true
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+..Y+..Y+..Yp..X!..Yp..X...Yp..X9..Y..X...Y..X:..Y..X9..Y...X)..Y...X-..Yp..X&..Y+..Y\..Y...Y*..Y+.aY*..Y...X*..YRich+..Y................PE..L....W.e.................R.......... P.......p....@..................................X....@.................................H...x........@...........&...L...`..........T...........................@...@............p...............................text....Q.......R.................. ..`.rdata...p...p...r...V..............@..@.data...............................@....rsrc....@.......B..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\System.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Wave Browser.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):21416
                                                                                      Entropy (8bit):6.949581618226155
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:z7Vxr8IgLgi3sVc4NIYixpYSMElLGoGCJEF8ZpHAYekb:lxr8bL3TYiIKEFiRMq
                                                                                      MD5:345B6FAA62A50BA996A4FC52A17031C7
                                                                                      SHA1:7EE131C8C4F836E9C88764197DA34A5A9DBE7D97
                                                                                      SHA-256:E994184F10C979EC8D3E0BA11D3C95322B0F846FE45D0A56AFC2AFB35CF92D9A
                                                                                      SHA-512:5EADF9EDF82B83C2C051C6072B7D31A711BAC17513DFB452C25F98CFEC00FC54FEF0E54C29E60D5DE8813284BDE440B4F7843C5CB07D2BD9014B0610E98A9347
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir*.-.D.-.D.-.D...J.*.D.-.E.>.D.....*.D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L....~.\...........!..... ...........(.......0...............................`.......:....@..........................2.......0..P........................%...P.......................................................0..X............................text...O........ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..|....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\inetc.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Wave Browser.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):45992
                                                                                      Entropy (8bit):5.697545485300516
                                                                                      Encrypted:false
                                                                                      SSDEEP:768:EFhctuggHZ7KQafLPvjZtYiI4AEFiRolX:EFagggHFnajjZt7/AeiK
                                                                                      MD5:01E912F4DCC1962E4CAF95CF06824BD6
                                                                                      SHA1:CA38906B61417A495AB4A99F87FEFD1FCEA27B68
                                                                                      SHA-256:7DE65937B8B6DCEBE11E373630B32979DD51DD642F5024C398E235FC603683DA
                                                                                      SHA-512:156B3EFC5656164C06E60A7657829216CE17C607A3AC82858C82BA8C886919B3E36D54DF101B5387E5ECA967672D30AA0BD081BA9ED322F407E7DF45CFA6511B
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&..H..H..H...I..H..I...H.}.M..H.}.L..H.}.H..H.}....H.}.J..H.Rich.H.........PE..L...3p._...........!.....R...x...............p............................................@.........................0u......,...d.......`................%......L....s..8...............................................,............................text...gQ.......R.................. ..`.rdata.......p.......V..............@..@.data...dI...........`..............@....idata...............j..............@..@.rsrc...`............v..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsArray.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Wave Browser.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):21928
                                                                                      Entropy (8bit):6.777383495483464
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:gQ6nDv70AXXcWtXexpnGIhWOIYixpYSANNGoGCJEF8ZpH+0:yDhXKxpnGIhKYiInEFiRL
                                                                                      MD5:261025B9C39810CAEBF7CDF301C62517
                                                                                      SHA1:59A757BDD007DAFFEA95FFB2D2EEF80B1E1F13E5
                                                                                      SHA-256:44480D48DFE139CB4125AC05DF462FDA4D6980D6558151C3A862578FBF790370
                                                                                      SHA-512:10DB13D86F2A75F3857B35F0B9025714AE53F3BE21CD7F93FBD22909E294F4FC81B2FDE50F5B378251594AA6158D139432B98B5F90C06779FBDAE4CE1BE2D982
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q\..5=..5=..5=..5=..>=...J..0=..S.w.6=..S.s.4=..S.p.4=..S.u.4=..Rich5=..........PE..L...&4}T...........!.................&.......0...............................p............@.........................`1......40..<....P..`............0...%...`..d....................................................0..4............................text............................... ..`.rdata..I....0......."..............@..@.data........@.......&..............@....rsrc...`....P.......(..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsDialogs.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Wave Browser.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):19368
                                                                                      Entropy (8bit):6.724070698442283
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:9Zg7+lkpxZdpLzKIYixpYSNFGoGCJEF8ZpHRTbgQ:Y+lkp3Dz3YiIoEFiR5gQ
                                                                                      MD5:D3E82A3A0A0F6B3376AEFBE411909EAD
                                                                                      SHA1:7A819FB67E3F2847C667490D65723125850881C0
                                                                                      SHA-256:3383FC788E3E7C0BD856C225B1007BB334039CCA9D1F6F193A1CB01E3B87629C
                                                                                      SHA-512:D933CC2BD25726CD99463E2B6C4FA4F84680F5051463231982FD1871D702A0D3E14A99593810260000861AE446CE3A623847F70953655E017CB03DAEDDA0AF7C
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L....~.\...........!......... ......Y........0............................................@..........................6..k....0.......`...............&...%...p.......................................................0...............................text............................... ..`.rdata..{....0......................@..@.data........@......................@....rsrc........`....... ..............@..@.reloc..t....p......."..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\nsResize.dll

                                                                                      Download File
                                                                                      Process:C:\Users\user\Desktop\Wave Browser.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                      Category:dropped
                                                                                      Size (bytes):14248
                                                                                      Entropy (8bit):7.126249759358661
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:+r05zOHAA1xAIYixpYSZ4GoGCJEF8ZpHcYfI:TOHAA1xJYiIzEFiRc
                                                                                      MD5:826B388AE77158FB430EEF40D09E20A4
                                                                                      SHA1:8E121819C77C950CB13767A0EEB76CF19E48ECCB
                                                                                      SHA-256:0A2387D1ACB456406DD83FBA1F69CB48532F96A7AEDF2E9E128229C66DBAA075
                                                                                      SHA-512:5C44C30861B8F2045D0AD3BEF298F84A9404CE6B3FBAEF8139CF603BFF9CDC878B0F87D6184D52BCEF7CE7D162148FD77D213C1F8FABEFA49D5EED0D88222027
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(uY.F&Y.F&Y.F&Y.G&V.F&...&\.F&..v&X.F&.p.&X.F&.p.&X.F&.p.&X.F&.p.&X.F&RichY.F&........................PE..L....iQ...........!.............`..pu...p..........................................:.....@.........................,.......`...........`................%.........................................................................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\66d1936b-e3fa-4d70-9c66-126a7dcd6c5e.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:Google Chrome extension, version 3
                                                                                      Category:dropped
                                                                                      Size (bytes):135748
                                                                                      Entropy (8bit):7.8064882260604795
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:Sb7VdSjxiiW2IPMap2mbnH0zfOd89Hkvn:SXVqxX3wVvjUL0sEvn
                                                                                      MD5:F8E609603D53C701422BBC4E026740C8
                                                                                      SHA1:5D08BA917111A8FCE835BE950477156720E57437
                                                                                      SHA-256:AEA99C066ADDC7157626D59326D8E5589402F6AAC551A0560B92710BA68DED8A
                                                                                      SHA-512:5CBDFC06D076665752B4A1AEFD697F8AF7DD2F673C2A65D363DDE5E27E97451BBF6D6097C0B9003CCCC886B1EC0CC3CD66BE58C57076C181D2749249395462BC
                                                                                      Malicious:false
                                                                                      Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........S.o..g.z..6....L.-....Q.n!'...........w_...r.zy..xb.......+h/+........j+..+....z......;`....AF."].v.br..g'.$.....q..b...........G....i0..L...bW....\.t..g...t.....9,~K.*..rx.......U......|..8.F._.....&....-.A..h..>.#..fdM{V..dX....=.....r....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. `=.I...,..S&......C...EA."p.^ot.!..d..c...,Z=.3..<.|...U.N.Uc.(..".%............o..:..._.0...k....)...W..`*...*.B..w_..h...j.%....~|.s...o?d}.>/.t..?..c...5.6...~Q....q...Z....S=L?...c.T.B....-M...62.i*.Q.....%....+S.......lty\....!..^/..M.R.....,..j..8.....r...|.|{..L.;_.:.<C.....q.4f....0bp......EO.\..!

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\128.png

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                      Category:dropped
                                                                                      Size (bytes):4982
                                                                                      Entropy (8bit):7.929761711048726
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
                                                                                      MD5:913064ADAAA4C4FA2A9D011B66B33183
                                                                                      SHA1:99EA751AC2597A080706C690612AEEEE43161FC1
                                                                                      SHA-256:AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
                                                                                      SHA-512:162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
                                                                                      Malicious:false
                                                                                      Preview:.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb*..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...*T.P.B...*Tx...=.Q..wv.w.....|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......|..}./.....e..,.K.1........W.u.v. ...\.o

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\af\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):908
                                                                                      Entropy (8bit):4.512512697156616
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
                                                                                      MD5:12403EBCCE3AE8287A9E823C0256D205
                                                                                      SHA1:C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
                                                                                      SHA-256:B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
                                                                                      SHA-512:153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\am\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1285
                                                                                      Entropy (8bit):4.702209356847184
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
                                                                                      MD5:9721EBCE89EC51EB2BAEB4159E2E4D8C
                                                                                      SHA1:58979859B28513608626B563138097DC19236F1F
                                                                                      SHA-256:3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
                                                                                      SHA-512:FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ar\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1244
                                                                                      Entropy (8bit):4.5533961615623735
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
                                                                                      MD5:3EC93EA8F8422FDA079F8E5B3F386A73
                                                                                      SHA1:24640131CCFB21D9BC3373C0661DA02D50350C15
                                                                                      SHA-256:ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
                                                                                      SHA-512:F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\az\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):977
                                                                                      Entropy (8bit):4.867640976960053
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
                                                                                      MD5:9A798FD298008074E59ECC253E2F2933
                                                                                      SHA1:1E93DA985E880F3D3350FC94F5CCC498EFC8C813
                                                                                      SHA-256:628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
                                                                                      SHA-512:9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\be\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):3107
                                                                                      Entropy (8bit):3.535189746470889
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
                                                                                      MD5:68884DFDA320B85F9FC5244C2DD00568
                                                                                      SHA1:FD9C01E03320560CBBB91DC3D1917C96D792A549
                                                                                      SHA-256:DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
                                                                                      SHA-512:7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\bg\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1389
                                                                                      Entropy (8bit):4.561317517930672
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
                                                                                      MD5:2E6423F38E148AC5A5A041B1D5989CC0
                                                                                      SHA1:88966FFE39510C06CD9F710DFAC8545672FFDCEB
                                                                                      SHA-256:AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
                                                                                      SHA-512:891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\bn\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1763
                                                                                      Entropy (8bit):4.25392954144533
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
                                                                                      MD5:651375C6AF22E2BCD228347A45E3C2C9
                                                                                      SHA1:109AC3A912326171D77869854D7300385F6E628C
                                                                                      SHA-256:1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
                                                                                      SHA-512:958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ca\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):930
                                                                                      Entropy (8bit):4.569672473374877
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
                                                                                      MD5:D177261FFE5F8AB4B3796D26835F8331
                                                                                      SHA1:4BE708E2FFE0F018AC183003B74353AD646C1657
                                                                                      SHA-256:D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
                                                                                      SHA-512:E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\cs\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):913
                                                                                      Entropy (8bit):4.947221919047
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
                                                                                      MD5:CCB00C63E4814F7C46B06E4A142F2DE9
                                                                                      SHA1:860936B2A500CE09498B07A457E0CCA6B69C5C23
                                                                                      SHA-256:21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
                                                                                      SHA-512:35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\cy\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):806
                                                                                      Entropy (8bit):4.815663786215102
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
                                                                                      MD5:A86407C6F20818972B80B9384ACFBBED
                                                                                      SHA1:D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
                                                                                      SHA-256:A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
                                                                                      SHA-512:D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\da\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):883
                                                                                      Entropy (8bit):4.5096240460083905
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
                                                                                      MD5:B922F7FD0E8CCAC31B411FC26542C5BA
                                                                                      SHA1:2D25E153983E311E44A3A348B7D97AF9AAD21A30
                                                                                      SHA-256:48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
                                                                                      SHA-512:AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\de\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1031
                                                                                      Entropy (8bit):4.621865814402898
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
                                                                                      MD5:D116453277CC860D196887CEC6432FFE
                                                                                      SHA1:0AE00288FDE696795CC62FD36EABC507AB6F4EA4
                                                                                      SHA-256:36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
                                                                                      SHA-512:C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\el\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1613
                                                                                      Entropy (8bit):4.618182455684241
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
                                                                                      MD5:9ABA4337C670C6349BA38FDDC27C2106
                                                                                      SHA1:1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
                                                                                      SHA-256:37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
                                                                                      SHA-512:8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\en\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):851
                                                                                      Entropy (8bit):4.4858053753176526
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                      MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                      SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                      SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                      SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\en_CA\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):851
                                                                                      Entropy (8bit):4.4858053753176526
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                                                      MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                                                      SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                                                      SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                                                      SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\en_GB\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):848
                                                                                      Entropy (8bit):4.494568170878587
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
                                                                                      MD5:3734D498FB377CF5E4E2508B8131C0FA
                                                                                      SHA1:AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
                                                                                      SHA-256:AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
                                                                                      SHA-512:56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\en_US\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1425
                                                                                      Entropy (8bit):4.461560329690825
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
                                                                                      MD5:578215FBB8C12CB7E6CD73FBD16EC994
                                                                                      SHA1:9471D71FA6D82CE1863B74E24237AD4FD9477187
                                                                                      SHA-256:102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
                                                                                      SHA-512:E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
                                                                                      Malicious:false
                                                                                      Preview:{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\es\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):961
                                                                                      Entropy (8bit):4.537633413451255
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
                                                                                      MD5:F61916A206AC0E971CDCB63B29E580E3
                                                                                      SHA1:994B8C985DC1E161655D6E553146FB84D0030619
                                                                                      SHA-256:2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
                                                                                      SHA-512:D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\es_419\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):959
                                                                                      Entropy (8bit):4.570019855018913
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
                                                                                      MD5:535331F8FB98894877811B14994FEA9D
                                                                                      SHA1:42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
                                                                                      SHA-256:90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
                                                                                      SHA-512:2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\et\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):968
                                                                                      Entropy (8bit):4.633956349931516
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
                                                                                      MD5:64204786E7A7C1ED9C241F1C59B81007
                                                                                      SHA1:586528E87CD670249A44FB9C54B1796E40CDB794
                                                                                      SHA-256:CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
                                                                                      SHA-512:44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\eu\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):838
                                                                                      Entropy (8bit):4.4975520913636595
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
                                                                                      MD5:29A1DA4ACB4C9D04F080BB101E204E93
                                                                                      SHA1:2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
                                                                                      SHA-256:A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
                                                                                      SHA-512:B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\fa\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1305
                                                                                      Entropy (8bit):4.673517697192589
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
                                                                                      MD5:097F3BA8DE41A0AAF436C783DCFE7EF3
                                                                                      SHA1:986B8CABD794E08C7AD41F0F35C93E4824AC84DF
                                                                                      SHA-256:7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
                                                                                      SHA-512:8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\fi\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):911
                                                                                      Entropy (8bit):4.6294343834070935
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
                                                                                      MD5:B38CBD6C2C5BFAA6EE252D573A0B12A1
                                                                                      SHA1:2E490D5A4942D2455C3E751F96BD9960F93C4B60
                                                                                      SHA-256:2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
                                                                                      SHA-512:6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\fil\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):939
                                                                                      Entropy (8bit):4.451724169062555
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
                                                                                      MD5:FCEA43D62605860FFF41BE26BAD80169
                                                                                      SHA1:F25C2CE893D65666CC46EA267E3D1AA080A25F5B
                                                                                      SHA-256:F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
                                                                                      SHA-512:F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\fr\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):977
                                                                                      Entropy (8bit):4.622066056638277
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
                                                                                      MD5:A58C0EEBD5DC6BB5D91DAF923BD3A2AA
                                                                                      SHA1:F169870EEED333363950D0BCD5A46D712231E2AE
                                                                                      SHA-256:0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
                                                                                      SHA-512:B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\fr_CA\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):972
                                                                                      Entropy (8bit):4.621319511196614
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
                                                                                      MD5:6CAC04BDCC09034981B4AB567B00C296
                                                                                      SHA1:84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
                                                                                      SHA-256:4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
                                                                                      SHA-512:160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\gl\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):990
                                                                                      Entropy (8bit):4.497202347098541
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
                                                                                      MD5:6BAAFEE2F718BEFBC7CD58A04CCC6C92
                                                                                      SHA1:CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
                                                                                      SHA-256:0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
                                                                                      SHA-512:3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\gu\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1658
                                                                                      Entropy (8bit):4.294833932445159
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
                                                                                      MD5:BC7E1D09028B085B74CB4E04D8A90814
                                                                                      SHA1:E28B2919F000B41B41209E56B7BF3A4448456CFE
                                                                                      SHA-256:FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
                                                                                      SHA-512:040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\hi\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1672
                                                                                      Entropy (8bit):4.314484457325167
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
                                                                                      MD5:98A7FC3E2E05AFFFC1CFE4A029F47476
                                                                                      SHA1:A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
                                                                                      SHA-256:D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
                                                                                      SHA-512:457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\hr\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):935
                                                                                      Entropy (8bit):4.6369398601609735
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
                                                                                      MD5:25CDFF9D60C5FC4740A48EF9804BF5C7
                                                                                      SHA1:4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
                                                                                      SHA-256:73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
                                                                                      SHA-512:EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\hu\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1065
                                                                                      Entropy (8bit):4.816501737523951
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
                                                                                      MD5:8930A51E3ACE3DD897C9E61A2AEA1D02
                                                                                      SHA1:4108506500C68C054BA03310C49FA5B8EE246EA4
                                                                                      SHA-256:958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
                                                                                      SHA-512:126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\hy\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2771
                                                                                      Entropy (8bit):3.7629875118570055
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
                                                                                      MD5:55DE859AD778E0AA9D950EF505B29DA9
                                                                                      SHA1:4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
                                                                                      SHA-256:0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
                                                                                      SHA-512:EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\id\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):858
                                                                                      Entropy (8bit):4.474411340525479
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
                                                                                      MD5:34D6EE258AF9429465AE6A078C2FB1F5
                                                                                      SHA1:612CAE151984449A4346A66C0A0DF4235D64D932
                                                                                      SHA-256:E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
                                                                                      SHA-512:20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\is\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):954
                                                                                      Entropy (8bit):4.631887382471946
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
                                                                                      MD5:1F565FB1C549B18AF8BBFED8DECD5D94
                                                                                      SHA1:B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
                                                                                      SHA-256:E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
                                                                                      SHA-512:A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\it\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):899
                                                                                      Entropy (8bit):4.474743599345443
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
                                                                                      MD5:0D82B734EF045D5FE7AA680B6A12E711
                                                                                      SHA1:BD04F181E4EE09F02CD53161DCABCEF902423092
                                                                                      SHA-256:F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
                                                                                      SHA-512:01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\iw\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2230
                                                                                      Entropy (8bit):3.8239097369647634
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
                                                                                      MD5:26B1533C0852EE4661EC1A27BD87D6BF
                                                                                      SHA1:18234E3ABAF702DF9330552780C2F33B83A1188A
                                                                                      SHA-256:BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
                                                                                      SHA-512:450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ja\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1160
                                                                                      Entropy (8bit):5.292894989863142
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
                                                                                      MD5:15EC1963FC113D4AD6E7E59AE5DE7C0A
                                                                                      SHA1:4017FC6D8B302335469091B91D063B07C9E12109
                                                                                      SHA-256:34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
                                                                                      SHA-512:427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ka\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):3264
                                                                                      Entropy (8bit):3.586016059431306
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
                                                                                      MD5:83F81D30913DC4344573D7A58BD20D85
                                                                                      SHA1:5AD0E91EA18045232A8F9DF1627007FE506A70E0
                                                                                      SHA-256:30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
                                                                                      SHA-512:85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\kk\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):3235
                                                                                      Entropy (8bit):3.6081439490236464
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
                                                                                      MD5:2D94A58795F7B1E6E43C9656A147AD3C
                                                                                      SHA1:E377DB505C6924B6BFC9D73DC7C02610062F674E
                                                                                      SHA-256:548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
                                                                                      SHA-512:F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\km\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):3122
                                                                                      Entropy (8bit):3.891443295908904
                                                                                      Encrypted:false
                                                                                      SSDEEP:96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
                                                                                      MD5:B3699C20A94776A5C2F90AEF6EB0DAD9
                                                                                      SHA1:1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
                                                                                      SHA-256:A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
                                                                                      SHA-512:1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\kn\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1880
                                                                                      Entropy (8bit):4.295185867329351
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
                                                                                      MD5:8E16966E815C3C274EEB8492B1EA6648
                                                                                      SHA1:7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
                                                                                      SHA-256:418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
                                                                                      SHA-512:85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ko\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1042
                                                                                      Entropy (8bit):5.3945675025513955
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
                                                                                      MD5:F3E59EEEB007144EA26306C20E04C292
                                                                                      SHA1:83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
                                                                                      SHA-256:C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
                                                                                      SHA-512:7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\lo\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2535
                                                                                      Entropy (8bit):3.8479764584971368
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
                                                                                      MD5:E20D6C27840B406555E2F5091B118FC5
                                                                                      SHA1:0DCECC1A58CEB4936E255A64A2830956BFA6EC14
                                                                                      SHA-256:89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
                                                                                      SHA-512:AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\lt\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1028
                                                                                      Entropy (8bit):4.797571191712988
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
                                                                                      MD5:970544AB4622701FFDF66DC556847652
                                                                                      SHA1:14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
                                                                                      SHA-256:5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
                                                                                      SHA-512:CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\lv\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):994
                                                                                      Entropy (8bit):4.700308832360794
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
                                                                                      MD5:A568A58817375590007D1B8ABCAEBF82
                                                                                      SHA1:B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
                                                                                      SHA-256:0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
                                                                                      SHA-512:FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ml\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2091
                                                                                      Entropy (8bit):4.358252286391144
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
                                                                                      MD5:4717EFE4651F94EFF6ACB6653E868D1A
                                                                                      SHA1:B8A7703152767FBE1819808876D09D9CC1C44450
                                                                                      SHA-256:22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
                                                                                      SHA-512:487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\mn\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2778
                                                                                      Entropy (8bit):3.595196082412897
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
                                                                                      MD5:83E7A14B7FC60D4C66BF313C8A2BEF0B
                                                                                      SHA1:1CCF1D79CDED5D65439266DB58480089CC110B18
                                                                                      SHA-256:613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
                                                                                      SHA-512:3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\mr\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1719
                                                                                      Entropy (8bit):4.287702203591075
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
                                                                                      MD5:3B98C4ED8874A160C3789FEAD5553CFA
                                                                                      SHA1:5550D0EC548335293D962AAA96B6443DD8ABB9F6
                                                                                      SHA-256:ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
                                                                                      SHA-512:5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ms\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):936
                                                                                      Entropy (8bit):4.457879437756106
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
                                                                                      MD5:7D273824B1E22426C033FF5D8D7162B7
                                                                                      SHA1:EADBE9DBE5519BD60458B3551BDFC36A10049DD1
                                                                                      SHA-256:2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
                                                                                      SHA-512:E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\my\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):3830
                                                                                      Entropy (8bit):3.5483353063347587
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
                                                                                      MD5:342335A22F1886B8BC92008597326B24
                                                                                      SHA1:2CB04F892E430DCD7705C02BF0A8619354515513
                                                                                      SHA-256:243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
                                                                                      SHA-512:CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ne\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1898
                                                                                      Entropy (8bit):4.187050294267571
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
                                                                                      MD5:B1083DA5EC718D1F2F093BD3D1FB4F37
                                                                                      SHA1:74B6F050D918448396642765DEF1AD5390AB5282
                                                                                      SHA-256:E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
                                                                                      SHA-512:7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\nl\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):914
                                                                                      Entropy (8bit):4.513485418448461
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
                                                                                      MD5:32DF72F14BE59A9BC9777113A8B21DE6
                                                                                      SHA1:2A8D9B9A998453144307DD0B700A76E783062AD0
                                                                                      SHA-256:F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
                                                                                      SHA-512:E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\no\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):878
                                                                                      Entropy (8bit):4.4541485835627475
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
                                                                                      MD5:A1744B0F53CCF889955B95108367F9C8
                                                                                      SHA1:6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
                                                                                      SHA-256:21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
                                                                                      SHA-512:F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\pa\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2766
                                                                                      Entropy (8bit):3.839730779948262
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
                                                                                      MD5:97F769F51B83D35C260D1F8CFD7990AF
                                                                                      SHA1:0D59A76564B0AEE31D0A074305905472F740CECA
                                                                                      SHA-256:BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
                                                                                      SHA-512:D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\pl\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):978
                                                                                      Entropy (8bit):4.879137540019932
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
                                                                                      MD5:B8D55E4E3B9619784AECA61BA15C9C0F
                                                                                      SHA1:B4A9C9885FBEB78635957296FDDD12579FEFA033
                                                                                      SHA-256:E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
                                                                                      SHA-512:266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\pt_BR\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):907
                                                                                      Entropy (8bit):4.599411354657937
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
                                                                                      MD5:608551F7026E6BA8C0CF85D9AC11F8E3
                                                                                      SHA1:87B017B2D4DA17E322AF6384F82B57B807628617
                                                                                      SHA-256:A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
                                                                                      SHA-512:82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\pt_PT\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):914
                                                                                      Entropy (8bit):4.604761241355716
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
                                                                                      MD5:0963F2F3641A62A78B02825F6FA3941C
                                                                                      SHA1:7E6972BEAB3D18E49857079A24FB9336BC4D2D48
                                                                                      SHA-256:E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
                                                                                      SHA-512:22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ro\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):937
                                                                                      Entropy (8bit):4.686555713975264
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
                                                                                      MD5:BED8332AB788098D276B448EC2B33351
                                                                                      SHA1:6084124A2B32F386967DA980CBE79DD86742859E
                                                                                      SHA-256:085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
                                                                                      SHA-512:22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ru\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1337
                                                                                      Entropy (8bit):4.69531415794894
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
                                                                                      MD5:51D34FE303D0C90EE409A2397FCA437D
                                                                                      SHA1:B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
                                                                                      SHA-256:BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
                                                                                      SHA-512:E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\si\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2846
                                                                                      Entropy (8bit):3.7416822879702547
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
                                                                                      MD5:B8A4FD612534A171A9A03C1984BB4BDD
                                                                                      SHA1:F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
                                                                                      SHA-256:54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
                                                                                      SHA-512:C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\sk\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):934
                                                                                      Entropy (8bit):4.882122893545996
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
                                                                                      MD5:8E55817BF7A87052F11FE554A61C52D5
                                                                                      SHA1:9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
                                                                                      SHA-256:903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
                                                                                      SHA-512:EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\sl\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):963
                                                                                      Entropy (8bit):4.6041913416245
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
                                                                                      MD5:BFAEFEFF32813DF91C56B71B79EC2AF4
                                                                                      SHA1:F8EDA2B632610972B581724D6B2F9782AC37377B
                                                                                      SHA-256:AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
                                                                                      SHA-512:971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\sr\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1320
                                                                                      Entropy (8bit):4.569671329405572
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
                                                                                      MD5:7F5F8933D2D078618496C67526A2B066
                                                                                      SHA1:B7050E3EFA4D39548577CF47CB119FA0E246B7A4
                                                                                      SHA-256:4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
                                                                                      SHA-512:0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\sv\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):884
                                                                                      Entropy (8bit):4.627108704340797
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
                                                                                      MD5:90D8FB448CE9C0B9BA3D07FB8DE6D7EE
                                                                                      SHA1:D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
                                                                                      SHA-256:64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
                                                                                      SHA-512:6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\sw\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):980
                                                                                      Entropy (8bit):4.50673686618174
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
                                                                                      MD5:D0579209686889E079D87C23817EDDD5
                                                                                      SHA1:C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
                                                                                      SHA-256:0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
                                                                                      SHA-512:D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ta\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1941
                                                                                      Entropy (8bit):4.132139619026436
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
                                                                                      MD5:DCC0D1725AEAEAAF1690EF8053529601
                                                                                      SHA1:BB9D31859469760AC93E84B70B57909DCC02EA65
                                                                                      SHA-256:6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
                                                                                      SHA-512:6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\te\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1969
                                                                                      Entropy (8bit):4.327258153043599
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
                                                                                      MD5:385E65EF723F1C4018EEE6E4E56BC03F
                                                                                      SHA1:0CEA195638A403FD99BAEF88A360BD746C21DF42
                                                                                      SHA-256:026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
                                                                                      SHA-512:E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\th\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1674
                                                                                      Entropy (8bit):4.343724179386811
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
                                                                                      MD5:64077E3D186E585A8BEA86FF415AA19D
                                                                                      SHA1:73A861AC810DABB4CE63AD052E6E1834F8CA0E65
                                                                                      SHA-256:D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
                                                                                      SHA-512:56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\tr\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1063
                                                                                      Entropy (8bit):4.853399816115876
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
                                                                                      MD5:76B59AAACC7B469792694CF3855D3F4C
                                                                                      SHA1:7C04A2C1C808FA57057A4CCEEE66855251A3C231
                                                                                      SHA-256:B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
                                                                                      SHA-512:2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\uk\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1333
                                                                                      Entropy (8bit):4.686760246306605
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
                                                                                      MD5:970963C25C2CEF16BB6F60952E103105
                                                                                      SHA1:BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
                                                                                      SHA-256:9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
                                                                                      SHA-512:1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\ur\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1263
                                                                                      Entropy (8bit):4.861856182762435
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
                                                                                      MD5:8B4DF6A9281333341C939C244DDB7648
                                                                                      SHA1:382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
                                                                                      SHA-256:5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
                                                                                      SHA-512:FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\vi\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1074
                                                                                      Entropy (8bit):5.062722522759407
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
                                                                                      MD5:773A3B9E708D052D6CBAA6D55C8A5438
                                                                                      SHA1:5617235844595D5C73961A2C0A4AC66D8EA5F90F
                                                                                      SHA-256:597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
                                                                                      SHA-512:E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\zh_CN\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):879
                                                                                      Entropy (8bit):5.7905809868505544
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
                                                                                      MD5:3E76788E17E62FB49FB5ED5F4E7A3DCE
                                                                                      SHA1:6904FFA0D13D45496F126E58C886C35366EFCC11
                                                                                      SHA-256:E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
                                                                                      SHA-512:F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\zh_HK\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1205
                                                                                      Entropy (8bit):4.50367724745418
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
                                                                                      MD5:524E1B2A370D0E71342D05DDE3D3E774
                                                                                      SHA1:60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
                                                                                      SHA-256:30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
                                                                                      SHA-512:D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\zh_TW\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):843
                                                                                      Entropy (8bit):5.76581227215314
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
                                                                                      MD5:0E60627ACFD18F44D4DF469D8DCE6D30
                                                                                      SHA1:2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
                                                                                      SHA-256:F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
                                                                                      SHA-512:6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
                                                                                      Malicious:false
                                                                                      Preview:{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_locales\zu\messages.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):912
                                                                                      Entropy (8bit):4.65963951143349
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
                                                                                      MD5:71F916A64F98B6D1B5D1F62D297FDEC1
                                                                                      SHA1:9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
                                                                                      SHA-256:EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
                                                                                      SHA-512:30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
                                                                                      Malicious:false
                                                                                      Preview:{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\_metadata\verified_contents.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):11280
                                                                                      Entropy (8bit):5.75072251686336
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqvupccWctmS:m8IGIEu8RE
                                                                                      MD5:CB96BFFC022867F3B3DD525D40CF5429
                                                                                      SHA1:56AB05B451BE53096DE1DB128D5E7461598FE212
                                                                                      SHA-256:A168E1A08F9A621F5491B078FAA7E29FE968AF03721163CC01EA7A25965BEB26
                                                                                      SHA-512:5506FF34D5015993A306D5C3C988211CCAD204B00881927EEA9F2CF21E6C5ACAC7802E3F878B9BC1F2FE60388784E69F1330B6F29F45A97213A98BDF7607F9FC
                                                                                      Malicious:false
                                                                                      Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\dasherSettingSchema.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):854
                                                                                      Entropy (8bit):4.284628987131403
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
                                                                                      MD5:4EC1DF2DA46182103D2FFC3B92D20CA5
                                                                                      SHA1:FB9D1BA3710CF31A87165317C6EDC110E98994CE
                                                                                      SHA-256:6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
                                                                                      SHA-512:939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
                                                                                      Malicious:false
                                                                                      Preview:{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\manifest.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):2525
                                                                                      Entropy (8bit):5.418318285401414
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1p9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APpgiVb
                                                                                      MD5:3B4509B8820E8EFE03C9BEF60A21D60E
                                                                                      SHA1:612AB23441238FB77D7458535F7423530320380E
                                                                                      SHA-256:A9A07E2FFE2058AE56E6ECA4FE82940A1A18A5E786FDE1E7F01E559649FBA338
                                                                                      SHA-512:5A0B799E03328BF5ACDC371603757571C834DE16285CC6B9390F49D60AA94B3F099C4FF10CF3918F5C85348BD3808F0684A09ACFA115E66ADAF4ABF90D57CB66
                                                                                      Malicious:false
                                                                                      Preview:{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/*", "https://drive.google.com/*", "https://drive-autopush.corp.google.com/*", "https://drive-daily-0.corp.google.com/*", "https://drive-daily-1.corp.google.com/*", "https://drive-daily-2.corp.google.com/*", "https://drive-daily-3.corp.google.com/*", "https://drive-daily-4.corp.google.com/*", "https://drive-daily-5.corp.google.com/*", "https://drive-daily-6.corp.google.com/*", "https://drive-preprod.corp.google.com/*", "https://drive-staging.corp.google.com/*" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\offscreendocument.html

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:HTML document, ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):97
                                                                                      Entropy (8bit):4.862433271815736
                                                                                      Encrypted:false
                                                                                      SSDEEP:3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
                                                                                      MD5:B747B5922A0BC74BBF0A9BC59DF7685F
                                                                                      SHA1:7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
                                                                                      SHA-256:B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
                                                                                      SHA-512:7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
                                                                                      Malicious:false
                                                                                      Preview:<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\offscreendocument_main.js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text, with very long lines (4369)
                                                                                      Category:dropped
                                                                                      Size (bytes):95567
                                                                                      Entropy (8bit):5.4016395763198135
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
                                                                                      MD5:09AF2D8CFA8BF1078101DA78D09C4174
                                                                                      SHA1:F2369551E2CDD86258062BEB0729EE4D93FCA050
                                                                                      SHA-256:39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
                                                                                      SHA-512:F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
                                                                                      Malicious:false
                                                                                      Preview:'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\page_embed_script.js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text
                                                                                      Category:dropped
                                                                                      Size (bytes):291
                                                                                      Entropy (8bit):4.65176400421739
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
                                                                                      MD5:3AB0CD0F493B1B185B42AD38AE2DD572
                                                                                      SHA1:079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
                                                                                      SHA-256:73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
                                                                                      SHA-512:32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
                                                                                      Malicious:false
                                                                                      Preview:(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_293020715\CRX_INSTALL\service_worker_bin_prod.js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:ASCII text, with very long lines (4369)
                                                                                      Category:dropped
                                                                                      Size (bytes):103988
                                                                                      Entropy (8bit):5.389407461078688
                                                                                      Encrypted:false
                                                                                      SSDEEP:1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
                                                                                      MD5:EA946F110850F17E637B15CF22B82837
                                                                                      SHA1:8D27C963E76E3D2F5B8634EE66706F95F000FCAF
                                                                                      SHA-256:029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
                                                                                      SHA-512:5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
                                                                                      Malicious:false
                                                                                      Preview:'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_746886012\4a3af0f0-c268-4c91-85e4-6d397c255984.tmp

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:Google Chrome extension, version 3
                                                                                      Category:dropped
                                                                                      Size (bytes):11185
                                                                                      Entropy (8bit):7.951995436832936
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                      MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                      SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                      SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                      SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                      Malicious:false
                                                                                      Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_746886012\CRX_INSTALL\_metadata\verified_contents.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):1753
                                                                                      Entropy (8bit):5.8889033066924155
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
                                                                                      MD5:738E757B92939B24CDBBD0EFC2601315
                                                                                      SHA1:77058CBAFA625AAFBEA867052136C11AD3332143
                                                                                      SHA-256:D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
                                                                                      SHA-512:DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
                                                                                      Malicious:false
                                                                                      Preview:[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_746886012\CRX_INSTALL\content.js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):9815
                                                                                      Entropy (8bit):6.1716321262973315
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
                                                                                      MD5:3D20584F7F6C8EAC79E17CCA4207FB79
                                                                                      SHA1:3C16DCC27AE52431C8CDD92FBAAB0341524D3092
                                                                                      SHA-256:0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
                                                                                      SHA-512:315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
                                                                                      Malicious:false
                                                                                      Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_746886012\CRX_INSTALL\content_new.js

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
                                                                                      Category:dropped
                                                                                      Size (bytes):10388
                                                                                      Entropy (8bit):6.174387413738973
                                                                                      Encrypted:false
                                                                                      SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
                                                                                      MD5:3DE1E7D989C232FC1B58F4E32DE15D64
                                                                                      SHA1:42B152EA7E7F31A964914F344543B8BF14B5F558
                                                                                      SHA-256:D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
                                                                                      SHA-512:177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
                                                                                      Malicious:false
                                                                                      Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                                                      C:\Users\user\AppData\Local\Temp\scoped_dir6988_746886012\CRX_INSTALL\manifest.json

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      File Type:JSON data
                                                                                      Category:dropped
                                                                                      Size (bytes):962
                                                                                      Entropy (8bit):5.698567446030411
                                                                                      Encrypted:false
                                                                                      SSDEEP:24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
                                                                                      MD5:E805E9E69FD6ECDCA65136957B1FB3BE
                                                                                      SHA1:2356F60884130C86A45D4B232A26062C7830E622
                                                                                      SHA-256:5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
                                                                                      SHA-512:049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
                                                                                      Malicious:false
                                                                                      Preview:{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/*" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/*" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

                                                                                      C:\Users\user\AppData\Local\Temp\swupdater.dll59227b (copy)

                                                                                      Download File
                                                                                      Process:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):1065888
                                                                                      Entropy (8bit):6.787215824096434
                                                                                      Encrypted:false
                                                                                      SSDEEP:24576:JXHn+3BSeyntPUjvkKtj190Lm3IEVYWoke8kNCFTYTnCqTukWL+jYGijK6:Q3BSfdUjvkKtj1h4ERoCFTqCqTDWL+tN
                                                                                      MD5:D388D67A1861F9D0CC4F6EDFA97861B4
                                                                                      SHA1:CA82FDB6FF39FE0B157100D1C8EEC48B73C34791
                                                                                      SHA-256:B21F99F14B4CCC78C5E01C269A8EBA83AE0C5912B46D8C1554F329A1076A7617
                                                                                      SHA-512:71879D3DD7B1B0B169E3C80FD88FF6F656778AF85462363202C4F28AE57B547EE569E5B43F55D0446CFBED736C32FA249BA91A5C34E8D9363295BE86B1D5A3D3
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......J..a...2...2...2U.3...2U.3...2U.3...2U.3..2?.@2...2...3C..2...3...2...3...2...3...2U.3...2U.3%..2...2P..2...3$..2...3...2..B2...2..*2...2...3...2Rich...2........PE..L....W.e...........!.........~.......3.......................................p.......F....@..........................T..T....T...........................)......|...d<..T...................p=.......<..@............................................text.............................. ..`.rdata..............................@..@.data...pX.......2...|..............@....rsrc...............................@..@.reloc..|...........................@..B................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\swupdaterres_en.dll59227b (copy)

                                                                                      Download File
                                                                                      Process:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):43416
                                                                                      Entropy (8bit):4.605896231361162
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:bvaagyWk9RsIYixpYSSmGbAM+o/8E9VF0NyvVgx:7aagyW49YiI4eAMxkE8x
                                                                                      MD5:35FD9F0A8FD4A41EBECAB887715A3FFD
                                                                                      SHA1:03CE4A819FB75E4C5E756FBE73F8A63B885B0624
                                                                                      SHA-256:A535EF96BCBE7F6953FB6D7194540716DF495BD7CF25E902DDDB6756561189BC
                                                                                      SHA-512:E6DB60D25DE13F5F452FD249AC2F6CDDD0958A2830404A2144154EE0E1023CF5CBFF3E58831383B14C9950DCF7C4B4B784D15E972B44808F8D02870A44D62D14
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#@..#@..#@..SD..#@..KA..#@..#A..#@.\RI..#@.\R@..#@.\R...#@.\RB..#@.Rich.#@.........................PE..L....W.e...........!.........z......p........ ............................................@.............................E....0..(....@...q...............)...... .......T...........................`...@............0...............................text............................... ..`.data...$.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\~DF199FC69198F1A4D6.TMP

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.2364979660455589
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1C:9vqyVKvqy6yEyvy5DlsNUAc
                                                                                      MD5:766DC8C2D2B704377A5D7A7CF489F4B1
                                                                                      SHA1:DD1B20EA878BAC7D8AEB1A77C3EEE35429A069BE
                                                                                      SHA-256:56669F04C60CBD07A2EE32D7B66236E4DE354EE94A1C34BAF25B6B3ED203E159
                                                                                      SHA-512:59EAE579720FCD522F65D796101FD2B16EE20DD5D9812386436345BFE009961C3A6785F994E85AAFAEDC9F198E58BC671D367377550604CD99CF76EB88211E94
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\~DF46920DACF564A05E.TMP

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.2364979660455589
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1C:9vqyVKvqy6yEyvy5DlsNUAc
                                                                                      MD5:766DC8C2D2B704377A5D7A7CF489F4B1
                                                                                      SHA1:DD1B20EA878BAC7D8AEB1A77C3EEE35429A069BE
                                                                                      SHA-256:56669F04C60CBD07A2EE32D7B66236E4DE354EE94A1C34BAF25B6B3ED203E159
                                                                                      SHA-512:59EAE579720FCD522F65D796101FD2B16EE20DD5D9812386436345BFE009961C3A6785F994E85AAFAEDC9F198E58BC671D367377550604CD99CF76EB88211E94
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\~DF57355BE76BD4B758.TMP

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.979703920788407
                                                                                      Encrypted:false
                                                                                      SSDEEP:48:9SgKS9LYu09Lzvr448PZzZi7jTXovxjNrrovHrxbehzt1:ls9LLuXvfku
                                                                                      MD5:7F79C330CF4B3599D7CA5BD067F7A682
                                                                                      SHA1:259DF15A24914FDFBC3555F317F80838DEDB2978
                                                                                      SHA-256:300AA88AF568B2A2F303E1C137B2079320A9FE32EA68FEC0D2E2067B2CB2C093
                                                                                      SHA-512:D88BD2C9A27D499A51DF9D6F26EC2E0E945272E187BDF1895AFFBE569A01E719F7704881A9440EF5C624037155B39E1F037C0A2C7B211B8C2A42E428B88136F6
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\~DF85E62B6355F7D4E2.TMP

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.2364979660455589
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1C:9vqyVKvqy6yEyvy5DlsNUAc
                                                                                      MD5:766DC8C2D2B704377A5D7A7CF489F4B1
                                                                                      SHA1:DD1B20EA878BAC7D8AEB1A77C3EEE35429A069BE
                                                                                      SHA-256:56669F04C60CBD07A2EE32D7B66236E4DE354EE94A1C34BAF25B6B3ED203E159
                                                                                      SHA-512:59EAE579720FCD522F65D796101FD2B16EE20DD5D9812386436345BFE009961C3A6785F994E85AAFAEDC9F198E58BC671D367377550604CD99CF76EB88211E94
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\~DFA10C5D01FDD85C7E.TMP

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.2364979660455589
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1C:9vqyVKvqy6yEyvy5DlsNUAc
                                                                                      MD5:766DC8C2D2B704377A5D7A7CF489F4B1
                                                                                      SHA1:DD1B20EA878BAC7D8AEB1A77C3EEE35429A069BE
                                                                                      SHA-256:56669F04C60CBD07A2EE32D7B66236E4DE354EE94A1C34BAF25B6B3ED203E159
                                                                                      SHA-512:59EAE579720FCD522F65D796101FD2B16EE20DD5D9812386436345BFE009961C3A6785F994E85AAFAEDC9F198E58BC671D367377550604CD99CF76EB88211E94
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\~DFA1E9F4149CA99198.TMP

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.2364979660455589
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN16gJ8H1C:9vqyVKvqy6yEyvy5DlsNUAc
                                                                                      MD5:766DC8C2D2B704377A5D7A7CF489F4B1
                                                                                      SHA1:DD1B20EA878BAC7D8AEB1A77C3EEE35429A069BE
                                                                                      SHA-256:56669F04C60CBD07A2EE32D7B66236E4DE354EE94A1C34BAF25B6B3ED203E159
                                                                                      SHA-512:59EAE579720FCD522F65D796101FD2B16EE20DD5D9812386436345BFE009961C3A6785F994E85AAFAEDC9F198E58BC671D367377550604CD99CF76EB88211E94
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\~DFBE26C60CD3B8EC0F.TMP

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.2364979660455589
                                                                                      Encrypted:false
                                                                                      SSDEEP:12:3NvM7yGpSU3NvM7y8Dy+DygoDyKqDlsN2cgJ8H1C:9vqyVKvqy6yEyvy5DlsN5Ac
                                                                                      MD5:7DA63F3349ADCE46708E4C0690063EC5
                                                                                      SHA1:3A4B1BC2A9F48A8E4227E461B85B46F14CA69D3D
                                                                                      SHA-256:C40819535B4185A8DB93B768A6B27657C5234D9789992D278CC01A4B3E353775
                                                                                      SHA-512:20C16F35AFA9B663C268224BE0AC6CFCAD7F5EDD2F3903E50BA5803ECC421BF54ED974001D3F056CA8E830832C874BA53AD30B111000ECBA361B9DF18BE2265F
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\~DFD1311C02A7EBF48A.TMP

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.2539486500851258
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:Yx9QT3xkNr1bx9iQxI6UUf9gmo0fNDvf9iH0fw9Yx1bcfX9Czr7M9bZXaSmT9M8w:Yw3udlm6UOkqg2XLVKT/
                                                                                      MD5:B7F2C62C77F86A229E661A2C8641C832
                                                                                      SHA1:1DF7582341AE7EC4149AFD08944DB2D7F49E6D96
                                                                                      SHA-256:492D41655687911DF3C3D46A6F81EEFD50EEC6237975B95424F438FB1F178494
                                                                                      SHA-512:2422D009CA05BB56CFB69ECE3E15F9166B0E00764080206B02D4904633DD2351F092FC57AF2381DD3505F365836FF47EBB1FCFA68033D4EEB484475859B074FD
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\AppData\Local\Temp\~DFE1F5451DA1C5E101.TMP

                                                                                      Download File
                                                                                      Process:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      File Type:data
                                                                                      Category:dropped
                                                                                      Size (bytes):16384
                                                                                      Entropy (8bit):0.0933529182987827
                                                                                      Encrypted:false
                                                                                      SSDEEP:6:a/vllIcalyPSQl3+tsMF2z31Nt6YsK+o2z31:i9lIcatQ0tbuH5you
                                                                                      MD5:FC20845C6687F48C27277653BFCC22E7
                                                                                      SHA1:D9E29F681668FAD703B4E8EC4422FBBB4D18D86F
                                                                                      SHA-256:85C89F1676A3516BBD61967C9896A975039D14E8FDAB300A12F774471E8AF317
                                                                                      SHA-512:AC4245D49ABBF451C6D1335D437502FBB90F1A9AB2265EEC6F91B09D2CC7D3FC7A9CA1D64C0D9F273666768E57780F5CB9D579A3A9E841A2E744C5BD3C54CE2C
                                                                                      Malicious:false
                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdater.exe

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):111000
                                                                                      Entropy (8bit):6.520895887440003
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:VPY5KTfLLX8YrWqY7/pTXb77Kxl4uZiT9XZwoDfrYeR48qy6peTUnZuh6o7YmzUY:a17KmbkGVkT7wuT76B+jXM
                                                                                      MD5:57428456C6E6C2EA328C864681DB5DF3
                                                                                      SHA1:2DC7329E0B346C435B6EA5CF44A3D0A076F8D398
                                                                                      SHA-256:EE87747102EBA8844939352740D0BB6C4A67F10C2656961CB2722CD42BA99F40
                                                                                      SHA-512:40FB34FCE07F094FDAF78C499A21C3F534F0C8AE1246B6CF382EA7E63FA08B4DE56E6C81EB8FADCE8A2E508AE5D03831590A06FFDA3D46026FB894E4997F31B0
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z^+..0x..0x..0x.s3y..0x.s5yK.0x.s4y..0x?k5y..0x?k4y..0x?k3y..0xpj5y..0x.s1y..0x..1x..0xzj9y..0xzj.x..0x...x..0xzj2y..0xRich..0x........PE..L....W.e.................*...f.......x.......@....@.......................................@.................................\a..x....p...5...............)......T...l]..T...................x^.......]..@............`..X............................text....(.......*.................. ..`.data...`....@......................@....idata..2....`.......8..............@..@.rsrc....5...p...6...B..............@..@.reloc..T............x..............@..B................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterBroker.exe

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):100256
                                                                                      Entropy (8bit):6.47039848214214
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:E6YCLNYEz/lQe0mWfY3WCuch7HW7DxVymB+FgStZZy:E6YaVZWCuchrmB+7tZ
                                                                                      MD5:558A3FA51457575EA29F9B041729EE8B
                                                                                      SHA1:7196875CE5B68F088E19FE4B7CC07BEC29CDA038
                                                                                      SHA-256:74BD216198FF11F08542473AAA7E5A619B50574E344BA8E8CA2C19FF497BF284
                                                                                      SHA-512:A0AFC3650879D6DF55ABE2CA461631BFA53E78376F1A702D42869026CAAE035982E22DF938D48D7DC42D6482237DB614A06DF067E2D3F89CDB2B915CDA9ED5C2
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f4.="U.n"U.n"U.ny=.o(U.ny=.o.U.ny=.o0U.n.%.o.U.n.%.o3U.n.%.o3U.ny=.o'U.n"U.nqU.n.$.o#U.n.$hn#U.n"U.n#U.n.$.o#U.nRich"U.n........PE..L....W.e..........................................@.......................................@.................................,$..<....P..82...........^...)..........l...T...............................@............................................text............................... ..`.rdata..PZ.......\..................@..@.data........0......................@....rsrc...82...P...4..................@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):195488
                                                                                      Entropy (8bit):6.2260860920108145
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:eS2deX2FXRPBKKZGNfGWlLYaYmzG3woY466OunZXgftB+FL:eSGmuXRpKKZsHRfoh9Xg1B+
                                                                                      MD5:10B82DC9D9A29BC4AF224981F0E1C6FE
                                                                                      SHA1:BC33B2EEAC62916EB9EE93A3F1ED6A0EB7611187
                                                                                      SHA-256:00CD644354032257A39FF710DDD03E9FB98348F5323DEC31CA670C903D68274C
                                                                                      SHA-512:A3C67A858CE7889506572E2448B5D1E936C6D6ADA2A04736B1F6CFE12B9AE46E9EE8C925778CDA273DB54000854F1EC4A544BCF2255770B978C7C6E9E24A1664
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..)..)..)..r.."..r.......}.....;.....#....+.......r..=..r..0..)......(.....(..).x.(....(..Rich)..................PE..d....W.e.........."......T..........pP.........@.............................P.......]....`..................................................u..x.......82...............)...@.......[..T................... ]..(....[..0............p...............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....2...........j..............@....pdata...............x..............@..@_RDATA..............................@..@.rsrc...82.......4..................@..@.reloc.......@......................@..B................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):213400
                                                                                      Entropy (8bit):6.657427399858563
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:Ndfq66ESD1t4cn4MJ9TuIJ2MalazAOJvKy7x+paPo9:ffq66ESD1t4cnH9TuIJ2CTKUx+UPo9
                                                                                      MD5:D40BD627BFB2BA39C5452A71A450EABD
                                                                                      SHA1:A0441DC20102FA71225F4F61675537D0549D5353
                                                                                      SHA-256:8AF504DDA28DA0896CB0E17273878D285D8CC1F912D304B21A49940FB577A0A5
                                                                                      SHA-512:434A8F5154A509BDA70EF7AF58E0029BA3AD9DA0E3803F9975609CAE65A1FDC0449D3A8D110A6928E9E621C7EA203CA98D96618C1DDE3DEE3A8110E806C05499
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..#...#...#..K...#..K..g#..:S..#..:S...#..:S...#..uR...#..K...#..K...#...#..F"...R...#...Rb..#...R...#..Rich.#..........PE..L....W.e.....................p......t.............@..........................p......P.....@.............................................82...............)...@... ..L...T...................X...........@............................................text...w........................... ..`.rdata..^...........................@..@.data....&..........................@....rsrc...82.......4..................@..@.reloc... ...@..."..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterOnDemand.exe

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):100256
                                                                                      Entropy (8bit):6.470568162079437
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:A6wCLNYEz/lQe0mWfY3WCuchkHW7DxXymB+Fg9tZI:A6waVZWCuchgmB+ktZ
                                                                                      MD5:29B0571D015318EDB1C292AEA8011179
                                                                                      SHA1:E3A8019B41AE73F2AA213C10337BB42783F5B5ED
                                                                                      SHA-256:CEA433E8FEA8DCF1705016545ABD150A2891291AE122A776CD66DDB802A17587
                                                                                      SHA-512:8CA55FC8E86B0F147AB3B358009B294780030137710E356E405EA3F7D48276E4387E83BC479D72BF068196D6D33C0B5524528B52FD145BA1E8161073AEA62951
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f4.="U.n"U.n"U.ny=.o(U.ny=.o.U.ny=.o0U.n.%.o.U.n.%.o3U.n.%.o3U.ny=.o'U.n"U.nqU.n.$.o#U.n.$hn#U.n"U.n#U.n.$.o#U.nRich"U.n........PE..L....W.e..........................................@.................................x.....@.................................,$..<....P..82...........^...)..........l...T...............................@............................................text............................... ..`.rdata..PZ.......\..................@..@.data........0......................@....rsrc...82...P...4..................@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterSetup.exe

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):815792
                                                                                      Entropy (8bit):7.870521754028661
                                                                                      Encrypted:false
                                                                                      SSDEEP:24576:f/RUhtSWUeNXoCPxjyJVhGi4vGuOg9ajduJd/WDj0:3RUhoK/9ecwjd6d/sI
                                                                                      MD5:18693249F3A283E83B8179E692FFBBA9
                                                                                      SHA1:546C0D89F8C8096D22C6F6BE7E843CF5CE08E220
                                                                                      SHA-256:3D828BCCCC628E7096856337B178DA5608A6C3DB99383374E6C49D50A1895E64
                                                                                      SHA-512:1AB246FEA99DAF75831F26930D458A05FF0EFD5F9C71C9C4396681A065FCF9F5C04AF774DF34AD55E140B71D41E42254EE2D9DABBB18009800BDFC62170A8C39
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 8%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+..Y+..Y+..Yp..X!..Yp..X...Yp..X9..Y..X...Y..X:..Y..X9..Y...X)..Y...X-..Yp..X&..Y+..Y\..Y...Y*..Y+.aY*..Y...X*..YRich+..Y................PE..L....W.e.................R.......... P.......p....@..................................X....@.................................H...x........@...........&...L...`..........T...........................@...@............p...............................text....Q.......R.................. ..`.rdata...p...p...r...V..............@..@.data...............................@....rsrc....@.......B..................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psmachine.dll

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):266136
                                                                                      Entropy (8bit):6.522279893817846
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:v+CRkUPava9DnekVeBl1CpWdbPirjuFIu0AO0sSKKBaQYphh:v+CR/Pava1ekVeBl1CpWdbwuFI7iJKXL
                                                                                      MD5:B10F0939BCE18AD24102C03769DDAB9B
                                                                                      SHA1:99B7CC45792F6CE7E270755E46A39F90D949C583
                                                                                      SHA-256:442AF0A1A403E17B5E5676CB49973D9E3AE067CFE9EFB8B669BF413F7B5A2E1D
                                                                                      SHA-512:2F7462160D0ADAA84E4996CAD27BB43A656D991BD8D8957C9AE3161BEF4CECCF1923D27B59FE69A8ACE048D9B663196EF44E7A7AEB52E9B93B560E10A3069121
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^._............A.......A...........P...........................A.......A...................+.....................d.............Rich....................PE..L....W.e...........!......................... ...............................@............@..........................>......@?...........g...............).......,..D/..T...................P0......./..@............ ..p............................text...$........................... ..`.orpc...c........................... ..`.rdata...2... ...4..................@..@.data....1...`.......8..............@....rsrc....g.......h...P..............@..@.reloc...,..........................@..B........................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psmachine_64.dll

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):331672
                                                                                      Entropy (8bit):6.12969104077321
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:CQOXiJFpBh12cITHjyXB6iohh3h0FKJ0ASaQYB:CJXSSpaXB9ogKvLT
                                                                                      MD5:19E105E099B7653CF60FF5783EC59453
                                                                                      SHA1:9D5AD1FBA3C03CE4C3841EF41F776B45CA9160D4
                                                                                      SHA-256:7E05780AFFFB2834EC4E2E1D67C9031616C13394CCFEB3A3C678415F19BA1104
                                                                                      SHA-512:E065358E22FEC9D2D323E7ACDCF3C4C81A629F4580E068F9B078CC414F2DC5B53912596CAB2CB40D5247A4746ACAFF2572445596F534940959E0B3E87E43AA13
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........T..T..T....._...............D....^.....V.....B.....O..T........e.....U......U..T.z.U.....U..RichT..........................PE..d....W.e.........." .....r..........L!.......................................`............`.........................................@....................g.......".......)...@..,.......T.......................(...p...0............................................text....n.......p.................. ..`.orpc...$............t.............. ..`.rdata..J............v..............@..@.data...\L...@...&..................@....pdata...".......$...@..............@..@_RDATA...............d..............@..@.rsrc....g.......h...f..............@..@.reloc..,....@......................@..B................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psuser.dll

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):266136
                                                                                      Entropy (8bit):6.522220247860862
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:P+CRkUPava9DnekVeBl1CpWdbPirjuFIn0AOPTSK6BaQYphib:P+CR/Pava1ekVeBl1CpWdbwuFI0ZuKH+
                                                                                      MD5:71DD0ABC865C9D8873E93478707A16D8
                                                                                      SHA1:6CC5C855B93E455C92FC15853A7AC219F62A3B3E
                                                                                      SHA-256:A0439F5455EF696B70A230AB76C15F4BC3D7571AD4FBC32FDA95247789AA5822
                                                                                      SHA-512:9C5CDF72684A6FBF9FC4194F26208A7E5B877BE8EAF1F5A334B3691F7CC281C7F134421592A920F4F3A3F45C1287D04A95631411BF2BBB189E137D1D1D143A22
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^._............A.......A...........P...........................A.......A...................+.....................d.............Rich....................PE..L....W.e...........!......................... ...............................@............@..........................>......<?...........g...............).......,..D/..T...................P0......./..@............ ..p............................text...$........................... ..`.orpc...c........................... ..`.rdata...2... ...4..................@..@.data....1...`.......8..............@....rsrc....g.......h...P..............@..@.reloc...,..........................@..B........................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\psuser_64.dll

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):331672
                                                                                      Entropy (8bit):6.1295498236184365
                                                                                      Encrypted:false
                                                                                      SSDEEP:6144:NQOXiJVRBh12cITHjyXBMiohK3SrFKpNAQaQYK:NJXSKpaXBHozKzAh4
                                                                                      MD5:3D08BFC845A13602E942F839E75BE233
                                                                                      SHA1:7C8CBEEFFB2139E83214F9E66D01EACAE35F5BE0
                                                                                      SHA-256:2992995FE9FBB5B0FF1DA5F081F2AABD32CA276EDE41889B4E457E6CBCF21EFD
                                                                                      SHA-512:7A2D2B1AFAD039F37FC9F7CAA819181E710CF60F1348C129B5AF7ABCE3307DB653F69485D6200B947BCB42B4DE406441587867AD61B48110407E265817B212FE
                                                                                      Malicious:false
                                                                                      Antivirus:
                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........T..T..T....._...............D....^.....V.....B.....O..T........e.....U......U..T.z.U.....U..RichT..........................PE..d....W.e.........." .....r..........L!.......................................`......\.....`.........................................@....................g.......".......)...@..,.......T.......................(...p...0............................................text....n.......p.................. ..`.orpc...$............t.............. ..`.rdata..B............v..............@..@.data...\L...@...&..................@....pdata...".......$...@..............@..@_RDATA...............d..............@..@.rsrc....g.......h...f..............@..@.reloc..,....@......................@..B................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\swupdater.dll

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):1065888
                                                                                      Entropy (8bit):6.787215824096434
                                                                                      Encrypted:false
                                                                                      SSDEEP:24576:JXHn+3BSeyntPUjvkKtj190Lm3IEVYWoke8kNCFTYTnCqTukWL+jYGijK6:Q3BSfdUjvkKtj1h4ERoCFTqCqTDWL+tN
                                                                                      MD5:D388D67A1861F9D0CC4F6EDFA97861B4
                                                                                      SHA1:CA82FDB6FF39FE0B157100D1C8EEC48B73C34791
                                                                                      SHA-256:B21F99F14B4CCC78C5E01C269A8EBA83AE0C5912B46D8C1554F329A1076A7617
                                                                                      SHA-512:71879D3DD7B1B0B169E3C80FD88FF6F656778AF85462363202C4F28AE57B547EE569E5B43F55D0446CFBED736C32FA249BA91A5C34E8D9363295BE86B1D5A3D3
                                                                                      Malicious:false
                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......J..a...2...2...2U.3...2U.3...2U.3...2U.3..2?.@2...2...3C..2...3...2...3...2...3...2U.3...2U.3%..2...2P..2...3$..2...3...2..B2...2..*2...2...3...2Rich...2........PE..L....W.e...........!.........~.......3.......................................p.......F....@..........................T..T....T...........................)......|...d<..T...................p=.......<..@............................................text.............................. ..`.rdata..............................@..@.data...pX.......2...|..............@....rsrc...............................@..@.reloc..|...........................@..B................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\swupdaterres_en.dll

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):43416
                                                                                      Entropy (8bit):4.605896231361162
                                                                                      Encrypted:false
                                                                                      SSDEEP:384:bvaagyWk9RsIYixpYSSmGbAM+o/8E9VF0NyvVgx:7aagyW49YiI4eAMxkE8x
                                                                                      MD5:35FD9F0A8FD4A41EBECAB887715A3FFD
                                                                                      SHA1:03CE4A819FB75E4C5E756FBE73F8A63B885B0624
                                                                                      SHA-256:A535EF96BCBE7F6953FB6D7194540716DF495BD7CF25E902DDDB6756561189BC
                                                                                      SHA-512:E6DB60D25DE13F5F452FD249AC2F6CDDD0958A2830404A2144154EE0E1023CF5CBFF3E58831383B14C9950DCF7C4B4B784D15E972B44808F8D02870A44D62D14
                                                                                      Malicious:false
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#@..#@..#@..SD..#@..KA..#@..#A..#@.\RI..#@.\R@..#@.\R...#@.\RB..#@.Rich.#@.........................PE..L....W.e...........!.........z......p........ ............................................@.............................E....0..(....@...q...............)...... .......T...........................`...@............0...............................text............................... ..`.data...$.... ......................@....idata..f....0......................@..@.rsrc....q...@...r..................@..@.reloc.. ............~..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\Download\{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}\1.3.16.5\WaveInstaller-v1.3.16.5.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                      Category:dropped
                                                                                      Size (bytes):96033720
                                                                                      Entropy (8bit):7.999913243821114
                                                                                      Encrypted:true
                                                                                      SSDEEP:1572864:+umsFlsZqGRS1oXZTIi/KTliaQHM8Oxv3huoyDFNJThpdOqM3eM9lhr3sucuH6fU:+NulsZNzXTCN8O7eD/ZhpdK3/9lhIhwB
                                                                                      MD5:99E6863FE48F0B551D0919056AEF7093
                                                                                      SHA1:70769514AE7E4F1A157AA3BFB289DB3F80F5F5A7
                                                                                      SHA-256:D5FB882FDE508C348D93EECD1A8796F75665B8A82F56B1DFC98E9BA5ACAF34BF
                                                                                      SHA-512:DCFF001681D2A7093E75F553579524FCC010CB6FF7ECBAD726CC21D266FF5EE0C973CE7F552060AD22A899248858D92A40CAA8436254EEEAF565A9676B03D5B1
                                                                                      Malicious:false
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F..v...F...@...F.Rich..F.........................PE..L...a..f.................`...........1.......p....@..........................`............@.................................0t.......................6...%...........................................................p...............................text...._.......`.................. ..`.rdata..P....p.......d..............@..@.data................x..............@....ndata...`...@...........................rsrc................|..............@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\Install\{DF7E1C1A-4867-4899-A0E8-C8CB671FD3D1}\WaveInstaller-v1.3.16.5.exe

                                                                                      Download File
                                                                                      Process:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                      Category:dropped
                                                                                      Size (bytes):96033720
                                                                                      Entropy (8bit):7.999913243821114
                                                                                      Encrypted:true
                                                                                      SSDEEP:1572864:+umsFlsZqGRS1oXZTIi/KTliaQHM8Oxv3huoyDFNJThpdOqM3eM9lhr3sucuH6fU:+NulsZNzXTCN8O7eD/ZhpdK3/9lhIhwB
                                                                                      MD5:99E6863FE48F0B551D0919056AEF7093
                                                                                      SHA1:70769514AE7E4F1A157AA3BFB289DB3F80F5F5A7
                                                                                      SHA-256:D5FB882FDE508C348D93EECD1A8796F75665B8A82F56B1DFC98E9BA5ACAF34BF
                                                                                      SHA-512:DCFF001681D2A7093E75F553579524FCC010CB6FF7ECBAD726CC21D266FF5EE0C973CE7F552060AD22A899248858D92A40CAA8436254EEEAF565A9676B03D5B1
                                                                                      Malicious:false
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F..v...F...@...F.Rich..F.........................PE..L...a..f.................`...........1.......p....@..........................`............@.................................0t.......................6...%...........................................................p...............................text...._.......`.................. ..`.rdata..P....p.......d..............@..@.data................x..............@....ndata...`...@...........................rsrc................|..............@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                      C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe

                                                                                      Download File
                                                                                      Process:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                      Category:dropped
                                                                                      Size (bytes):111000
                                                                                      Entropy (8bit):6.520895887440003
                                                                                      Encrypted:false
                                                                                      SSDEEP:3072:VPY5KTfLLX8YrWqY7/pTXb77Kxl4uZiT9XZwoDfrYeR48qy6peTUnZuh6o7YmzUY:a17KmbkGVkT7wuT76B+jXM
                                                                                      MD5:57428456C6E6C2EA328C864681DB5DF3
                                                                                      SHA1:2DC7329E0B346C435B6EA5CF44A3D0A076F8D398
                                                                                      SHA-256:EE87747102EBA8844939352740D0BB6C4A67F10C2656961CB2722CD42BA99F40
                                                                                      SHA-512:40FB34FCE07F094FDAF78C499A21C3F534F0C8AE1246B6CF382EA7E63FA08B4DE56E6C81EB8FADCE8A2E508AE5D03831590A06FFDA3D46026FB894E4997F31B0
                                                                                      Malicious:false
                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z^+..0x..0x..0x.s3y..0x.s5yK.0x.s4y..0x?k5y..0x?k4y..0x?k3y..0xpj5y..0x.s1y..0x..1x..0xzj9y..0xzj.x..0x...x..0xzj2y..0xRich..0x........PE..L....W.e.................*...f.......x.......@....@.......................................@.................................\a..x....p...5...............)......T...l]..T...................x^.......]..@............`..X............................text....(.......*.................. ..`.data...`....@......................@....idata..2....`.......8..............@..@.rsrc....5...p...6...B..............@..@.reloc..T............x..............@..B................................................................................................................................................................................................................................................................................................

                                                                                      Static File Info

                                                                                      General

                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                      Entropy (8bit):7.781369787159185
                                                                                      TrID:
                                                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                      File name:Wave Browser.exe
                                                                                      File size:1'035'600 bytes
                                                                                      MD5:938c6a14b9132727c3d29951610100d0
                                                                                      SHA1:189056824936b67d9bc96586f26975af0b351b27
                                                                                      SHA256:7a14127890cc5f7c0d6746a55dce214c701ee111224a065ad332bd2182106c02
                                                                                      SHA512:97727cce0cbd2d24022dba429118b84de8648c8cd2efba99a539d086f7b40eba70798f929d800b2ef662963d7114684a33dd981627789c4f942fb67e9ccf6287
                                                                                      SSDEEP:24576:lI0yo9CjuY5/2K0C0gAhaTbE/7nkP7OZo/UcvbAyuoC:lgocu8/7oebE/7e7OQUcjJC
                                                                                      TLSH:3525E02208F5DC75F591E5F9C8E7F0FA84CA7C02E42D848B9D613CAEF970A069D27295
                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F...v...F...@...F.Rich..F.........................PE..L.... .e.................`.........

                                                                                      File Icon

                                                                                      Icon Hash:1b197a76b2d86917

                                                                                      Static PE Info

                                                                                      General

                                                                                      Entrypoint:0x4031d6
                                                                                      Entrypoint Section:.text
                                                                                      Digitally signed:true
                                                                                      Imagebase:0x400000
                                                                                      Subsystem:windows gui
                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                      Time Stamp:0x65CD209D [Wed Feb 14 20:20:45 2024 UTC]
                                                                                      TLS Callbacks:
                                                                                      CLR (.Net) Version:
                                                                                      OS Version Major:4
                                                                                      OS Version Minor:0
                                                                                      File Version Major:4
                                                                                      File Version Minor:0
                                                                                      Subsystem Version Major:4
                                                                                      Subsystem Version Minor:0
                                                                                      Import Hash:3abe302b6d9a1256e6a915429af4ffd2

                                                                                      Authenticode Signature

                                                                                      Signature Valid:true
                                                                                      Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                      Signature Validation Error:The operation completed successfully
                                                                                      Error Number:0
                                                                                      Not Before, Not After
                                                                                      • 14/09/2023 01:00:00 21/07/2026 00:59:59
                                                                                      Subject Chain
                                                                                      • CN=Wavesor Software (Eightpoint Technologies Ltd. SEZC), O=Wavesor Software (Eightpoint Technologies Ltd. SEZC), L=George Town, C=KY, SERIALNUMBER=314202, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=KY
                                                                                      Version:3
                                                                                      Thumbprint MD5:AECFC3F717D06635CB33A3E5ECD51CBF
                                                                                      Thumbprint SHA-1:2EA4ADE8719DE01274C5A3BAF694B91E339BDA79
                                                                                      Thumbprint SHA-256:89F225CC1B03AB2BDCEF6B5D4606EEAC8B5B9CF289ED5FF3659240BCD3A7FA72
                                                                                      Serial:09D77A45C1C09755AE3E7A5153983C03

                                                                                      Entrypoint Preview

                                                                                      Instruction
                                                                                      sub esp, 00000184h
                                                                                      push ebx
                                                                                      push esi
                                                                                      push edi
                                                                                      xor ebx, ebx
                                                                                      push 00008001h
                                                                                      mov dword ptr [esp+18h], ebx
                                                                                      mov dword ptr [esp+10h], 00409198h
                                                                                      mov dword ptr [esp+20h], ebx
                                                                                      mov byte ptr [esp+14h], 00000020h
                                                                                      call dword ptr [004070A0h]
                                                                                      call dword ptr [0040709Ch]
                                                                                      and eax, BFFFFFFFh
                                                                                      cmp ax, 00000006h
                                                                                      mov dword ptr [0042370Ch], eax
                                                                                      je 00007FA258BE9353h
                                                                                      push ebx
                                                                                      call 00007FA258BEC42Ah
                                                                                      cmp eax, ebx
                                                                                      je 00007FA258BE9349h
                                                                                      push 00000C00h
                                                                                      call eax
                                                                                      mov esi, 00407298h
                                                                                      push esi
                                                                                      call 00007FA258BEC3A6h
                                                                                      push esi
                                                                                      call dword ptr [00407098h]
                                                                                      lea esi, dword ptr [esi+eax+01h]
                                                                                      cmp byte ptr [esi], bl
                                                                                      jne 00007FA258BE932Dh
                                                                                      push 0000000Ah
                                                                                      call 00007FA258BEC3FEh
                                                                                      push 00000008h
                                                                                      call 00007FA258BEC3F7h
                                                                                      push 00000006h
                                                                                      mov dword ptr [00423704h], eax
                                                                                      call 00007FA258BEC3EBh
                                                                                      cmp eax, ebx
                                                                                      je 00007FA258BE9351h
                                                                                      push 0000001Eh
                                                                                      call eax
                                                                                      test eax, eax
                                                                                      je 00007FA258BE9349h
                                                                                      or byte ptr [0042370Fh], 00000040h
                                                                                      push ebp
                                                                                      call dword ptr [00407044h]
                                                                                      push ebx
                                                                                      call dword ptr [00407288h]
                                                                                      mov dword ptr [004237D8h], eax
                                                                                      push ebx
                                                                                      lea eax, dword ptr [esp+38h]
                                                                                      push 00000160h
                                                                                      push eax
                                                                                      push ebx
                                                                                      push 0041ECC8h
                                                                                      call dword ptr [00407178h]
                                                                                      push 00409188h

                                                                                      Rich Headers

                                                                                      Programming Language:
                                                                                      • [EXP] VC++ 6.0 SP5 build 8804

                                                                                      Data Directories

                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x74300xa0.rdata
                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x3a0000x2b8e0.rsrc
                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0xfa7a80x25a8
                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x70000x298.rdata
                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                      Sections

                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                      .text0x10000x5f0d0x6000a04138503cbcc902263bedc7fedd6947False0.6649576822916666data6.450391437698698IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                      .rdata0x70000x12500x14004856bbf2a79b612f639ebd55d68c4d02False0.4287109375data5.001085207233966IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                      .data0x90000x1a8180x40006c5105864978df88e34770eefada5daFalse0.6376953125data5.129587811765307IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                      .ndata0x240000x160000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                      .rsrc0x3a0000x2b8e00x2ba007ce2afbb04e20bb68c9bc0454fe2f456False0.33573603151862463data5.623985242990102IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                      Resources

                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                      RT_ICON0x3a3880x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/mEnglishUnited States0.14971016207263693
                                                                                      RT_ICON0x4abb00x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 3779 x 3779 px/mEnglishUnited States0.19292621400042043
                                                                                      RT_ICON0x540580x6573PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.998767856455277
                                                                                      RT_ICON0x5a5d00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/mEnglishUnited States0.2827113840340104
                                                                                      RT_ICON0x5e7f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/mEnglishUnited States0.35643153526970955
                                                                                      RT_ICON0x60da00x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 6400, resolution 3779 x 3779 px/mEnglishUnited States0.39571005917159763
                                                                                      RT_ICON0x628080x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/mEnglishUnited States0.47303001876172607
                                                                                      RT_ICON0x638b00x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 3779 x 3779 px/mEnglishUnited States0.5651639344262295
                                                                                      RT_ICON0x642380x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 1600, resolution 3779 x 3779 px/mEnglishUnited States0.6122093023255814
                                                                                      RT_ICON0x648f00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/mEnglishUnited States0.7047872340425532
                                                                                      RT_DIALOG0x64d580x202dataEnglishUnited States0.4182879377431907
                                                                                      RT_DIALOG0x64f600xf8dataEnglishUnited States0.6330645161290323
                                                                                      RT_DIALOG0x650580xeedataEnglishUnited States0.6260504201680672
                                                                                      RT_GROUP_ICON0x651480x92dataEnglishUnited States0.7054794520547946
                                                                                      RT_VERSION0x651e00x2d8dataEnglishUnited States0.45467032967032966
                                                                                      RT_MANIFEST0x654b80x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                      Imports

                                                                                      DLLImport
                                                                                      KERNEL32.dllGetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetCurrentDirectoryA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileAttributesA, GetFileAttributesA, GetShortPathNameA, MoveFileA, GetFullPathNameA, SetFileTime, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
                                                                                      USER32.dllScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
                                                                                      GDI32.dllSelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                      SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
                                                                                      ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
                                                                                      COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                      ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                      Possible Origin

                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                      EnglishUnited States

                                                                                      Network Behavior

                                                                                      ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                      Statistics

                                                                                      CPU Usage

                                                                                      Click to jump to process

                                                                                      Memory Usage

                                                                                      Click to jump to process

                                                                                      High Level Behavior Distribution

                                                                                      Click to dive into process behavior distribution

                                                                                      Behavior

                                                                                      Click to jump to process

                                                                                      System Behavior

                                                                                      General

                                                                                      Target ID:0
                                                                                      Start time:04:53:57
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Desktop\Wave Browser.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Desktop\Wave Browser.exe"
                                                                                      Imagebase:0x400000
                                                                                      File size:1'035'600 bytes
                                                                                      MD5 hash:938C6A14B9132727C3D29951610100D0
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:low
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:1
                                                                                      Start time:04:54:04
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"
                                                                                      Imagebase:0xd70000
                                                                                      File size:815'792 bytes
                                                                                      MD5 hash:18693249F3A283E83B8179E692FFBBA9
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Antivirus matches:
                                                                                      • Detection: 8%, ReversingLabs
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:2
                                                                                      Start time:04:54:05
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"
                                                                                      Imagebase:0x640000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Antivirus matches:
                                                                                      • Detection: 3%, ReversingLabs
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:3
                                                                                      Start time:04:54:05
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /regserver
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:4
                                                                                      Start time:04:54:05
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user
                                                                                      Imagebase:0x7ff6b3530000
                                                                                      File size:195'488 bytes
                                                                                      MD5 hash:10B82DC9D9A29BC4AF224981F0E1C6FE
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Antivirus matches:
                                                                                      • Detection: 4%, ReversingLabs
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:5
                                                                                      Start time:04:54:05
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user
                                                                                      Imagebase:0x7ff6b3530000
                                                                                      File size:195'488 bytes
                                                                                      MD5 hash:10B82DC9D9A29BC4AF224981F0E1C6FE
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:6
                                                                                      Start time:04:54:05
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user
                                                                                      Imagebase:0x7ff6b3530000
                                                                                      File size:195'488 bytes
                                                                                      MD5 hash:10B82DC9D9A29BC4AF224981F0E1C6FE
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:7
                                                                                      Start time:04:54:06
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /c
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:8
                                                                                      Start time:04:54:06
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource scheduler
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:9
                                                                                      Start time:04:54:06
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /cr
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:10
                                                                                      Start time:04:54:06
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource core
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:12
                                                                                      Start time:04:54:07
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /registermsihelper
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Reputation:moderate
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:13
                                                                                      Start time:04:54:08
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9Ins1RjRENDdGRS1CNDQ4LTQzNDAtQjY1Qi03QUYyNDVFRTc5MEN9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezVEOUEyNUNELTJDQkQtNDIxMS1CM0MzLTIxMEREQzcxNjk4MH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjEzMy4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iMTAxNiIvPjwvYXBwPjwvcmVxdWVzdD4
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:14
                                                                                      Start time:04:54:08
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /handoff "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{5F4D47FE-B448-4340-B65B-7AF245EE790C}"
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:15
                                                                                      Start time:04:54:09
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /uninstall
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:16
                                                                                      Start time:04:54:15
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0ie0IwNEYxMzYzLTQxQTgtNDg2RS1BOTU4LTEzMUZDNTcwRTEwOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RUIxNDlBRDItQ0U0RS00RjUxLUI3RkMtQTE0OUZBQTRDQ0FGfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:18
                                                                                      Start time:04:54:18
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe"
                                                                                      Imagebase:0x880000
                                                                                      File size:213'400 bytes
                                                                                      MD5 hash:D40BD627BFB2BA39C5452A71A450EABD
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Antivirus matches:
                                                                                      • Detection: 8%, ReversingLabs
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:19
                                                                                      Start time:04:54:18
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /c
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:22
                                                                                      Start time:04:54:26
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe"
                                                                                      Imagebase:0x880000
                                                                                      File size:213'400 bytes
                                                                                      MD5 hash:D40BD627BFB2BA39C5452A71A450EABD
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:23
                                                                                      Start time:04:54:26
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                      Imagebase:0x7ff6044a0000
                                                                                      File size:834'512 bytes
                                                                                      MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:24
                                                                                      Start time:04:54:26
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17410 /prefetch:2
                                                                                      Imagebase:0x5e0000
                                                                                      File size:828'368 bytes
                                                                                      MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:25
                                                                                      Start time:04:54:26
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2
                                                                                      Imagebase:0x7ff6833d0000
                                                                                      File size:540'712 bytes
                                                                                      MD5 hash:89CF8972D683795DAB6901BC9456675D
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:26
                                                                                      Start time:04:54:27
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
                                                                                      Imagebase:0x110000
                                                                                      File size:85'632 bytes
                                                                                      MD5 hash:F9A898A606E7F5A1CD7CFFA8079253A0
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:27
                                                                                      Start time:04:54:27
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2
                                                                                      Imagebase:0x7ff67dcd0000
                                                                                      File size:4'210'216 bytes
                                                                                      MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:28
                                                                                      Start time:04:54:27
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=2004,i,3718953657744578865,13232452162775934316,262144 /prefetch:3
                                                                                      Imagebase:0x7ff70f330000
                                                                                      File size:4'210'216 bytes
                                                                                      MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:29
                                                                                      Start time:04:54:28
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=404b2 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
                                                                                      Imagebase:0x7ff67dcd0000
                                                                                      File size:4'210'216 bytes
                                                                                      MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:30
                                                                                      Start time:04:54:28
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:3
                                                                                      Imagebase:0x7ff67dcd0000
                                                                                      File size:4'210'216 bytes
                                                                                      MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:32
                                                                                      Start time:04:54:31
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                      Imagebase:0x7ff6044a0000
                                                                                      File size:834'512 bytes
                                                                                      MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:33
                                                                                      Start time:04:54:32
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17414 /prefetch:2
                                                                                      Imagebase:0x5e0000
                                                                                      File size:828'368 bytes
                                                                                      MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:34
                                                                                      Start time:04:54:32
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5880 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8
                                                                                      Imagebase:0x7ff67dcd0000
                                                                                      File size:4'210'216 bytes
                                                                                      MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:35
                                                                                      Start time:04:54:34
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8
                                                                                      Imagebase:0x7ff6b0b00000
                                                                                      File size:1'255'976 bytes
                                                                                      MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:36
                                                                                      Start time:04:54:34
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=2020,i,5026019351485379267,1651319541682861894,262144 /prefetch:8
                                                                                      Imagebase:0x7ff6b0b00000
                                                                                      File size:1'255'976 bytes
                                                                                      MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:37
                                                                                      Start time:04:54:44
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                      Imagebase:0x7ff67dcd0000
                                                                                      File size:4'210'216 bytes
                                                                                      MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:38
                                                                                      Start time:04:54:44
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2040,i,9846940053479223879,3976424785995044148,262144 /prefetch:3
                                                                                      Imagebase:0x7ff67dcd0000
                                                                                      File size:4'210'216 bytes
                                                                                      MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:39
                                                                                      Start time:04:54:47
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InswRjU4QTAwRC00MTc1LTREODctQUIwMi1FRTlCMTQ0OTczNjF9IiB1c2VyaWQ9IntjMWU4MGI5OS1hN2M1LTQwY2YtYTg4Mi0yYzAwYjY4OGZkYTZ9IiBpbnN0YWxsc291cmNlPSJ1bmluc3RhbGwiIHJlcXVlc3RpZD0iezMyNzQ0Q0IzLUQ3M0EtNEQ5NC1BMkIyLUM1ODIwNUE0NDJBQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4yMDA2IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iMS4zLjEzMy4wIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:40
                                                                                      Start time:04:54:52
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                                                      Imagebase:0x7ff67dcd0000
                                                                                      File size:4'210'216 bytes
                                                                                      MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:41
                                                                                      Start time:04:54:53
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=2004,i,761526046158747839,15104522579484344094,262144 /prefetch:3
                                                                                      Imagebase:0x7ff67dcd0000
                                                                                      File size:4'210'216 bytes
                                                                                      MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:42
                                                                                      Start time:04:54:56
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                      Imagebase:0x7ff6044a0000
                                                                                      File size:834'512 bytes
                                                                                      MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:43
                                                                                      Start time:04:54:56
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:82952 /prefetch:2
                                                                                      Imagebase:0x5e0000
                                                                                      File size:828'368 bytes
                                                                                      MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:44
                                                                                      Start time:04:55:02
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                      Imagebase:0x7ff6044a0000
                                                                                      File size:834'512 bytes
                                                                                      MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:45
                                                                                      Start time:04:55:02
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:17420 /prefetch:2
                                                                                      Imagebase:0x5e0000
                                                                                      File size:828'368 bytes
                                                                                      MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:46
                                                                                      Start time:04:55:09
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                      Imagebase:0x7ff6044a0000
                                                                                      File size:834'512 bytes
                                                                                      MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:47
                                                                                      Start time:04:55:15
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                      Imagebase:0x7ff6044a0000
                                                                                      File size:834'512 bytes
                                                                                      MD5 hash:CFE2E6942AC1B72981B3105E22D3224E
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:48
                                                                                      Start time:04:55:15
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7944 CREDAT:82962 /prefetch:2
                                                                                      Imagebase:0x5e0000
                                                                                      File size:828'368 bytes
                                                                                      MD5 hash:6F0F06D6AB125A99E43335427066A4A1
                                                                                      Has elevated privileges:true
                                                                                      Has administrator privileges:true
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:false

                                                                                      General

                                                                                      Target ID:49
                                                                                      Start time:04:55:20
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                      Wow64 process (32bit):true
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe" /unregserver
                                                                                      Imagebase:0xc30000
                                                                                      File size:111'000 bytes
                                                                                      MD5 hash:57428456C6E6C2EA328C864681DB5DF3
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:50
                                                                                      Start time:04:55:20
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user /unregister
                                                                                      Imagebase:0x7ff6b3530000
                                                                                      File size:195'488 bytes
                                                                                      MD5 hash:10B82DC9D9A29BC4AF224981F0E1C6FE
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      General

                                                                                      Target ID:51
                                                                                      Start time:04:55:20
                                                                                      Start date:07/07/2024
                                                                                      Path:C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe
                                                                                      Wow64 process (32bit):false
                                                                                      Commandline:"C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user /unregister
                                                                                      Imagebase:0x7ff6b3530000
                                                                                      File size:195'488 bytes
                                                                                      MD5 hash:10B82DC9D9A29BC4AF224981F0E1C6FE
                                                                                      Has elevated privileges:false
                                                                                      Has administrator privileges:false
                                                                                      Programmed in:C, C++ or other language
                                                                                      Has exited:true

                                                                                      Disassembly

                                                                                      Reset < >

                                                                                        Execution Graph

                                                                                        Execution Coverage:24.5%
                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                        Signature Coverage:21.2%
                                                                                        Total number of Nodes:1288
                                                                                        Total number of Limit Nodes:41
                                                                                        execution_graph 3852 402340 3853 402acb 17 API calls 3852->3853 3854 402351 3853->3854 3855 402acb 17 API calls 3854->3855 3856 40235a 3855->3856 3857 402acb 17 API calls 3856->3857 3858 402364 GetPrivateProfileStringA 3857->3858 3859 401d41 GetDlgItem GetClientRect 3860 402acb 17 API calls 3859->3860 3861 401d71 LoadImageA SendMessageA 3860->3861 3862 402957 3861->3862 3863 401d8f DeleteObject 3861->3863 3863->3862 3133 401746 3134 402acb 17 API calls 3133->3134 3135 40174d 3134->3135 3139 405b32 3135->3139 3137 401754 3138 405b32 2 API calls 3137->3138 3138->3137 3140 405b3d GetTickCount GetTempFileNameA 3139->3140 3141 405b6e 3140->3141 3142 405b6a 3140->3142 3141->3137 3142->3140 3142->3141 3871 401947 3872 402acb 17 API calls 3871->3872 3873 40194e lstrlenA 3872->3873 3874 40257d 3873->3874 3878 4025ca 3879 402aa9 17 API calls 3878->3879 3882 4025d4 3879->3882 3880 402642 3881 405b7b ReadFile 3881->3882 3882->3880 3882->3881 3883 402644 3882->3883 3884 402654 3882->3884 3887 405ec8 wsprintfA 3883->3887 3884->3880 3886 40266a SetFilePointer 3884->3886 3886->3880 3887->3880 3888 40224b 3889 402acb 17 API calls 3888->3889 3890 402251 3889->3890 3891 402acb 17 API calls 3890->3891 3892 40225a 3891->3892 3893 402acb 17 API calls 3892->3893 3894 402263 3893->3894 3895 40626d 2 API calls 3894->3895 3896 40226c 3895->3896 3897 40227d lstrlenA lstrlenA 3896->3897 3901 402270 3896->3901 3899 405091 24 API calls 3897->3899 3898 405091 24 API calls 3902 402278 3898->3902 3900 4022b9 SHFileOperationA 3899->3900 3900->3901 3900->3902 3901->3898 3903 4028cb 3904 402aa9 17 API calls 3903->3904 3905 4028d1 3904->3905 3906 402906 3905->3906 3907 40271c 3905->3907 3909 4028e3 3905->3909 3906->3907 3908 405f8c 17 API calls 3906->3908 3908->3907 3909->3907 3911 405ec8 wsprintfA 3909->3911 3911->3907 3912 4022cd 3913 4022d4 3912->3913 3915 4022e7 3912->3915 3914 405f8c 17 API calls 3913->3914 3916 4022e1 3914->3916 3917 405686 MessageBoxIndirectA 3916->3917 3917->3915 3176 4051cf 3177 4051f1 GetDlgItem GetDlgItem GetDlgItem 3176->3177 3178 40537a 3176->3178 3221 40403e SendMessageA 3177->3221 3180 405382 GetDlgItem CreateThread CloseHandle 3178->3180 3181 4053aa 3178->3181 3180->3181 3244 405163 OleInitialize 3180->3244 3183 4053c0 ShowWindow ShowWindow 3181->3183 3184 4053f9 3181->3184 3185 4053d8 3181->3185 3182 405261 3188 405268 GetClientRect GetSystemMetrics SendMessageA SendMessageA 3182->3188 3226 40403e SendMessageA 3183->3226 3230 404070 3184->3230 3186 405433 3185->3186 3190 4053e8 3185->3190 3191 40540c ShowWindow 3185->3191 3186->3184 3198 405440 SendMessageA 3186->3198 3196 4052d6 3188->3196 3197 4052ba SendMessageA SendMessageA 3188->3197 3227 403fe2 3190->3227 3194 40542c 3191->3194 3195 40541e 3191->3195 3193 405405 3200 403fe2 SendMessageA 3194->3200 3199 405091 24 API calls 3195->3199 3201 4052e9 3196->3201 3202 4052db SendMessageA 3196->3202 3197->3196 3198->3193 3203 405459 CreatePopupMenu 3198->3203 3199->3194 3200->3186 3222 404009 3201->3222 3202->3201 3204 405f8c 17 API calls 3203->3204 3206 405469 AppendMenuA 3204->3206 3210 405487 GetWindowRect 3206->3210 3211 40549a TrackPopupMenu 3206->3211 3207 4052f9 3208 405302 ShowWindow 3207->3208 3209 405336 GetDlgItem SendMessageA 3207->3209 3212 405318 ShowWindow 3208->3212 3215 405325 3208->3215 3209->3193 3214 40535d SendMessageA SendMessageA 3209->3214 3210->3211 3211->3193 3213 4054b6 3211->3213 3212->3215 3216 4054d5 SendMessageA 3213->3216 3214->3193 3225 40403e SendMessageA 3215->3225 3216->3216 3217 4054f2 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3216->3217 3219 405514 SendMessageA 3217->3219 3219->3219 3220 405536 GlobalUnlock SetClipboardData CloseClipboard 3219->3220 3220->3193 3221->3182 3223 405f8c 17 API calls 3222->3223 3224 404014 SetDlgItemTextA 3223->3224 3224->3207 3225->3209 3226->3185 3228 403fe9 3227->3228 3229 403fef SendMessageA 3227->3229 3228->3229 3229->3184 3231 404088 GetWindowLongA 3230->3231 3232 404133 3230->3232 3231->3232 3233 40409d 3231->3233 3232->3193 3233->3232 3234 4040ca GetSysColor 3233->3234 3235 4040cd 3233->3235 3234->3235 3236 4040d3 SetTextColor 3235->3236 3237 4040dd SetBkMode 3235->3237 3236->3237 3238 4040f5 GetSysColor 3237->3238 3239 4040fb 3237->3239 3238->3239 3240 404102 SetBkColor 3239->3240 3241 40410c 3239->3241 3240->3241 3241->3232 3242 404126 CreateBrushIndirect 3241->3242 3243 40411f DeleteObject 3241->3243 3242->3232 3243->3242 3251 404055 3244->3251 3246 4051ad 3247 404055 SendMessageA 3246->3247 3248 4051bf OleUninitialize 3247->3248 3249 405186 3249->3246 3254 401389 3249->3254 3252 40406d 3251->3252 3253 40405e SendMessageA 3251->3253 3252->3249 3253->3252 3256 401390 3254->3256 3255 4013fe 3255->3249 3256->3255 3257 4013cb MulDiv SendMessageA 3256->3257 3257->3256 3918 4020d1 3919 402acb 17 API calls 3918->3919 3920 4020d8 3919->3920 3921 402acb 17 API calls 3920->3921 3922 4020e2 3921->3922 3923 402acb 17 API calls 3922->3923 3924 4020ec 3923->3924 3925 402acb 17 API calls 3924->3925 3926 4020f6 3925->3926 3927 402acb 17 API calls 3926->3927 3929 402100 3927->3929 3928 402142 CoCreateInstance 3933 402161 3928->3933 3935 40220c 3928->3935 3929->3928 3930 402acb 17 API calls 3929->3930 3930->3928 3931 401423 24 API calls 3932 402242 3931->3932 3934 4021ec MultiByteToWideChar 3933->3934 3933->3935 3934->3935 3935->3931 3935->3932 3936 404454 3937 404464 3936->3937 3938 40448a 3936->3938 3939 404009 18 API calls 3937->3939 3940 404070 8 API calls 3938->3940 3941 404471 SetDlgItemTextA 3939->3941 3942 404496 3940->3942 3941->3938 3943 4026d4 3944 4026da 3943->3944 3945 4026de FindNextFileA 3944->3945 3948 4026f0 3944->3948 3946 40272f 3945->3946 3945->3948 3949 405f6a lstrcpynA 3946->3949 3949->3948 3466 4031d6 SetErrorMode GetVersion 3467 403217 3466->3467 3468 40321d 3466->3468 3469 406302 5 API calls 3467->3469 3555 406294 GetSystemDirectoryA 3468->3555 3469->3468 3471 403233 lstrlenA 3471->3468 3472 403242 3471->3472 3558 406302 GetModuleHandleA 3472->3558 3475 406302 5 API calls 3476 403250 3475->3476 3477 406302 5 API calls 3476->3477 3478 40325c #17 OleInitialize SHGetFileInfoA 3477->3478 3564 405f6a lstrcpynA 3478->3564 3481 4032a8 GetCommandLineA 3565 405f6a lstrcpynA 3481->3565 3483 4032ba 3484 40592d CharNextA 3483->3484 3485 4032e3 CharNextA 3484->3485 3490 4032f3 3485->3490 3486 4033bd 3487 4033d0 GetTempPathA 3486->3487 3566 4031a5 3487->3566 3489 4033e8 3491 403442 DeleteFileA 3489->3491 3492 4033ec GetWindowsDirectoryA lstrcatA 3489->3492 3490->3486 3493 40592d CharNextA 3490->3493 3498 4033bf 3490->3498 3576 402d63 GetTickCount GetModuleFileNameA 3491->3576 3494 4031a5 12 API calls 3492->3494 3493->3490 3497 403408 3494->3497 3496 403456 3499 4034f0 ExitProcess OleUninitialize 3496->3499 3506 40592d CharNextA 3496->3506 3539 4034dc 3496->3539 3497->3491 3501 40340c GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 3497->3501 3667 405f6a lstrcpynA 3498->3667 3502 403624 3499->3502 3503 403506 3499->3503 3504 4031a5 12 API calls 3501->3504 3508 40362c GetCurrentProcess OpenProcessToken 3502->3508 3512 4036a6 ExitProcess 3502->3512 3670 405686 3503->3670 3509 40343a 3504->3509 3511 403471 3506->3511 3515 403677 3508->3515 3516 403647 LookupPrivilegeValueA AdjustTokenPrivileges 3508->3516 3509->3491 3509->3499 3510 4034ec 3510->3499 3518 4034b7 3511->3518 3519 40351c 3511->3519 3517 406302 5 API calls 3515->3517 3516->3515 3520 40367e 3517->3520 3522 4059f0 18 API calls 3518->3522 3660 4055f1 3519->3660 3523 403693 ExitWindowsEx 3520->3523 3524 40369f 3520->3524 3526 4034c2 3522->3526 3523->3512 3523->3524 3527 40140b 2 API calls 3524->3527 3526->3499 3668 405f6a lstrcpynA 3526->3668 3527->3512 3528 403532 lstrcatA 3529 40353d lstrcatA lstrcmpiA 3528->3529 3529->3499 3530 403559 3529->3530 3532 403565 3530->3532 3533 40355e 3530->3533 3679 4055d4 CreateDirectoryA 3532->3679 3674 405557 CreateDirectoryA 3533->3674 3534 4034d1 3669 405f6a lstrcpynA 3534->3669 3604 403798 3539->3604 3540 40356a SetCurrentDirectoryA 3541 403584 3540->3541 3542 403579 3540->3542 3663 405f6a lstrcpynA 3541->3663 3682 405f6a lstrcpynA 3542->3682 3545 405f8c 17 API calls 3546 4035c3 DeleteFileA 3545->3546 3547 4035d0 CopyFileA 3546->3547 3552 403592 3546->3552 3547->3552 3548 403618 3549 405d49 36 API calls 3548->3549 3549->3510 3550 405d49 36 API calls 3550->3552 3551 405f8c 17 API calls 3551->3552 3552->3545 3552->3548 3552->3550 3552->3551 3554 403604 CloseHandle 3552->3554 3664 405609 CreateProcessA 3552->3664 3554->3552 3556 4062b6 wsprintfA LoadLibraryExA 3555->3556 3556->3471 3559 406328 GetProcAddress 3558->3559 3560 40631e 3558->3560 3562 403249 3559->3562 3561 406294 3 API calls 3560->3561 3563 406324 3561->3563 3562->3475 3563->3559 3563->3562 3564->3481 3565->3483 3567 4061d4 5 API calls 3566->3567 3569 4031b1 3567->3569 3568 4031bb 3568->3489 3569->3568 3570 405902 3 API calls 3569->3570 3571 4031c3 3570->3571 3572 4055d4 2 API calls 3571->3572 3573 4031c9 3572->3573 3574 405b32 2 API calls 3573->3574 3575 4031d4 3574->3575 3575->3489 3683 405b03 GetFileAttributesA CreateFileA 3576->3683 3578 402da3 3599 402db3 3578->3599 3684 405f6a lstrcpynA 3578->3684 3580 402dc9 3581 405949 2 API calls 3580->3581 3582 402dcf 3581->3582 3685 405f6a lstrcpynA 3582->3685 3584 402dda GetFileSize 3585 402ed6 3584->3585 3597 402df1 3584->3597 3686 402cff 3585->3686 3587 402edf 3589 402f0f GlobalAlloc 3587->3589 3587->3599 3722 40318e SetFilePointer 3587->3722 3697 40318e SetFilePointer 3589->3697 3591 402f42 3595 402cff 6 API calls 3591->3595 3593 402ef8 3596 403178 ReadFile 3593->3596 3594 402f2a 3698 402f9c 3594->3698 3595->3599 3600 402f03 3596->3600 3597->3585 3597->3591 3597->3599 3601 402cff 6 API calls 3597->3601 3719 403178 3597->3719 3599->3496 3600->3589 3600->3599 3601->3597 3602 402f36 3602->3599 3602->3602 3603 402f73 SetFilePointer 3602->3603 3603->3599 3605 406302 5 API calls 3604->3605 3606 4037ac 3605->3606 3607 4037b2 3606->3607 3608 4037c4 3606->3608 3743 405ec8 wsprintfA 3607->3743 3609 405e51 3 API calls 3608->3609 3610 4037ef 3609->3610 3611 40380d lstrcatA 3610->3611 3613 405e51 3 API calls 3610->3613 3614 4037c2 3611->3614 3613->3611 3735 403a5d 3614->3735 3617 4059f0 18 API calls 3618 40383f 3617->3618 3619 4038c8 3618->3619 3621 405e51 3 API calls 3618->3621 3620 4059f0 18 API calls 3619->3620 3622 4038ce 3620->3622 3624 40386b 3621->3624 3623 4038de LoadImageA 3622->3623 3625 405f8c 17 API calls 3622->3625 3626 403984 3623->3626 3627 403905 RegisterClassA 3623->3627 3624->3619 3628 403887 lstrlenA 3624->3628 3632 40592d CharNextA 3624->3632 3625->3623 3631 40140b 2 API calls 3626->3631 3629 40398e 3627->3629 3630 40393b SystemParametersInfoA CreateWindowExA 3627->3630 3633 403895 lstrcmpiA 3628->3633 3634 4038bb 3628->3634 3629->3510 3630->3626 3635 40398a 3631->3635 3636 403885 3632->3636 3633->3634 3637 4038a5 GetFileAttributesA 3633->3637 3638 405902 3 API calls 3634->3638 3635->3629 3640 403a5d 18 API calls 3635->3640 3636->3628 3639 4038b1 3637->3639 3641 4038c1 3638->3641 3639->3634 3642 405949 2 API calls 3639->3642 3643 40399b 3640->3643 3744 405f6a lstrcpynA 3641->3744 3642->3634 3645 4039a7 ShowWindow 3643->3645 3646 403a2a 3643->3646 3648 406294 3 API calls 3645->3648 3647 405163 5 API calls 3646->3647 3649 403a30 3647->3649 3650 4039bf 3648->3650 3651 403a34 3649->3651 3652 403a4c 3649->3652 3653 4039cd GetClassInfoA 3650->3653 3655 406294 3 API calls 3650->3655 3651->3629 3659 40140b 2 API calls 3651->3659 3654 40140b 2 API calls 3652->3654 3656 4039e1 GetClassInfoA RegisterClassA 3653->3656 3657 4039f7 DialogBoxParamA 3653->3657 3654->3629 3655->3653 3656->3657 3658 40140b 2 API calls 3657->3658 3658->3629 3659->3629 3661 406302 5 API calls 3660->3661 3662 403521 lstrcatA 3661->3662 3662->3528 3662->3529 3663->3552 3665 405648 3664->3665 3666 40563c CloseHandle 3664->3666 3665->3552 3666->3665 3667->3487 3668->3534 3669->3539 3671 40569b 3670->3671 3672 403514 ExitProcess 3671->3672 3673 4056af MessageBoxIndirectA 3671->3673 3673->3672 3675 403563 3674->3675 3676 4055a8 GetLastError 3674->3676 3675->3540 3676->3675 3677 4055b7 SetFileSecurityA 3676->3677 3677->3675 3678 4055cd GetLastError 3677->3678 3678->3675 3680 4055e4 3679->3680 3681 4055e8 GetLastError 3679->3681 3680->3540 3681->3680 3682->3541 3683->3578 3684->3580 3685->3584 3687 402d20 3686->3687 3688 402d08 3686->3688 3691 402d30 GetTickCount 3687->3691 3692 402d28 3687->3692 3689 402d11 DestroyWindow 3688->3689 3690 402d18 3688->3690 3689->3690 3690->3587 3694 402d61 3691->3694 3695 402d3e CreateDialogParamA ShowWindow 3691->3695 3723 40633e 3692->3723 3694->3587 3695->3694 3697->3594 3700 402fb2 3698->3700 3699 402fdd 3702 403178 ReadFile 3699->3702 3700->3699 3734 40318e SetFilePointer 3700->3734 3703 402fe8 3702->3703 3704 403118 3703->3704 3705 402ffa GetTickCount 3703->3705 3713 403102 3703->3713 3706 40311c 3704->3706 3707 403134 3704->3707 3717 40300d 3705->3717 3708 403178 ReadFile 3706->3708 3709 403178 ReadFile 3707->3709 3711 405baa WriteFile 3707->3711 3707->3713 3708->3713 3709->3707 3710 403178 ReadFile 3710->3717 3711->3707 3713->3602 3714 403073 GetTickCount 3714->3717 3715 40309c MulDiv wsprintfA 3716 405091 24 API calls 3715->3716 3716->3717 3717->3710 3717->3713 3717->3714 3717->3715 3718 405baa WriteFile 3717->3718 3727 406447 3717->3727 3718->3717 3720 405b7b ReadFile 3719->3720 3721 40318b 3720->3721 3721->3597 3722->3593 3724 40635b PeekMessageA 3723->3724 3725 406351 DispatchMessageA 3724->3725 3726 402d2e 3724->3726 3725->3724 3726->3587 3728 40646c 3727->3728 3729 406474 3727->3729 3728->3717 3729->3728 3730 406504 GlobalAlloc 3729->3730 3731 4064fb GlobalFree 3729->3731 3732 406572 GlobalFree 3729->3732 3733 40657b GlobalAlloc 3729->3733 3730->3728 3730->3729 3731->3730 3732->3733 3733->3728 3733->3729 3734->3699 3736 403a71 3735->3736 3745 405ec8 wsprintfA 3736->3745 3738 403ae2 3739 403b16 18 API calls 3738->3739 3741 403ae7 3739->3741 3740 40381d 3740->3617 3741->3740 3742 405f8c 17 API calls 3741->3742 3742->3741 3743->3614 3744->3619 3745->3738 3746 4023d6 3747 402acb 17 API calls 3746->3747 3748 4023e8 3747->3748 3749 402acb 17 API calls 3748->3749 3750 4023f2 3749->3750 3763 402b5b 3750->3763 3753 40271c 3754 402427 3756 402433 3754->3756 3758 402aa9 17 API calls 3754->3758 3755 402acb 17 API calls 3757 402420 lstrlenA 3755->3757 3759 402452 RegSetValueExA 3756->3759 3760 402f9c 35 API calls 3756->3760 3757->3754 3758->3756 3761 402468 RegCloseKey 3759->3761 3760->3759 3761->3753 3764 402b76 3763->3764 3767 405e1e 3764->3767 3768 405e2d 3767->3768 3769 402402 3768->3769 3770 405e38 RegCreateKeyExA 3768->3770 3769->3753 3769->3754 3769->3755 3770->3769 3950 403756 3951 403761 3950->3951 3952 403765 3951->3952 3953 403768 GlobalAlloc 3951->3953 3953->3952 3954 4014d6 3955 402aa9 17 API calls 3954->3955 3956 4014dc Sleep 3955->3956 3958 402957 3956->3958 3776 401759 3777 402acb 17 API calls 3776->3777 3778 401760 3777->3778 3779 401786 3778->3779 3780 40177e 3778->3780 3816 405f6a lstrcpynA 3779->3816 3815 405f6a lstrcpynA 3780->3815 3783 401784 3787 4061d4 5 API calls 3783->3787 3784 401791 3785 405902 3 API calls 3784->3785 3786 401797 lstrcatA 3785->3786 3786->3783 3799 4017a3 3787->3799 3788 40626d 2 API calls 3788->3799 3789 405ade 2 API calls 3789->3799 3791 4017ba CompareFileTime 3791->3799 3792 40187e 3793 405091 24 API calls 3792->3793 3794 401888 3793->3794 3797 402f9c 35 API calls 3794->3797 3795 405091 24 API calls 3798 40186a 3795->3798 3796 405f6a lstrcpynA 3796->3799 3800 40189b 3797->3800 3799->3788 3799->3789 3799->3791 3799->3792 3799->3796 3802 405f8c 17 API calls 3799->3802 3809 405686 MessageBoxIndirectA 3799->3809 3813 401855 3799->3813 3814 405b03 GetFileAttributesA CreateFileA 3799->3814 3801 4018af SetFileTime 3800->3801 3803 4018c1 FindCloseChangeNotification 3800->3803 3801->3803 3802->3799 3803->3798 3804 4018d2 3803->3804 3805 4018d7 3804->3805 3806 4018ea 3804->3806 3807 405f8c 17 API calls 3805->3807 3808 405f8c 17 API calls 3806->3808 3810 4018df lstrcatA 3807->3810 3811 4018f2 3808->3811 3809->3799 3810->3811 3812 405686 MessageBoxIndirectA 3811->3812 3812->3798 3813->3795 3813->3798 3814->3799 3815->3783 3816->3784 3959 401659 3960 402acb 17 API calls 3959->3960 3961 40165f 3960->3961 3962 40626d 2 API calls 3961->3962 3963 401665 3962->3963 3964 401959 3965 402aa9 17 API calls 3964->3965 3966 401960 3965->3966 3967 402aa9 17 API calls 3966->3967 3968 40196d 3967->3968 3969 402acb 17 API calls 3968->3969 3970 401984 lstrlenA 3969->3970 3972 401994 3970->3972 3971 4019d4 3972->3971 3976 405f6a lstrcpynA 3972->3976 3974 4019c4 3974->3971 3975 4019c9 lstrlenA 3974->3975 3975->3971 3976->3974 3977 401cda 3978 402aa9 17 API calls 3977->3978 3979 401ce0 IsWindow 3978->3979 3980 401a0e 3979->3980 3988 401a5e 3989 402aa9 17 API calls 3988->3989 3990 401a67 3989->3990 3991 402aa9 17 API calls 3990->3991 3992 401a0e 3991->3992 3993 401f61 3994 402acb 17 API calls 3993->3994 3995 401f68 3994->3995 3996 406302 5 API calls 3995->3996 3997 401f77 3996->3997 3998 401f8f GlobalAlloc 3997->3998 4000 401ff7 3997->4000 3999 401fa3 3998->3999 3998->4000 4001 406302 5 API calls 3999->4001 4002 401faa 4001->4002 4003 406302 5 API calls 4002->4003 4004 401fb4 4003->4004 4004->4000 4008 405ec8 wsprintfA 4004->4008 4006 401feb 4009 405ec8 wsprintfA 4006->4009 4008->4006 4009->4000 4010 402561 4011 402acb 17 API calls 4010->4011 4012 402568 4011->4012 4015 405b03 GetFileAttributesA CreateFileA 4012->4015 4014 402574 4015->4014 4016 401563 4017 4028ff 4016->4017 4020 405ec8 wsprintfA 4017->4020 4019 402904 4020->4019 4021 4024e5 4031 402b0b 4021->4031 4024 402aa9 17 API calls 4025 4024f8 4024->4025 4026 402513 RegEnumKeyA 4025->4026 4027 40251f RegEnumValueA 4025->4027 4028 40271c 4025->4028 4029 402534 RegCloseKey 4026->4029 4027->4029 4029->4028 4032 402acb 17 API calls 4031->4032 4033 402b22 4032->4033 4034 405df0 RegOpenKeyExA 4033->4034 4035 4024ef 4034->4035 4035->4024 4043 40166a 4044 402acb 17 API calls 4043->4044 4045 401671 4044->4045 4046 402acb 17 API calls 4045->4046 4047 40167a 4046->4047 4048 402acb 17 API calls 4047->4048 4049 401683 MoveFileA 4048->4049 4050 401696 4049->4050 4056 40168f 4049->4056 4052 40626d 2 API calls 4050->4052 4054 402242 4050->4054 4051 401423 24 API calls 4051->4054 4053 4016a5 4052->4053 4053->4054 4055 405d49 36 API calls 4053->4055 4055->4056 4056->4051 4057 4047ec 4058 404818 4057->4058 4059 4047fc 4057->4059 4060 40484b 4058->4060 4061 40481e SHGetPathFromIDListA 4058->4061 4068 40566a GetDlgItemTextA 4059->4068 4063 404835 SendMessageA 4061->4063 4064 40482e 4061->4064 4063->4060 4066 40140b 2 API calls 4064->4066 4065 404809 SendMessageA 4065->4058 4066->4063 4068->4065 4069 4019ed 4070 402acb 17 API calls 4069->4070 4071 4019f4 4070->4071 4072 402acb 17 API calls 4071->4072 4073 4019fd 4072->4073 4074 401a04 lstrcmpiA 4073->4074 4075 401a16 lstrcmpA 4073->4075 4076 401a0a 4074->4076 4075->4076 4077 40156f 4078 401586 4077->4078 4079 40157f ShowWindow 4077->4079 4080 401594 ShowWindow 4078->4080 4081 402957 4078->4081 4079->4078 4080->4081 4082 402473 4083 402b0b 17 API calls 4082->4083 4084 40247d 4083->4084 4085 402acb 17 API calls 4084->4085 4086 402486 4085->4086 4087 402490 RegQueryValueExA 4086->4087 4088 40271c 4086->4088 4089 4024b0 4087->4089 4092 4024b6 RegCloseKey 4087->4092 4089->4092 4093 405ec8 wsprintfA 4089->4093 4092->4088 4093->4092 4094 404174 4095 40418a 4094->4095 4103 404296 4094->4103 4097 404009 18 API calls 4095->4097 4096 404305 4098 4043cf 4096->4098 4099 40430f GetDlgItem 4096->4099 4100 4041e0 4097->4100 4105 404070 8 API calls 4098->4105 4101 404325 4099->4101 4102 40438d 4099->4102 4104 404009 18 API calls 4100->4104 4101->4102 4108 40434b SendMessageA LoadCursorA SetCursor 4101->4108 4102->4098 4109 40439f 4102->4109 4103->4096 4103->4098 4106 4042da GetDlgItem SendMessageA 4103->4106 4107 4041ed CheckDlgButton 4104->4107 4119 4043ca 4105->4119 4127 40402b KiUserCallbackDispatcher 4106->4127 4125 40402b KiUserCallbackDispatcher 4107->4125 4131 404418 4108->4131 4114 4043a5 SendMessageA 4109->4114 4115 4043b6 4109->4115 4111 404300 4128 4043f4 4111->4128 4114->4115 4115->4119 4120 4043bc SendMessageA 4115->4120 4117 40420b GetDlgItem 4126 40403e SendMessageA 4117->4126 4120->4119 4122 404221 SendMessageA 4123 404248 SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 4122->4123 4124 40423f GetSysColor 4122->4124 4123->4119 4124->4123 4125->4117 4126->4122 4127->4111 4129 404402 4128->4129 4130 404407 SendMessageA 4128->4130 4129->4130 4130->4096 4134 40564c ShellExecuteExA 4131->4134 4133 40437e LoadCursorA SetCursor 4133->4102 4134->4133 4135 4014f4 SetForegroundWindow 4136 402957 4135->4136 4137 4065f6 4141 40647a 4137->4141 4138 406de5 4139 406504 GlobalAlloc 4139->4138 4139->4141 4140 4064fb GlobalFree 4140->4139 4141->4138 4141->4139 4141->4140 4141->4141 4142 406572 GlobalFree 4141->4142 4143 40657b GlobalAlloc 4141->4143 4142->4143 4143->4138 4143->4141 3771 406377 WaitForSingleObject 3772 406391 3771->3772 3773 4063a3 GetExitCodeProcess 3772->3773 3774 40633e 2 API calls 3772->3774 3775 406398 WaitForSingleObject 3774->3775 3775->3772 4144 401cfb 4145 402aa9 17 API calls 4144->4145 4146 401d02 4145->4146 4147 402aa9 17 API calls 4146->4147 4148 401d0e GetDlgItem 4147->4148 4149 40257d 4148->4149 4150 402c7c 4151 402ca4 4150->4151 4152 402c8b SetTimer 4150->4152 4153 402cf9 4151->4153 4154 402cbe MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 4151->4154 4152->4151 4154->4153 4155 4022fc 4156 402304 4155->4156 4157 40230a 4155->4157 4158 402acb 17 API calls 4156->4158 4159 402acb 17 API calls 4157->4159 4160 40231a 4157->4160 4158->4157 4159->4160 4161 402328 4160->4161 4162 402acb 17 API calls 4160->4162 4163 402acb 17 API calls 4161->4163 4162->4161 4164 402331 WritePrivateProfileStringA 4163->4164 4165 4018fd 4166 401934 4165->4166 4167 402acb 17 API calls 4166->4167 4168 401939 4167->4168 4169 405732 67 API calls 4168->4169 4170 401942 4169->4170 4171 4026fe 4172 402acb 17 API calls 4171->4172 4173 402705 FindFirstFileA 4172->4173 4174 402728 4173->4174 4178 402718 4173->4178 4175 40272f 4174->4175 4179 405ec8 wsprintfA 4174->4179 4180 405f6a lstrcpynA 4175->4180 4179->4175 4180->4178 4188 401000 4189 401037 BeginPaint GetClientRect 4188->4189 4190 40100c DefWindowProcA 4188->4190 4192 4010f3 4189->4192 4193 401179 4190->4193 4194 401073 CreateBrushIndirect FillRect DeleteObject 4192->4194 4195 4010fc 4192->4195 4194->4192 4196 401102 CreateFontIndirectA 4195->4196 4197 401167 EndPaint 4195->4197 4196->4197 4198 401112 6 API calls 4196->4198 4197->4193 4198->4197 4199 401900 4200 402acb 17 API calls 4199->4200 4201 401907 4200->4201 4202 405686 MessageBoxIndirectA 4201->4202 4203 401910 4202->4203 4204 402381 4205 4023b3 4204->4205 4206 402388 4204->4206 4207 402acb 17 API calls 4205->4207 4208 402b0b 17 API calls 4206->4208 4209 4023ba 4207->4209 4210 40238f 4208->4210 4215 402b89 4209->4215 4212 402acb 17 API calls 4210->4212 4214 4023c7 4210->4214 4213 4023a0 RegDeleteValueA RegCloseKey 4212->4213 4213->4214 4216 402b95 4215->4216 4217 402b9c 4215->4217 4216->4214 4217->4216 4219 402bcd 4217->4219 4220 405df0 RegOpenKeyExA 4219->4220 4224 402bfb 4220->4224 4221 402c21 RegEnumKeyA 4222 402c38 RegCloseKey 4221->4222 4221->4224 4225 406302 5 API calls 4222->4225 4223 402c59 RegCloseKey 4229 402c4c 4223->4229 4224->4221 4224->4222 4224->4223 4226 402bcd 6 API calls 4224->4226 4224->4229 4227 402c48 4225->4227 4226->4224 4228 402c69 RegDeleteKeyA 4227->4228 4227->4229 4228->4229 4229->4216 4230 401502 4231 40150a 4230->4231 4233 40151d 4230->4233 4232 402aa9 17 API calls 4231->4232 4232->4233 3051 402003 3052 402015 3051->3052 3053 4020c3 3051->3053 3071 402acb 3052->3071 3055 401423 24 API calls 3053->3055 3062 402242 3055->3062 3057 402acb 17 API calls 3058 402025 3057->3058 3059 40203a LoadLibraryExA 3058->3059 3060 40202d GetModuleHandleA 3058->3060 3059->3053 3061 40204a GetProcAddress 3059->3061 3060->3059 3060->3061 3063 402096 3061->3063 3064 402059 3061->3064 3080 405091 3063->3080 3065 402061 3064->3065 3066 402078 KiUserCallbackDispatcher 3064->3066 3077 401423 3065->3077 3069 402069 3066->3069 3069->3062 3070 4020b7 FreeLibrary 3069->3070 3070->3062 3072 402ad7 3071->3072 3091 405f8c 3072->3091 3075 40201c 3075->3057 3078 405091 24 API calls 3077->3078 3079 401431 3078->3079 3079->3069 3081 4050ac 3080->3081 3090 40514f 3080->3090 3082 4050c9 lstrlenA 3081->3082 3083 405f8c 17 API calls 3081->3083 3084 4050f2 3082->3084 3085 4050d7 lstrlenA 3082->3085 3083->3082 3087 405105 3084->3087 3088 4050f8 SetWindowTextA 3084->3088 3086 4050e9 lstrcatA 3085->3086 3085->3090 3086->3084 3089 40510b SendMessageA SendMessageA SendMessageA 3087->3089 3087->3090 3088->3087 3089->3090 3090->3069 3105 405f99 3091->3105 3092 4061bb 3093 402af8 3092->3093 3124 405f6a lstrcpynA 3092->3124 3093->3075 3108 4061d4 3093->3108 3095 406195 lstrlenA 3095->3105 3096 405f8c 10 API calls 3096->3095 3099 4060b1 GetSystemDirectoryA 3099->3105 3101 4060c4 GetWindowsDirectoryA 3101->3105 3102 4061d4 5 API calls 3102->3105 3103 405f8c 10 API calls 3103->3105 3104 40613e lstrcatA 3104->3105 3105->3092 3105->3095 3105->3096 3105->3099 3105->3101 3105->3102 3105->3103 3105->3104 3106 4060f8 SHGetSpecialFolderLocation 3105->3106 3117 405e51 3105->3117 3122 405ec8 wsprintfA 3105->3122 3123 405f6a lstrcpynA 3105->3123 3106->3105 3107 406110 SHGetPathFromIDListA CoTaskMemFree 3106->3107 3107->3105 3115 4061e0 3108->3115 3109 406248 3110 40624c CharPrevA 3109->3110 3112 406267 3109->3112 3110->3109 3111 40623d CharNextA 3111->3109 3111->3115 3112->3075 3114 40622b CharNextA 3114->3115 3115->3109 3115->3111 3115->3114 3116 406238 CharNextA 3115->3116 3129 40592d 3115->3129 3116->3111 3125 405df0 3117->3125 3120 405eb4 3120->3105 3121 405e85 RegQueryValueExA RegCloseKey 3121->3120 3122->3105 3123->3105 3124->3093 3126 405dff 3125->3126 3127 405e03 3126->3127 3128 405e08 RegOpenKeyExA 3126->3128 3127->3120 3127->3121 3128->3127 3130 405933 3129->3130 3131 405946 3130->3131 3132 405939 CharNextA 3130->3132 3131->3115 3132->3130 4234 402583 4235 402588 4234->4235 4236 40259c 4234->4236 4237 402aa9 17 API calls 4235->4237 4238 402acb 17 API calls 4236->4238 4239 402591 4237->4239 4240 4025a3 lstrlenA 4238->4240 4241 405baa WriteFile 4239->4241 4242 4025c5 4239->4242 4240->4239 4241->4242 4243 405005 4244 405015 4243->4244 4245 405029 4243->4245 4246 405072 4244->4246 4247 40501b 4244->4247 4248 405031 IsWindowVisible 4245->4248 4254 405048 4245->4254 4249 405077 CallWindowProcA 4246->4249 4250 404055 SendMessageA 4247->4250 4248->4246 4251 40503e 4248->4251 4252 405025 4249->4252 4250->4252 4256 40495c SendMessageA 4251->4256 4254->4249 4261 4049dc 4254->4261 4257 4049bb SendMessageA 4256->4257 4258 40497f GetMessagePos ScreenToClient SendMessageA 4256->4258 4259 4049b3 4257->4259 4258->4259 4260 4049b8 4258->4260 4259->4254 4260->4257 4270 405f6a lstrcpynA 4261->4270 4263 4049ef 4271 405ec8 wsprintfA 4263->4271 4265 4049f9 4266 40140b 2 API calls 4265->4266 4267 404a02 4266->4267 4272 405f6a lstrcpynA 4267->4272 4269 404a09 4269->4246 4270->4263 4271->4265 4272->4269 4273 402688 4274 40268f 4273->4274 4276 402904 4273->4276 4275 402aa9 17 API calls 4274->4275 4277 402696 4275->4277 4278 4026a5 SetFilePointer 4277->4278 4278->4276 4279 4026b5 4278->4279 4281 405ec8 wsprintfA 4279->4281 4281->4276 3143 401c0a 3165 402aa9 3143->3165 3145 401c11 3146 402aa9 17 API calls 3145->3146 3147 401c1e 3146->3147 3148 401c33 3147->3148 3149 402acb 17 API calls 3147->3149 3150 401c43 3148->3150 3151 402acb 17 API calls 3148->3151 3149->3148 3152 401c9a 3150->3152 3153 401c4e 3150->3153 3151->3150 3154 402acb 17 API calls 3152->3154 3155 402aa9 17 API calls 3153->3155 3156 401c9f 3154->3156 3157 401c53 3155->3157 3158 402acb 17 API calls 3156->3158 3159 402aa9 17 API calls 3157->3159 3160 401ca8 FindWindowExA 3158->3160 3161 401c5f 3159->3161 3164 401cc6 3160->3164 3162 401c8a SendMessageA 3161->3162 3163 401c6c SendMessageTimeoutA 3161->3163 3162->3164 3163->3164 3166 405f8c 17 API calls 3165->3166 3167 402abe 3166->3167 3167->3145 4282 404a0e GetDlgItem GetDlgItem 4283 404a60 7 API calls 4282->4283 4291 404c78 4282->4291 4284 404b03 DeleteObject 4283->4284 4285 404af6 SendMessageA 4283->4285 4286 404b0c 4284->4286 4285->4284 4287 404b43 4286->4287 4290 405f8c 17 API calls 4286->4290 4288 404009 18 API calls 4287->4288 4292 404b57 4288->4292 4289 404e08 4294 404e12 SendMessageA 4289->4294 4295 404e1a 4289->4295 4296 404b25 SendMessageA SendMessageA 4290->4296 4293 404d5c 4291->4293 4297 40495c 5 API calls 4291->4297 4316 404ce9 4291->4316 4298 404009 18 API calls 4292->4298 4293->4289 4299 404db5 SendMessageA 4293->4299 4325 404c6b 4293->4325 4294->4295 4302 404e33 4295->4302 4303 404e2c ImageList_Destroy 4295->4303 4319 404e43 4295->4319 4296->4286 4297->4316 4318 404b65 4298->4318 4304 404dca SendMessageA 4299->4304 4299->4325 4300 404070 8 API calls 4305 404ffe 4300->4305 4301 404d4e SendMessageA 4301->4293 4306 404e3c GlobalFree 4302->4306 4302->4319 4303->4302 4308 404ddd 4304->4308 4306->4319 4307 404c39 GetWindowLongA SetWindowLongA 4311 404c52 4307->4311 4320 404dee SendMessageA 4308->4320 4309 404fb2 4310 404fc4 ShowWindow GetDlgItem ShowWindow 4309->4310 4309->4325 4310->4325 4312 404c70 4311->4312 4313 404c58 ShowWindow 4311->4313 4334 40403e SendMessageA 4312->4334 4333 40403e SendMessageA 4313->4333 4316->4293 4316->4301 4317 404bb4 SendMessageA 4317->4318 4318->4307 4318->4317 4321 404c33 4318->4321 4322 404bf0 SendMessageA 4318->4322 4323 404c01 SendMessageA 4318->4323 4319->4309 4324 4049dc 4 API calls 4319->4324 4329 404e7e 4319->4329 4320->4289 4321->4307 4321->4311 4322->4318 4323->4318 4324->4329 4325->4300 4326 404f88 InvalidateRect 4326->4309 4327 404f9e 4326->4327 4335 404917 4327->4335 4328 404eac SendMessageA 4332 404ec2 4328->4332 4329->4328 4329->4332 4331 404f36 SendMessageA SendMessageA 4331->4332 4332->4326 4332->4331 4333->4325 4334->4291 4338 404852 4335->4338 4337 40492c 4337->4309 4339 404868 4338->4339 4340 405f8c 17 API calls 4339->4340 4341 4048cc 4340->4341 4342 405f8c 17 API calls 4341->4342 4343 4048d7 4342->4343 4344 405f8c 17 API calls 4343->4344 4345 4048ed lstrlenA wsprintfA SetDlgItemTextA 4344->4345 4345->4337 4346 401490 4347 405091 24 API calls 4346->4347 4348 401497 4347->4348 4349 406895 4351 40647a 4349->4351 4350 406de5 4351->4350 4352 406504 GlobalAlloc 4351->4352 4353 4064fb GlobalFree 4351->4353 4354 406572 GlobalFree 4351->4354 4355 40657b GlobalAlloc 4351->4355 4352->4350 4352->4351 4353->4352 4354->4355 4355->4350 4355->4351 4356 40449b 4357 4044c7 4356->4357 4358 4044d8 4356->4358 4417 40566a GetDlgItemTextA 4357->4417 4359 4044e4 GetDlgItem 4358->4359 4392 404543 4358->4392 4361 4044f8 4359->4361 4364 40450c SetWindowTextA 4361->4364 4368 40599b 4 API calls 4361->4368 4362 4044d2 4363 4061d4 5 API calls 4362->4363 4363->4358 4369 404009 18 API calls 4364->4369 4365 4047d1 4367 404070 8 API calls 4365->4367 4372 4047e5 4367->4372 4373 404502 4368->4373 4374 404528 4369->4374 4370 405f8c 17 API calls 4375 4045b7 SHBrowseForFolderA 4370->4375 4371 404657 4376 4059f0 18 API calls 4371->4376 4373->4364 4381 405902 3 API calls 4373->4381 4377 404009 18 API calls 4374->4377 4378 404627 4375->4378 4379 4045cf CoTaskMemFree 4375->4379 4380 40465d 4376->4380 4382 404536 4377->4382 4378->4365 4419 40566a GetDlgItemTextA 4378->4419 4383 405902 3 API calls 4379->4383 4420 405f6a lstrcpynA 4380->4420 4381->4364 4418 40403e SendMessageA 4382->4418 4386 4045dc 4383->4386 4388 404613 SetDlgItemTextA 4386->4388 4393 405f8c 17 API calls 4386->4393 4387 40453c 4390 406302 5 API calls 4387->4390 4388->4378 4389 404674 4391 406302 5 API calls 4389->4391 4390->4392 4400 40467b 4391->4400 4392->4365 4392->4370 4392->4378 4394 4045fb lstrcmpiA 4393->4394 4394->4388 4396 40460c lstrcatA 4394->4396 4395 4046b7 4421 405f6a lstrcpynA 4395->4421 4396->4388 4398 4046be 4399 40599b 4 API calls 4398->4399 4401 4046c4 GetDiskFreeSpaceA 4399->4401 4400->4395 4404 405949 2 API calls 4400->4404 4405 40470f 4400->4405 4403 4046e8 MulDiv 4401->4403 4401->4405 4403->4405 4404->4400 4406 404780 4405->4406 4407 404917 20 API calls 4405->4407 4408 4047a3 4406->4408 4410 40140b 2 API calls 4406->4410 4409 40476d 4407->4409 4422 40402b KiUserCallbackDispatcher 4408->4422 4411 404782 SetDlgItemTextA 4409->4411 4412 404772 4409->4412 4410->4408 4411->4406 4414 404852 20 API calls 4412->4414 4414->4406 4415 4047bf 4415->4365 4416 4043f4 SendMessageA 4415->4416 4416->4365 4417->4362 4418->4387 4419->4371 4420->4389 4421->4398 4422->4415 4423 401d9b GetDC 4424 402aa9 17 API calls 4423->4424 4425 401dad GetDeviceCaps MulDiv ReleaseDC 4424->4425 4426 402aa9 17 API calls 4425->4426 4427 401dde 4426->4427 4428 405f8c 17 API calls 4427->4428 4429 401e1b CreateFontIndirectA 4428->4429 4430 40257d 4429->4430 3837 40159d 3838 402acb 17 API calls 3837->3838 3839 4015a4 SetFileAttributesA 3838->3839 3840 4015b6 3839->3840 4431 40149d 4432 4014ab PostQuitMessage 4431->4432 4433 4022e7 4431->4433 4432->4433 4434 401a1e 4435 402acb 17 API calls 4434->4435 4436 401a27 ExpandEnvironmentStringsA 4435->4436 4437 401a3b 4436->4437 4439 401a4e 4436->4439 4438 401a40 lstrcmpA 4437->4438 4437->4439 4438->4439 4445 40171f 4446 402acb 17 API calls 4445->4446 4447 401726 SearchPathA 4446->4447 4448 401741 4447->4448 4449 401d20 4450 402aa9 17 API calls 4449->4450 4451 401d2e SetWindowLongA 4450->4451 4452 402957 4451->4452 3168 401e2b 3169 402aa9 17 API calls 3168->3169 3170 401e31 3169->3170 3171 402aa9 17 API calls 3170->3171 3172 401e3d 3171->3172 3173 401e54 EnableWindow 3172->3173 3174 401e49 ShowWindow 3172->3174 3175 402957 3173->3175 3174->3175 4467 401f31 4468 402acb 17 API calls 4467->4468 4469 401f38 4468->4469 4470 40626d 2 API calls 4469->4470 4471 401f3e 4470->4471 4473 401f50 4471->4473 4474 405ec8 wsprintfA 4471->4474 4474->4473 3258 401932 3259 401934 3258->3259 3260 402acb 17 API calls 3259->3260 3261 401939 3260->3261 3264 405732 3261->3264 3301 4059f0 3264->3301 3267 405771 3269 40589f 3267->3269 3315 405f6a lstrcpynA 3267->3315 3268 40575a DeleteFileA 3296 401942 3268->3296 3269->3296 3316 40626d FindFirstFileA 3269->3316 3271 405797 3272 4057aa 3271->3272 3273 40579d lstrcatA 3271->3273 3330 405949 lstrlenA 3272->3330 3275 4057b0 3273->3275 3278 4057be lstrcatA 3275->3278 3279 4057c9 lstrlenA FindFirstFileA 3275->3279 3278->3279 3279->3269 3299 4057ed 3279->3299 3282 40592d CharNextA 3282->3299 3285 4058f3 3289 405091 24 API calls 3285->3289 3286 4058dd 3291 405091 24 API calls 3286->3291 3286->3296 3287 40587e FindNextFileA 3290 405896 FindClose 3287->3290 3287->3299 3289->3296 3290->3269 3292 4058ea 3291->3292 3293 405d49 36 API calls 3292->3293 3293->3296 3294 4056ea 5 API calls 3294->3299 3295 405732 60 API calls 3295->3299 3297 405091 24 API calls 3297->3287 3298 405091 24 API calls 3298->3299 3299->3282 3299->3287 3299->3294 3299->3295 3299->3297 3299->3298 3334 405f6a lstrcpynA 3299->3334 3335 405d49 MoveFileExA 3299->3335 3340 405f6a lstrcpynA 3301->3340 3303 405a01 3341 40599b CharNextA CharNextA 3303->3341 3306 405752 3306->3267 3306->3268 3307 4061d4 5 API calls 3312 405a17 3307->3312 3308 405a42 lstrlenA 3309 405a4d 3308->3309 3308->3312 3311 405902 3 API calls 3309->3311 3310 40626d 2 API calls 3310->3312 3313 405a52 GetFileAttributesA 3311->3313 3312->3306 3312->3308 3312->3310 3314 405949 2 API calls 3312->3314 3313->3306 3314->3308 3315->3271 3317 406283 FindClose 3316->3317 3318 4058c3 3316->3318 3317->3318 3318->3296 3319 405902 lstrlenA CharPrevA 3318->3319 3320 4058cd 3319->3320 3321 40591c lstrcatA 3319->3321 3322 4056ea 3320->3322 3321->3320 3347 405ade GetFileAttributesA 3322->3347 3325 405717 3325->3285 3325->3286 3326 405705 RemoveDirectoryA 3328 405713 3326->3328 3327 40570d DeleteFileA 3327->3328 3328->3325 3329 405723 SetFileAttributesA 3328->3329 3329->3325 3331 405956 3330->3331 3332 405967 3331->3332 3333 40595b CharPrevA 3331->3333 3332->3275 3333->3331 3333->3332 3334->3299 3336 405d6c 3335->3336 3337 405d5d 3335->3337 3336->3299 3350 405bd9 3337->3350 3340->3303 3342 4059b6 3341->3342 3345 4059c6 3341->3345 3344 4059c1 CharNextA 3342->3344 3342->3345 3343 4059e6 3343->3306 3343->3307 3344->3343 3345->3343 3346 40592d CharNextA 3345->3346 3346->3345 3348 405af0 SetFileAttributesA 3347->3348 3349 4056f6 3347->3349 3348->3349 3349->3325 3349->3326 3349->3327 3351 405c25 GetShortPathNameA 3350->3351 3352 405bff 3350->3352 3353 405d44 3351->3353 3354 405c3a 3351->3354 3377 405b03 GetFileAttributesA CreateFileA 3352->3377 3353->3336 3354->3353 3357 405c42 wsprintfA 3354->3357 3356 405c09 CloseHandle GetShortPathNameA 3356->3353 3358 405c1d 3356->3358 3359 405f8c 17 API calls 3357->3359 3358->3351 3358->3353 3360 405c6a 3359->3360 3378 405b03 GetFileAttributesA CreateFileA 3360->3378 3362 405c77 3362->3353 3363 405c86 GetFileSize GlobalAlloc 3362->3363 3364 405ca8 3363->3364 3365 405d3d CloseHandle 3363->3365 3379 405b7b ReadFile 3364->3379 3365->3353 3370 405cc7 lstrcpyA 3373 405ce9 3370->3373 3371 405cdb 3372 405a68 4 API calls 3371->3372 3372->3373 3374 405d20 SetFilePointer 3373->3374 3386 405baa WriteFile 3374->3386 3377->3356 3378->3362 3380 405b99 3379->3380 3380->3365 3381 405a68 lstrlenA 3380->3381 3382 405aa9 lstrlenA 3381->3382 3383 405ab1 3382->3383 3384 405a82 lstrcmpiA 3382->3384 3383->3370 3383->3371 3384->3383 3385 405aa0 CharNextA 3384->3385 3385->3382 3387 405bc8 GlobalFree 3386->3387 3387->3365 4475 402932 SendMessageA 4476 402957 4475->4476 4477 40294c InvalidateRect 4475->4477 4477->4476 3388 403b35 3389 403c88 3388->3389 3390 403b4d 3388->3390 3392 403c99 GetDlgItem GetDlgItem 3389->3392 3407 403cd9 3389->3407 3390->3389 3391 403b59 3390->3391 3394 403b64 SetWindowPos 3391->3394 3395 403b77 3391->3395 3393 404009 18 API calls 3392->3393 3398 403cc3 SetClassLongA 3393->3398 3394->3395 3396 403b94 3395->3396 3397 403b7c ShowWindow 3395->3397 3401 403bb6 3396->3401 3402 403b9c DestroyWindow 3396->3402 3397->3396 3403 40140b 2 API calls 3398->3403 3399 403d33 3400 404055 SendMessageA 3399->3400 3405 403c83 3399->3405 3426 403d45 3400->3426 3408 403bbb SetWindowLongA 3401->3408 3409 403bcc 3401->3409 3406 403f92 3402->3406 3403->3407 3404 401389 2 API calls 3410 403d0b 3404->3410 3406->3405 3416 403fc3 ShowWindow 3406->3416 3407->3399 3407->3404 3408->3405 3412 403c43 3409->3412 3413 403bd8 GetDlgItem 3409->3413 3410->3399 3414 403d0f SendMessageA 3410->3414 3411 403f94 DestroyWindow EndDialog 3411->3406 3419 404070 8 API calls 3412->3419 3417 403c08 3413->3417 3418 403beb SendMessageA IsWindowEnabled 3413->3418 3414->3405 3415 40140b 2 API calls 3415->3426 3416->3405 3421 403c15 3417->3421 3424 403c5c SendMessageA 3417->3424 3425 403c28 3417->3425 3431 403c0d 3417->3431 3418->3405 3418->3417 3419->3405 3420 405f8c 17 API calls 3420->3426 3421->3424 3421->3431 3422 403fe2 SendMessageA 3422->3412 3423 404009 18 API calls 3423->3426 3424->3412 3427 403c30 3425->3427 3428 403c45 3425->3428 3426->3405 3426->3411 3426->3415 3426->3420 3426->3423 3432 404009 18 API calls 3426->3432 3448 403ed4 DestroyWindow 3426->3448 3463 40140b 3427->3463 3430 40140b 2 API calls 3428->3430 3430->3431 3431->3412 3431->3422 3433 403dc0 GetDlgItem 3432->3433 3434 403dd5 3433->3434 3435 403ddd ShowWindow KiUserCallbackDispatcher 3433->3435 3434->3435 3457 40402b KiUserCallbackDispatcher 3435->3457 3437 403e07 KiUserCallbackDispatcher 3442 403e1b 3437->3442 3438 403e20 GetSystemMenu EnableMenuItem SendMessageA 3439 403e50 SendMessageA 3438->3439 3438->3442 3439->3442 3442->3438 3458 40403e SendMessageA 3442->3458 3459 403b16 3442->3459 3462 405f6a lstrcpynA 3442->3462 3444 403e7f lstrlenA 3445 405f8c 17 API calls 3444->3445 3446 403e90 SetWindowTextA 3445->3446 3447 401389 2 API calls 3446->3447 3447->3426 3448->3406 3449 403eee CreateDialogParamA 3448->3449 3449->3406 3450 403f21 3449->3450 3451 404009 18 API calls 3450->3451 3452 403f2c GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3451->3452 3453 401389 2 API calls 3452->3453 3454 403f72 3453->3454 3454->3405 3455 403f7a ShowWindow 3454->3455 3456 404055 SendMessageA 3455->3456 3456->3406 3457->3437 3458->3442 3460 405f8c 17 API calls 3459->3460 3461 403b24 SetWindowTextA 3460->3461 3461->3442 3462->3444 3464 401389 2 API calls 3463->3464 3465 401420 3464->3465 3465->3431 4485 4014b7 4486 4014bd 4485->4486 4487 401389 2 API calls 4486->4487 4488 4014c5 4487->4488 4489 4026ba 4490 4026c0 4489->4490 4491 402957 4490->4491 4492 4026c8 FindClose 4490->4492 4492->4491 3817 4015bb 3818 402acb 17 API calls 3817->3818 3819 4015c2 3818->3819 3820 40599b 4 API calls 3819->3820 3832 4015ca 3820->3832 3821 401624 3823 401652 3821->3823 3824 401629 3821->3824 3822 40592d CharNextA 3822->3832 3826 401423 24 API calls 3823->3826 3825 401423 24 API calls 3824->3825 3827 401630 3825->3827 3834 40164a 3826->3834 3836 405f6a lstrcpynA 3827->3836 3828 4055d4 2 API calls 3828->3832 3830 4055f1 5 API calls 3830->3832 3831 40163b SetCurrentDirectoryA 3831->3834 3832->3821 3832->3822 3832->3828 3832->3830 3833 40160c GetFileAttributesA 3832->3833 3835 405557 4 API calls 3832->3835 3833->3832 3835->3832 3836->3831 4493 4016bb 4494 402acb 17 API calls 4493->4494 4495 4016c1 GetFullPathNameA 4494->4495 4496 4016d8 4495->4496 4497 4016f9 4495->4497 4496->4497 4500 40626d 2 API calls 4496->4500 4498 402957 4497->4498 4499 40170d GetShortPathNameA 4497->4499 4499->4498 4501 4016e9 4500->4501 4501->4497 4503 405f6a lstrcpynA 4501->4503 4503->4497 4504 40273c 4505 402acb 17 API calls 4504->4505 4507 40274a 4505->4507 4506 402760 4509 405ade 2 API calls 4506->4509 4507->4506 4508 402acb 17 API calls 4507->4508 4508->4506 4510 402766 4509->4510 4532 405b03 GetFileAttributesA CreateFileA 4510->4532 4512 402773 4513 40281c 4512->4513 4514 40277f GlobalAlloc 4512->4514 4517 402824 DeleteFileA 4513->4517 4518 402837 4513->4518 4515 402813 CloseHandle 4514->4515 4516 402798 4514->4516 4515->4513 4533 40318e SetFilePointer 4516->4533 4517->4518 4520 40279e 4521 403178 ReadFile 4520->4521 4522 4027a7 GlobalAlloc 4521->4522 4523 4027f1 4522->4523 4524 4027b7 4522->4524 4525 405baa WriteFile 4523->4525 4526 402f9c 35 API calls 4524->4526 4527 4027fd GlobalFree 4525->4527 4529 4027c4 4526->4529 4528 402f9c 35 API calls 4527->4528 4531 402810 4528->4531 4530 4027e8 GlobalFree 4529->4530 4530->4523 4531->4515 4532->4512 4533->4520 4534 40283d 4535 402aa9 17 API calls 4534->4535 4536 402843 4535->4536 4537 402882 4536->4537 4538 40286b 4536->4538 4545 40271c 4536->4545 4541 40289c 4537->4541 4542 40288c 4537->4542 4539 402870 4538->4539 4540 40287f 4538->4540 4548 405f6a lstrcpynA 4539->4548 4549 405ec8 wsprintfA 4540->4549 4544 405f8c 17 API calls 4541->4544 4543 402aa9 17 API calls 4542->4543 4543->4545 4544->4545 4548->4545 4549->4545 3841 4036be 3842 4036d6 3841->3842 3843 4036c8 CloseHandle 3841->3843 3848 403703 3842->3848 3843->3842 3846 405732 67 API calls 3847 4036e7 3846->3847 3849 403711 3848->3849 3850 4036db 3849->3850 3851 403716 FreeLibrary GlobalFree 3849->3851 3850->3846 3851->3850 3851->3851 4550 40413f lstrcpynA lstrlenA 4551 401b3f 4552 402acb 17 API calls 4551->4552 4553 401b46 4552->4553 4554 402aa9 17 API calls 4553->4554 4555 401b4f wsprintfA 4554->4555 4556 402957 4555->4556

                                                                                        Executed Functions

                                                                                        Function 004031D6 Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 366stringcomfileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 0 4031d6-403215 SetErrorMode GetVersion 1 403217-40321f call 406302 0->1 2 403228 0->2 1->2 7 403221 1->7 4 40322d-403240 call 406294 lstrlenA 2->4 9 403242-40325e call 406302 * 3 4->9 7->2 16 403260-403266 9->16 17 40326f-4032cd #17 OleInitialize SHGetFileInfoA call 405f6a GetCommandLineA call 405f6a 9->17 16->17 21 403268 16->21 24 4032d9-4032ee call 40592d CharNextA 17->24 25 4032cf-4032d4 17->25 21->17 28 4033b3-4033b7 24->28 25->24 29 4032f3-4032f6 28->29 30 4033bd 28->30 31 4032f8-4032fc 29->31 32 4032fe-403306 29->32 33 4033d0-4033ea GetTempPathA call 4031a5 30->33 31->31 31->32 34 403308-403309 32->34 35 40330e-403311 32->35 42 403442-40345c DeleteFileA call 402d63 33->42 43 4033ec-40340a GetWindowsDirectoryA lstrcatA call 4031a5 33->43 34->35 37 4033a3-4033b0 call 40592d 35->37 38 403317-40331b 35->38 37->28 53 4033b2 37->53 40 403333-403360 38->40 41 40331d-403323 38->41 47 403362-403368 40->47 48 403373-4033a1 40->48 45 403325-403327 41->45 46 403329 41->46 58 4034f0-403500 ExitProcess OleUninitialize 42->58 59 403462-403468 42->59 43->42 61 40340c-40343c GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 4031a5 43->61 45->40 45->46 46->40 54 40336a-40336c 47->54 55 40336e 47->55 48->37 57 4033bf-4033cb call 405f6a 48->57 53->28 54->48 54->55 55->48 57->33 64 403624-40362a 58->64 65 403506-403516 call 405686 ExitProcess 58->65 62 4034e0-4034e7 call 403798 59->62 63 40346a-403475 call 40592d 59->63 61->42 61->58 73 4034ec 62->73 80 403477-4034a0 63->80 81 4034ab-4034b5 63->81 70 4036a6-4036ae 64->70 71 40362c-403645 GetCurrentProcess OpenProcessToken 64->71 75 4036b0 70->75 76 4036b4-4036b8 ExitProcess 70->76 78 403677-403685 call 406302 71->78 79 403647-403671 LookupPrivilegeValueA AdjustTokenPrivileges 71->79 73->58 75->76 90 403693-40369d ExitWindowsEx 78->90 91 403687-403691 78->91 79->78 83 4034a2-4034a4 80->83 84 4034b7-4034c4 call 4059f0 81->84 85 40351c-403530 call 4055f1 lstrcatA 81->85 83->81 87 4034a6-4034a9 83->87 84->58 99 4034c6-4034dc call 405f6a * 2 84->99 97 403532-403538 lstrcatA 85->97 98 40353d-403557 lstrcatA lstrcmpiA 85->98 87->81 87->83 90->70 92 40369f-4036a1 call 40140b 90->92 91->90 91->92 92->70 97->98 98->58 100 403559-40355c 98->100 99->62 102 403565 call 4055d4 100->102 103 40355e-403563 call 405557 100->103 110 40356a-403577 SetCurrentDirectoryA 102->110 103->110 111 403584-4035ac call 405f6a 110->111 112 403579-40357f call 405f6a 110->112 116 4035b2-4035ce call 405f8c DeleteFileA 111->116 112->111 119 4035d0-4035e0 CopyFileA 116->119 120 40360f-403616 116->120 119->120 122 4035e2-4035fb call 405d49 call 405f8c call 405609 119->122 120->116 121 403618-40361f call 405d49 120->121 121->58 130 403600-403602 122->130 130->120 131 403604-40360b CloseHandle 130->131 131->120
                                                                                        APIs
                                                                                        • SetErrorMode.KERNEL32 ref: 004031FB
                                                                                        • GetVersion.KERNEL32 ref: 00403201
                                                                                        • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403234
                                                                                        • #17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403270
                                                                                        • OleInitialize.OLE32(00000000), ref: 00403277
                                                                                        • SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 00403293
                                                                                        • GetCommandLineA.KERNEL32(00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 004032A8
                                                                                        • CharNextA.USER32(00000000,"C:\Users\user\Desktop\Wave Browser.exe",00000020,"C:\Users\user\Desktop\Wave Browser.exe",00000000,?,00000006,00000008,0000000A), ref: 004032E4
                                                                                        • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 004033E1
                                                                                        • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004033F2
                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004033FE
                                                                                        • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403412
                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040341A
                                                                                        • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040342B
                                                                                        • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403433
                                                                                        • DeleteFileA.KERNEL32(1033,?,00000006,00000008,0000000A), ref: 00403447
                                                                                          • Part of subcall function 00406302: GetModuleHandleA.KERNEL32(?,?,?,00403249,0000000A), ref: 00406314
                                                                                          • Part of subcall function 00406302: GetProcAddress.KERNEL32(00000000,?), ref: 0040632F
                                                                                          • Part of subcall function 00403798: lstrlenA.KERNEL32(Delete on reboot: ,?,?,?,Delete on reboot: ,00000000,C:\Users\user\Wavesor Software\WaveBrowser,1033,WaveBrowser Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,WaveBrowser Setup: Installing,00000000,00000002,74DF3410), ref: 00403888
                                                                                          • Part of subcall function 00403798: lstrcmpiA.KERNEL32(?,.exe), ref: 0040389B
                                                                                          • Part of subcall function 00403798: GetFileAttributesA.KERNEL32(Delete on reboot: ), ref: 004038A6
                                                                                          • Part of subcall function 00403798: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\Wavesor Software\WaveBrowser), ref: 004038EF
                                                                                          • Part of subcall function 00403798: RegisterClassA.USER32(00422EA0), ref: 0040392C
                                                                                        • ExitProcess.KERNEL32(?,?,00000006,00000008,0000000A), ref: 004034F0
                                                                                          • Part of subcall function 004036BE: CloseHandle.KERNEL32(FFFFFFFF,004034F5,?,?,00000006,00000008,0000000A), ref: 004036C9
                                                                                        • OleUninitialize.OLE32(?,?,00000006,00000008,0000000A), ref: 004034F5
                                                                                        • ExitProcess.KERNEL32 ref: 00403516
                                                                                        • GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 00403633
                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 0040363A
                                                                                        • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403652
                                                                                        • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403671
                                                                                        • ExitWindowsEx.USER32(00000002,80040002), ref: 00403695
                                                                                        • ExitProcess.KERNEL32 ref: 004036B8
                                                                                          • Part of subcall function 00405686: MessageBoxIndirectA.USER32(00409218), ref: 004056E1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$Exit$File$EnvironmentHandlePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
                                                                                        • String ID: "$"C:\Users\user\Desktop\Wave Browser.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nstDC9E.tmp$C:\Users\user\Desktop$C:\Users\user\Desktop\Wave Browser.exe$C:\Users\user\Wavesor Software\WaveBrowser$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`Kt$~nsu
                                                                                        • API String ID: 562314493-388903188
                                                                                        • Opcode ID: 483ba3a7cdb34d638443db681a1ca3900c5ad5cf2d027fabf9b326830b4d936e
                                                                                        • Instruction ID: 9e312bc3f5d3d37e61d45afab2cefd1cff230aa7333539c56d086af75f350ab7
                                                                                        • Opcode Fuzzy Hash: 483ba3a7cdb34d638443db681a1ca3900c5ad5cf2d027fabf9b326830b4d936e
                                                                                        • Instruction Fuzzy Hash: 90C106706082426AE7216F719D4DB2B3EACEB85706F04457FF581B61E2C77C8A05CB2E
                                                                                        Function 004051CF Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 282windowclipboardmemoryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 132 4051cf-4051eb 133 4051f1-4052b8 GetDlgItem * 3 call 40403e call 40492f GetClientRect GetSystemMetrics SendMessageA * 2 132->133 134 40537a-405380 132->134 156 4052d6-4052d9 133->156 157 4052ba-4052d4 SendMessageA * 2 133->157 136 405382-4053a4 GetDlgItem CreateThread CloseHandle 134->136 137 4053aa-4053b6 134->137 136->137 139 4053d8-4053de 137->139 140 4053b8-4053be 137->140 144 4053e0-4053e6 139->144 145 405433-405436 139->145 142 4053c0-4053d3 ShowWindow * 2 call 40403e 140->142 143 4053f9-405400 call 404070 140->143 142->139 153 405405-405409 143->153 150 4053e8-4053f4 call 403fe2 144->150 151 40540c-40541c ShowWindow 144->151 145->143 148 405438-40543e 145->148 148->143 158 405440-405453 SendMessageA 148->158 150->143 154 40542c-40542e call 403fe2 151->154 155 40541e-405427 call 405091 151->155 154->145 155->154 161 4052e9-405300 call 404009 156->161 162 4052db-4052e7 SendMessageA 156->162 157->156 163 405550-405552 158->163 164 405459-405485 CreatePopupMenu call 405f8c AppendMenuA 158->164 169 405302-405316 ShowWindow 161->169 170 405336-405357 GetDlgItem SendMessageA 161->170 162->161 163->153 171 405487-405497 GetWindowRect 164->171 172 40549a-4054b0 TrackPopupMenu 164->172 173 405325 169->173 174 405318-405323 ShowWindow 169->174 170->163 176 40535d-405375 SendMessageA * 2 170->176 171->172 172->163 175 4054b6-4054d0 172->175 177 40532b-405331 call 40403e 173->177 174->177 178 4054d5-4054f0 SendMessageA 175->178 176->163 177->170 178->178 179 4054f2-405512 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 178->179 181 405514-405534 SendMessageA 179->181 181->181 182 405536-40554a GlobalUnlock SetClipboardData CloseClipboard 181->182 182->163
                                                                                        APIs
                                                                                        • GetDlgItem.USER32(?,00000403), ref: 0040522E
                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 0040523D
                                                                                        • GetClientRect.USER32(?,?), ref: 0040527A
                                                                                        • GetSystemMetrics.USER32(00000002), ref: 00405281
                                                                                        • SendMessageA.USER32(?,0000101B,00000000,?), ref: 004052A2
                                                                                        • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004052B3
                                                                                        • SendMessageA.USER32(?,00001001,00000000,?), ref: 004052C6
                                                                                        • SendMessageA.USER32(?,00001026,00000000,?), ref: 004052D4
                                                                                        • SendMessageA.USER32(?,00001024,00000000,?), ref: 004052E7
                                                                                        • ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405309
                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040531D
                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 0040533E
                                                                                        • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040534E
                                                                                        • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405367
                                                                                        • SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405373
                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 0040524C
                                                                                          • Part of subcall function 0040403E: SendMessageA.USER32(00000028,?,00000001,00403E6E), ref: 0040404C
                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 0040538F
                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_00005163,00000000), ref: 0040539D
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004053A4
                                                                                        • ShowWindow.USER32(00000000), ref: 004053C7
                                                                                        • ShowWindow.USER32(?,00000008), ref: 004053CE
                                                                                        • ShowWindow.USER32(00000008), ref: 00405414
                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405448
                                                                                        • CreatePopupMenu.USER32 ref: 00405459
                                                                                        • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 0040546E
                                                                                        • GetWindowRect.USER32(?,000000FF), ref: 0040548E
                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004054A7
                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 004054E3
                                                                                        • OpenClipboard.USER32(00000000), ref: 004054F3
                                                                                        • EmptyClipboard.USER32 ref: 004054F9
                                                                                        • GlobalAlloc.KERNEL32(00000042,?), ref: 00405502
                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0040550C
                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405520
                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00405539
                                                                                        • SetClipboardData.USER32(00000001,00000000), ref: 00405544
                                                                                        • CloseClipboard.USER32 ref: 0040554A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                        • String ID: DS$WaveBrowser Setup: Installing
                                                                                        • API String ID: 590372296-2651666588
                                                                                        • Opcode ID: 3a9281ed8a789c1f11ab91822155f9eb880975752d287774625736a89b1e06cb
                                                                                        • Instruction ID: 0e806a1c10c1a3103ec1b6ff030541c572903ae85d70ab094f2e75f2d1af7317
                                                                                        • Opcode Fuzzy Hash: 3a9281ed8a789c1f11ab91822155f9eb880975752d287774625736a89b1e06cb
                                                                                        • Instruction Fuzzy Hash: ABA15AB1900209BFDB219FA4DD89AAE7F79FB04355F10403AFA04B62A0C7B55E41DF69
                                                                                        Function 00405732 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 491 405732-405758 call 4059f0 494 405771-405778 491->494 495 40575a-40576c DeleteFileA 491->495 496 40577a-40577c 494->496 497 40578b-40579b call 405f6a 494->497 498 4058fb-4058ff 495->498 499 405782-405785 496->499 500 4058a9-4058ae 496->500 504 4057aa-4057ab call 405949 497->504 505 40579d-4057a8 lstrcatA 497->505 499->497 499->500 500->498 503 4058b0-4058b3 500->503 506 4058b5-4058bb 503->506 507 4058bd-4058c5 call 40626d 503->507 509 4057b0-4057b3 504->509 505->509 506->498 507->498 514 4058c7-4058db call 405902 call 4056ea 507->514 512 4057b5-4057bc 509->512 513 4057be-4057c4 lstrcatA 509->513 512->513 515 4057c9-4057e7 lstrlenA FindFirstFileA 512->515 513->515 530 4058f3-4058f6 call 405091 514->530 531 4058dd-4058e0 514->531 517 4057ed-405804 call 40592d 515->517 518 40589f-4058a3 515->518 525 405806-40580a 517->525 526 40580f-405812 517->526 518->500 520 4058a5 518->520 520->500 525->526 527 40580c 525->527 528 405814-405819 526->528 529 405825-405833 call 405f6a 526->529 527->526 532 40581b-40581d 528->532 533 40587e-405890 FindNextFileA 528->533 541 405835-40583d 529->541 542 40584a-405855 call 4056ea 529->542 530->498 531->506 535 4058e2-4058f1 call 405091 call 405d49 531->535 532->529 537 40581f-405823 532->537 533->517 539 405896-405899 FindClose 533->539 535->498 537->529 537->533 539->518 541->533 544 40583f-405848 call 405732 541->544 551 405876-405879 call 405091 542->551 552 405857-40585a 542->552 544->533 551->533 553 40585c-40586c call 405091 call 405d49 552->553 554 40586e-405874 552->554 553->533 554->533
                                                                                        APIs
                                                                                        • DeleteFileA.KERNEL32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040575B
                                                                                        • lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057A3
                                                                                        • lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057C4
                                                                                        • lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057CA
                                                                                        • FindFirstFileA.KERNEL32(00420D10,?,?,?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057DB
                                                                                        • FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405888
                                                                                        • FindClose.KERNEL32(00000000), ref: 00405899
                                                                                        Strings
                                                                                        • "C:\Users\user\Desktop\Wave Browser.exe", xrefs: 00405732
                                                                                        • \*.*, xrefs: 0040579D
                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 0040573F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                        • String ID: "C:\Users\user\Desktop\Wave Browser.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
                                                                                        • API String ID: 2035342205-401770328
                                                                                        • Opcode ID: f68f1787a7535e61b3df604e6a8492ba07a213b852bbd40fa4bcb335dd7bb391
                                                                                        • Instruction ID: 4530166bbd706fa81c440e6583376772d6fc270faa34d54a03d6882d8fc6be8c
                                                                                        • Opcode Fuzzy Hash: f68f1787a7535e61b3df604e6a8492ba07a213b852bbd40fa4bcb335dd7bb391
                                                                                        • Instruction Fuzzy Hash: 7351B332904A09BADB216B728C45BAF7A78DF42714F14817BF841B11D2D73C8952DEA9
                                                                                        Function 004065F6 Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 48b772c591d60bd120ceb21c558333e6da892a782e2c7f4c33aa573d96a0a8bb
                                                                                        • Instruction ID: 5cdea38fe39661480990cc8a004f6d9d9bf1a0cca829e9caf547f016d39c1b54
                                                                                        • Opcode Fuzzy Hash: 48b772c591d60bd120ceb21c558333e6da892a782e2c7f4c33aa573d96a0a8bb
                                                                                        • Instruction Fuzzy Hash: 7BF17475D00229CBDF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7385A86CF44
                                                                                        Function 0040626D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileA.KERNEL32(74DF3410,00421558,C:\,00405A33,C:\,C:\,00000000,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 00406278
                                                                                        • FindClose.KERNEL32(00000000), ref: 00406284
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Find$CloseFileFirst
                                                                                        • String ID: C:\
                                                                                        • API String ID: 2295610775-3404278061
                                                                                        • Opcode ID: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                                                                                        • Instruction ID: 4b5b4fac396428ba6811cbdb79132df6df7f7590a8a38978907140e3512fee8b
                                                                                        • Opcode Fuzzy Hash: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                                                                                        • Instruction Fuzzy Hash: 9AD012319190246BC3402B387D0C84B7B599B553317128B77F96BF16F0C3389C7286EA
                                                                                        Function 00403B35 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 346windowstringCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 183 403b35-403b47 184 403c88-403c97 183->184 185 403b4d-403b53 183->185 187 403ce6-403cfb 184->187 188 403c99-403ce1 GetDlgItem * 2 call 404009 SetClassLongA call 40140b 184->188 185->184 186 403b59-403b62 185->186 192 403b64-403b71 SetWindowPos 186->192 193 403b77-403b7a 186->193 190 403d3b-403d40 call 404055 187->190 191 403cfd-403d00 187->191 188->187 205 403d45-403d60 190->205 197 403d02-403d0d call 401389 191->197 198 403d33-403d35 191->198 192->193 194 403b94-403b9a 193->194 195 403b7c-403b8e ShowWindow 193->195 200 403bb6-403bb9 194->200 201 403b9c-403bb1 DestroyWindow 194->201 195->194 197->198 219 403d0f-403d2e SendMessageA 197->219 198->190 204 403fd6 198->204 209 403bbb-403bc7 SetWindowLongA 200->209 210 403bcc-403bd2 200->210 206 403fb3-403fb9 201->206 208 403fd8-403fdf 204->208 212 403d62-403d64 call 40140b 205->212 213 403d69-403d6f 205->213 206->204 214 403fbb-403fc1 206->214 209->208 217 403c75-403c83 call 404070 210->217 218 403bd8-403be9 GetDlgItem 210->218 212->213 215 403f94-403fad DestroyWindow EndDialog 213->215 216 403d75-403d80 213->216 214->204 221 403fc3-403fcc ShowWindow 214->221 215->206 216->215 222 403d86-403dd3 call 405f8c call 404009 * 3 GetDlgItem 216->222 217->208 223 403c08-403c0b 218->223 224 403beb-403c02 SendMessageA IsWindowEnabled 218->224 219->208 221->204 253 403dd5-403dda 222->253 254 403ddd-403e19 ShowWindow KiUserCallbackDispatcher call 40402b KiUserCallbackDispatcher 222->254 227 403c10-403c13 223->227 228 403c0d-403c0e 223->228 224->204 224->223 232 403c21-403c26 227->232 233 403c15-403c1b 227->233 231 403c3e-403c43 call 403fe2 228->231 231->217 236 403c5c-403c6f SendMessageA 232->236 238 403c28-403c2e 232->238 233->236 237 403c1d-403c1f 233->237 236->217 237->231 241 403c30-403c36 call 40140b 238->241 242 403c45-403c4e call 40140b 238->242 249 403c3c 241->249 242->217 251 403c50-403c5a 242->251 249->231 251->249 253->254 257 403e1b-403e1c 254->257 258 403e1e 254->258 259 403e20-403e4e GetSystemMenu EnableMenuItem SendMessageA 257->259 258->259 260 403e50-403e61 SendMessageA 259->260 261 403e63 259->261 262 403e69-403ea3 call 40403e call 403b16 call 405f6a lstrlenA call 405f8c SetWindowTextA call 401389 260->262 261->262 262->205 273 403ea9-403eab 262->273 273->205 274 403eb1-403eb5 273->274 275 403ed4-403ee8 DestroyWindow 274->275 276 403eb7-403ebd 274->276 275->206 278 403eee-403f1b CreateDialogParamA 275->278 276->204 277 403ec3-403ec9 276->277 277->205 279 403ecf 277->279 278->206 280 403f21-403f78 call 404009 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 278->280 279->204 280->204 285 403f7a-403f8d ShowWindow call 404055 280->285 287 403f92 285->287 287->206
                                                                                        APIs
                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B71
                                                                                        • ShowWindow.USER32(?), ref: 00403B8E
                                                                                        • DestroyWindow.USER32 ref: 00403BA2
                                                                                        • SetWindowLongA.USER32(?,00000000,00000000), ref: 00403BBE
                                                                                        • GetDlgItem.USER32(?,?), ref: 00403BDF
                                                                                        • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403BF3
                                                                                        • IsWindowEnabled.USER32(00000000), ref: 00403BFA
                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00403CA8
                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00403CB2
                                                                                        • SetClassLongA.USER32(?,000000F2,?), ref: 00403CCC
                                                                                        • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403D1D
                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00403DC3
                                                                                        • ShowWindow.USER32(00000000,?), ref: 00403DE4
                                                                                        • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403DF6
                                                                                        • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403E11
                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E27
                                                                                        • EnableMenuItem.USER32(00000000), ref: 00403E2E
                                                                                        • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403E46
                                                                                        • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403E59
                                                                                        • lstrlenA.KERNEL32(WaveBrowser Setup: Installing,?,WaveBrowser Setup: Installing,00000000), ref: 00403E83
                                                                                        • SetWindowTextA.USER32(?,WaveBrowser Setup: Installing), ref: 00403E92
                                                                                        • ShowWindow.USER32(?,0000000A), ref: 00403FC6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$Item$MessageSend$Show$CallbackDispatcherLongMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
                                                                                        • String ID: DS$WaveBrowser Setup: Installing
                                                                                        • API String ID: 1252290697-2651666588
                                                                                        • Opcode ID: 05387db83c01577c3a6776a36a7a5abe3735367355a95d1901617aca2af9034d
                                                                                        • Instruction ID: ece9219a4d70184b68c45d6c06b8272552e5c94251c83fd0e936414de4f8c744
                                                                                        • Opcode Fuzzy Hash: 05387db83c01577c3a6776a36a7a5abe3735367355a95d1901617aca2af9034d
                                                                                        • Instruction Fuzzy Hash: 7AC1C0B1A04205BBDB206F61EE48E2B3E7DFB45706F40453EF601B11E1C779A9429B6E
                                                                                        Function 00403798 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215stringregistryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 288 403798-4037b0 call 406302 291 4037b2-4037c2 call 405ec8 288->291 292 4037c4-4037f5 call 405e51 288->292 300 403818-403841 call 403a5d call 4059f0 291->300 296 4037f7-403808 call 405e51 292->296 297 40380d-403813 lstrcatA 292->297 296->297 297->300 306 403847-40384c 300->306 307 4038c8-4038d0 call 4059f0 300->307 306->307 308 40384e-403872 call 405e51 306->308 312 4038d2-4038d9 call 405f8c 307->312 313 4038de-403903 LoadImageA 307->313 308->307 318 403874-403876 308->318 312->313 316 403984-40398c call 40140b 313->316 317 403905-403935 RegisterClassA 313->317 331 403996-4039a1 call 403a5d 316->331 332 40398e-403991 316->332 321 403a53 317->321 322 40393b-40397f SystemParametersInfoA CreateWindowExA 317->322 319 403887-403893 lstrlenA 318->319 320 403878-403885 call 40592d 318->320 326 403895-4038a3 lstrcmpiA 319->326 327 4038bb-4038c3 call 405902 call 405f6a 319->327 320->319 325 403a55-403a5c 321->325 322->316 326->327 330 4038a5-4038af GetFileAttributesA 326->330 327->307 334 4038b1-4038b3 330->334 335 4038b5-4038b6 call 405949 330->335 341 4039a7-4039c1 ShowWindow call 406294 331->341 342 403a2a-403a2b call 405163 331->342 332->325 334->327 334->335 335->327 349 4039c3-4039c8 call 406294 341->349 350 4039cd-4039df GetClassInfoA 341->350 345 403a30-403a32 342->345 347 403a34-403a3a 345->347 348 403a4c-403a4e call 40140b 345->348 347->332 355 403a40-403a47 call 40140b 347->355 348->321 349->350 353 4039e1-4039f1 GetClassInfoA RegisterClassA 350->353 354 4039f7-403a1a DialogBoxParamA call 40140b 350->354 353->354 358 403a1f-403a28 call 4036e8 354->358 355->332 358->325
                                                                                        APIs
                                                                                          • Part of subcall function 00406302: GetModuleHandleA.KERNEL32(?,?,?,00403249,0000000A), ref: 00406314
                                                                                          • Part of subcall function 00406302: GetProcAddress.KERNEL32(00000000,?), ref: 0040632F
                                                                                        • lstrcatA.KERNEL32(1033,WaveBrowser Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,WaveBrowser Setup: Installing,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Wave Browser.exe",00000000), ref: 00403813
                                                                                        • lstrlenA.KERNEL32(Delete on reboot: ,?,?,?,Delete on reboot: ,00000000,C:\Users\user\Wavesor Software\WaveBrowser,1033,WaveBrowser Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,WaveBrowser Setup: Installing,00000000,00000002,74DF3410), ref: 00403888
                                                                                        • lstrcmpiA.KERNEL32(?,.exe), ref: 0040389B
                                                                                        • GetFileAttributesA.KERNEL32(Delete on reboot: ), ref: 004038A6
                                                                                        • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\Wavesor Software\WaveBrowser), ref: 004038EF
                                                                                          • Part of subcall function 00405EC8: wsprintfA.USER32 ref: 00405ED5
                                                                                        • RegisterClassA.USER32(00422EA0), ref: 0040392C
                                                                                        • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403944
                                                                                        • CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403979
                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 004039AF
                                                                                        • GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004039DB
                                                                                        • GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004039E8
                                                                                        • RegisterClassA.USER32(00422EA0), ref: 004039F1
                                                                                        • DialogBoxParamA.USER32(?,00000000,00403B35,00000000), ref: 00403A10
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                        • String ID: "C:\Users\user\Desktop\Wave Browser.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Wavesor Software\WaveBrowser$Control Panel\Desktop\ResourceLocale$Delete on reboot: $RichEd20$RichEd32$RichEdit$RichEdit20A$WaveBrowser Setup: Installing$_Nb
                                                                                        • API String ID: 1975747703-3278341199
                                                                                        • Opcode ID: dface4e9632d23add9968eb1af687a71e183a8757a236420549c2432d96a325f
                                                                                        • Instruction ID: adaaead87af2f4bee353d1c72736fa47975a157a90096c49b539272413637961
                                                                                        • Opcode Fuzzy Hash: dface4e9632d23add9968eb1af687a71e183a8757a236420549c2432d96a325f
                                                                                        • Instruction Fuzzy Hash: 1961D7B1744200BED720BF619D45F3B3AACEB4475AF40447EF941B22E1C67C9D069A2E
                                                                                        Function 00402D63 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 362 402d63-402db1 GetTickCount GetModuleFileNameA call 405b03 365 402db3-402db8 362->365 366 402dbd-402deb call 405f6a call 405949 call 405f6a GetFileSize 362->366 367 402f95-402f99 365->367 374 402df1 366->374 375 402ed8-402ee6 call 402cff 366->375 377 402df6-402e0d 374->377 382 402ee8-402eeb 375->382 383 402f3b-402f40 375->383 378 402e11-402e1a call 403178 377->378 379 402e0f 377->379 388 402e20-402e27 378->388 389 402f42-402f4a call 402cff 378->389 379->378 385 402eed-402f05 call 40318e call 403178 382->385 386 402f0f-402f39 GlobalAlloc call 40318e call 402f9c 382->386 383->367 385->383 408 402f07-402f0d 385->408 386->383 413 402f4c-402f5d 386->413 392 402ea3-402ea7 388->392 393 402e29-402e3d call 405abe 388->393 389->383 397 402eb1-402eb7 392->397 398 402ea9-402eb0 call 402cff 392->398 393->397 411 402e3f-402e46 393->411 404 402ec6-402ed0 397->404 405 402eb9-402ec3 call 4063b9 397->405 398->397 404->377 412 402ed6 404->412 405->404 408->383 408->386 411->397 415 402e48-402e4f 411->415 412->375 416 402f65-402f6a 413->416 417 402f5f 413->417 415->397 419 402e51-402e58 415->419 418 402f6b-402f71 416->418 417->416 418->418 420 402f73-402f8e SetFilePointer call 405abe 418->420 419->397 421 402e5a-402e61 419->421 424 402f93 420->424 421->397 423 402e63-402e83 421->423 423->383 425 402e89-402e8d 423->425 424->367 426 402e95-402e9d 425->426 427 402e8f-402e93 425->427 426->397 428 402e9f-402ea1 426->428 427->412 427->426 428->397
                                                                                        APIs
                                                                                        • GetTickCount.KERNEL32 ref: 00402D74
                                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Wave Browser.exe,00000400), ref: 00402D90
                                                                                          • Part of subcall function 00405B03: GetFileAttributesA.KERNEL32(00000003,00402DA3,C:\Users\user\Desktop\Wave Browser.exe,80000000,00000003), ref: 00405B07
                                                                                          • Part of subcall function 00405B03: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B29
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Wave Browser.exe,C:\Users\user\Desktop\Wave Browser.exe,80000000,00000003), ref: 00402DDC
                                                                                        Strings
                                                                                        • Null, xrefs: 00402E5A
                                                                                        • Inst, xrefs: 00402E48
                                                                                        • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F3B
                                                                                        • "C:\Users\user\Desktop\Wave Browser.exe", xrefs: 00402D63
                                                                                        • soft, xrefs: 00402E51
                                                                                        • C:\Users\user\Desktop\Wave Browser.exe, xrefs: 00402D7A, 00402D89, 00402D9D, 00402DBD
                                                                                        • Error launching installer, xrefs: 00402DB3
                                                                                        • C:\Users\user\Desktop, xrefs: 00402DBE, 00402DC3, 00402DC9
                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00402D6A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                                                        • String ID: "C:\Users\user\Desktop\Wave Browser.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Wave Browser.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
                                                                                        • API String ID: 4283519449-4190609545
                                                                                        • Opcode ID: 1397dd72d6c115af7393f493c685ca3f8ebbcff4dac0a2af7d9ad0e79a19b9bb
                                                                                        • Instruction ID: 2e32d7aad0b4ca297083aa7498b96cb894cc3d31802a5233eda7db803f364c93
                                                                                        • Opcode Fuzzy Hash: 1397dd72d6c115af7393f493c685ca3f8ebbcff4dac0a2af7d9ad0e79a19b9bb
                                                                                        • Instruction Fuzzy Hash: CB51D6B1900215ABDB219F65DE89B9F7AB8EB04365F10403BF904B62D1C7BC9E418B9D
                                                                                        Function 00405F8C Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 199stringCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 429 405f8c-405f97 430 405f99-405fa8 429->430 431 405faa-405fc0 429->431 430->431 432 4061b1-4061b5 431->432 433 405fc6-405fd1 431->433 435 405fe3-405fed 432->435 436 4061bb-4061c5 432->436 433->432 434 405fd7-405fde 433->434 434->432 435->436 437 405ff3-405ffa 435->437 438 4061d0-4061d1 436->438 439 4061c7-4061cb call 405f6a 436->439 440 406000-406034 437->440 441 4061a4 437->441 439->438 443 406151-406154 440->443 444 40603a-406044 440->444 445 4061a6-4061ac 441->445 446 4061ae-4061b0 441->446 449 406184-406187 443->449 450 406156-406159 443->450 447 406046-40604a 444->447 448 40605e 444->448 445->432 446->432 447->448 453 40604c-406050 447->453 456 406065-40606c 448->456 451 406195-4061a2 lstrlenA 449->451 452 406189-406190 call 405f8c 449->452 454 406169-406175 call 405f6a 450->454 455 40615b-406167 call 405ec8 450->455 451->432 452->451 453->448 458 406052-406056 453->458 467 40617a-406180 454->467 455->467 460 406071-406073 456->460 461 40606e-406070 456->461 458->448 463 406058-40605c 458->463 465 406075-406098 call 405e51 460->465 466 4060ac-4060af 460->466 461->460 463->456 477 406138-40613c 465->477 478 40609e-4060a7 call 405f8c 465->478 468 4060b1-4060bd GetSystemDirectoryA 466->468 469 4060bf-4060c2 466->469 467->451 471 406182 467->471 474 406133-406136 468->474 475 4060c4-4060d2 GetWindowsDirectoryA 469->475 476 40612f-406131 469->476 473 406149-40614f call 4061d4 471->473 473->451 474->473 474->477 475->476 476->474 479 4060d4-4060de 476->479 477->473 482 40613e-406144 lstrcatA 477->482 478->474 484 4060e0-4060e3 479->484 485 4060f8-40610e SHGetSpecialFolderLocation 479->485 482->473 484->485 487 4060e5-4060ec 484->487 488 406110-40612a SHGetPathFromIDListA CoTaskMemFree 485->488 489 40612c 485->489 490 4060f4-4060f6 487->490 488->474 488->489 489->476 490->474 490->485
                                                                                        APIs
                                                                                        • GetSystemDirectoryA.KERNEL32(Delete on reboot: ,00000400), ref: 004060B7
                                                                                        • GetWindowsDirectoryA.KERNEL32(Delete on reboot: ,00000400,?,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,004050C9,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000), ref: 004060CA
                                                                                        • SHGetSpecialFolderLocation.SHELL32(004050C9,00000000,?,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,004050C9,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000), ref: 00406106
                                                                                        • SHGetPathFromIDListA.SHELL32(00000000,Delete on reboot: ), ref: 00406114
                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00406120
                                                                                        • lstrcatA.KERNEL32(Delete on reboot: ,\Microsoft\Internet Explorer\Quick Launch), ref: 00406144
                                                                                        • lstrlenA.KERNEL32(Delete on reboot: ,?,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,004050C9,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,00000000,0040E8C0,00000000), ref: 00406196
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
                                                                                        • String ID: Delete on reboot: $Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                        • API String ID: 717251189-451700854
                                                                                        • Opcode ID: fdc6a5aa1746c55117902e6833992edfdaf1df66eec9c6c9a1b750bd381f8059
                                                                                        • Instruction ID: bb9011323e63b572c88625bc05a244510e37b0ede85a9af68ccf729595c90084
                                                                                        • Opcode Fuzzy Hash: fdc6a5aa1746c55117902e6833992edfdaf1df66eec9c6c9a1b750bd381f8059
                                                                                        • Instruction Fuzzy Hash: F661F171A00111AEDF219F24CC95BBA3BA5DB45301F16813BE943BA2D2C27C49A2CB5E
                                                                                        Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 560 401759-40177c call 402acb call 40596f 565 401786-401798 call 405f6a call 405902 lstrcatA 560->565 566 40177e-401784 call 405f6a 560->566 571 40179d-4017a3 call 4061d4 565->571 566->571 576 4017a8-4017ac 571->576 577 4017ae-4017b8 call 40626d 576->577 578 4017df-4017e2 576->578 585 4017ca-4017dc 577->585 586 4017ba-4017c8 CompareFileTime 577->586 580 4017e4-4017e5 call 405ade 578->580 581 4017ea-401806 call 405b03 578->581 580->581 588 401808-40180b 581->588 589 40187e-4018a7 call 405091 call 402f9c 581->589 585->578 586->585 591 401860-40186a call 405091 588->591 592 40180d-40184f call 405f6a * 2 call 405f8c call 405f6a call 405686 588->592 602 4018a9-4018ad 589->602 603 4018af-4018bb SetFileTime 589->603 604 401873-401879 591->604 592->576 624 401855-401856 592->624 602->603 607 4018c1-4018cc FindCloseChangeNotification 602->607 603->607 605 402960 604->605 611 402962-402966 605->611 609 4018d2-4018d5 607->609 610 402957-40295a 607->610 613 4018d7-4018e8 call 405f8c lstrcatA 609->613 614 4018ea-4018ed call 405f8c 609->614 610->605 620 4018f2-4022ec call 405686 613->620 614->620 620->610 620->611 624->604 626 401858-401859 624->626 626->591
                                                                                        APIs
                                                                                        • lstrcatA.KERNEL32(00000000,00000000,get,C:\Users\user\AppData\Local\Temp\nstDC9E.tmp,00000000,00000000,00000031), ref: 00401798
                                                                                        • CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,C:\Users\user\AppData\Local\Temp\nstDC9E.tmp,00000000,00000000,00000031), ref: 004017C2
                                                                                          • Part of subcall function 00405F6A: lstrcpynA.KERNEL32(?,?,00000400,004032A8,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F77
                                                                                          • Part of subcall function 00405091: lstrlenA.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000,?), ref: 004050CA
                                                                                          • Part of subcall function 00405091: lstrlenA.KERNEL32(004030CC,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000), ref: 004050DA
                                                                                          • Part of subcall function 00405091: lstrcatA.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,004030CC,004030CC,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,0040E8C0,00000000), ref: 004050ED
                                                                                          • Part of subcall function 00405091: SetWindowTextA.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\), ref: 004050FF
                                                                                          • Part of subcall function 00405091: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405125
                                                                                          • Part of subcall function 00405091: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040513F
                                                                                          • Part of subcall function 00405091: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040514D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\Wave\$C:\Users\user\AppData\Local\Temp\nstDC9E.tmp$C:\Users\user\AppData\Local\Temp\nstDC9E.tmp$get
                                                                                        • API String ID: 1941528284-2997272245
                                                                                        • Opcode ID: e05100f54101f6d3c895e7db8c6c988e4dd7c25176b0aabcd4c2f6528f85e43f
                                                                                        • Instruction ID: ccd8e90e53bd547ce555faf0a88c0b4db7f619f01c1663a473e2e99c851a8e73
                                                                                        • Opcode Fuzzy Hash: e05100f54101f6d3c895e7db8c6c988e4dd7c25176b0aabcd4c2f6528f85e43f
                                                                                        • Instruction Fuzzy Hash: D841A571A04516BECF107BB5CC45DAF76A8EF45369B20823BF521F20E1C77C8A418A6D
                                                                                        Function 00405091 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 627 405091-4050a6 628 40515c-405160 627->628 629 4050ac-4050be 627->629 630 4050c0-4050c4 call 405f8c 629->630 631 4050c9-4050d5 lstrlenA 629->631 630->631 633 4050f2-4050f6 631->633 634 4050d7-4050e7 lstrlenA 631->634 636 405105-405109 633->636 637 4050f8-4050ff SetWindowTextA 633->637 634->628 635 4050e9-4050ed lstrcatA 634->635 635->633 638 40510b-40514d SendMessageA * 3 636->638 639 40514f-405151 636->639 637->636 638->639 639->628 640 405153-405156 639->640 640->628
                                                                                        APIs
                                                                                        • lstrlenA.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000,?), ref: 004050CA
                                                                                        • lstrlenA.KERNEL32(004030CC,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000), ref: 004050DA
                                                                                        • lstrcatA.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,004030CC,004030CC,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,0040E8C0,00000000), ref: 004050ED
                                                                                        • SetWindowTextA.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\), ref: 004050FF
                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405125
                                                                                        • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040513F
                                                                                        • SendMessageA.USER32(?,00001013,?,00000000), ref: 0040514D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                        • String ID: Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\
                                                                                        • API String ID: 2531174081-827568868
                                                                                        • Opcode ID: 954db5f2327d198c380381d75d535be114341e3607e8d3e1ad8a742e9c9284d1
                                                                                        • Instruction ID: f15a229f4800e2d3be0f1ca7c95b874ac348c5f245d1a9f1eaef2b17b8141df3
                                                                                        • Opcode Fuzzy Hash: 954db5f2327d198c380381d75d535be114341e3607e8d3e1ad8a742e9c9284d1
                                                                                        • Instruction Fuzzy Hash: 67217A71E00518BADF119FA5CD84ADFBFA9EB05354F14807AF904AA291C6789E418FA8
                                                                                        Function 00405557 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 641 405557-4055a2 CreateDirectoryA 642 4055a4-4055a6 641->642 643 4055a8-4055b5 GetLastError 641->643 644 4055cf-4055d1 642->644 643->644 645 4055b7-4055cb SetFileSecurityA 643->645 645->642 646 4055cd GetLastError 645->646 646->644
                                                                                        APIs
                                                                                        • CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040559A
                                                                                        • GetLastError.KERNEL32 ref: 004055AE
                                                                                        • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004055C3
                                                                                        • GetLastError.KERNEL32 ref: 004055CD
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ls@$|s@
                                                                                        • API String ID: 3449924974-3603458149
                                                                                        • Opcode ID: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
                                                                                        • Instruction ID: 10c896659e8025b4850b99cc2d4e61bdda87fff31b3f3568e94b9897cbd4a4b4
                                                                                        • Opcode Fuzzy Hash: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
                                                                                        • Instruction Fuzzy Hash: FC010871C04219EAEF019BA1CC447EFBFB9EF04354F10813AD905B6290E378A604CBAA
                                                                                        Function 00406294 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 647 406294-4062b4 GetSystemDirectoryA 648 4062b6 647->648 649 4062b8-4062ba 647->649 648->649 650 4062ca-4062cc 649->650 651 4062bc-4062c4 649->651 653 4062cd-4062ff wsprintfA LoadLibraryExA 650->653 651->650 652 4062c6-4062c8 651->652 652->653
                                                                                        APIs
                                                                                        • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004062AB
                                                                                        • wsprintfA.USER32 ref: 004062E4
                                                                                        • LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 004062F8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                        • String ID: %s%s.dll$UXTHEME$\
                                                                                        • API String ID: 2200240437-4240819195
                                                                                        • Opcode ID: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
                                                                                        • Instruction ID: b350a7b34e5dfe1d1a07fade029f1484d0e2916aa38c44d12689a48c44b66a33
                                                                                        • Opcode Fuzzy Hash: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
                                                                                        • Instruction Fuzzy Hash: FAF0F63091410AAADF15AB74DC0DFFB365CAB08304F1405BAB646E11D2E6B8E9288B69
                                                                                        Function 00402F9C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 654 402f9c-402fb0 655 402fb2 654->655 656 402fb9-402fc1 654->656 655->656 657 402fc3 656->657 658 402fc8-402fcd 656->658 657->658 659 402fdd-402fea call 403178 658->659 660 402fcf-402fd8 call 40318e 658->660 664 402ff0-402ff4 659->664 665 40312f 659->665 660->659 666 403118-40311a 664->666 667 402ffa-40301a GetTickCount call 406427 664->667 668 403131-403132 665->668 669 403163-403167 666->669 670 40311c-40311f 666->670 680 40316e 667->680 682 403020-403028 667->682 672 403171-403175 668->672 673 403134-40313a 669->673 674 403169 669->674 675 403121 670->675 676 403124-40312d call 403178 670->676 678 40313c 673->678 679 40313f-40314d call 403178 673->679 674->680 675->676 676->665 688 40316b 676->688 678->679 679->665 690 40314f-40315b call 405baa 679->690 680->672 685 40302a 682->685 686 40302d-40303b call 403178 682->686 685->686 686->665 692 403041-40304a 686->692 688->680 697 403114-403116 690->697 698 40315d-403160 690->698 694 403050-40306d call 406447 692->694 700 403110-403112 694->700 701 403073-40308a GetTickCount 694->701 697->668 698->669 700->668 702 40308c-403094 701->702 703 4030cf-4030d1 701->703 704 403096-40309a 702->704 705 40309c-4030c7 MulDiv wsprintfA call 405091 702->705 706 4030d3-4030d7 703->706 707 403104-403108 703->707 704->703 704->705 713 4030cc 705->713 710 4030d9-4030de call 405baa 706->710 711 4030ec-4030f2 706->711 707->682 708 40310e 707->708 708->680 716 4030e3-4030e5 710->716 712 4030f8-4030fc 711->712 712->694 715 403102 712->715 713->703 715->680 716->697 717 4030e7-4030ea 716->717 717->712
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountTick$wsprintf
                                                                                        • String ID: ... %d%%
                                                                                        • API String ID: 551687249-2449383134
                                                                                        • Opcode ID: 1fd27a76b4cfc9f99989baa1e417c1091a8e19b6c8bbbe4dda6a34e9ab433526
                                                                                        • Instruction ID: 5f1f0f90ab52480f624b15d228fda7616e1eaa7d5f1d5864c66c4d16daa58cb3
                                                                                        • Opcode Fuzzy Hash: 1fd27a76b4cfc9f99989baa1e417c1091a8e19b6c8bbbe4dda6a34e9ab433526
                                                                                        • Instruction Fuzzy Hash: 69518271901219ABCF10DF65DA4469F7BB8AB08756F14413BF910BB2C0C7389E51CBAA
                                                                                        Function 00405B32 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 718 405b32-405b3c 719 405b3d-405b68 GetTickCount GetTempFileNameA 718->719 720 405b77-405b79 719->720 721 405b6a-405b6c 719->721 723 405b71-405b74 720->723 721->719 722 405b6e 721->722 722->723
                                                                                        APIs
                                                                                        • GetTickCount.KERNEL32 ref: 00405B46
                                                                                        • GetTempFileNameA.KERNEL32(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405B60
                                                                                        Strings
                                                                                        • nsa, xrefs: 00405B3D
                                                                                        • "C:\Users\user\Desktop\Wave Browser.exe", xrefs: 00405B32
                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405B35
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountFileNameTempTick
                                                                                        • String ID: "C:\Users\user\Desktop\Wave Browser.exe"$C:\Users\user\AppData\Local\Temp\$nsa
                                                                                        • API String ID: 1716503409-3769032816
                                                                                        • Opcode ID: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
                                                                                        • Instruction ID: 47ad9e4c3b070603f63866c15a94f77f10573a77d4085d28ed577f0a2abf86d9
                                                                                        • Opcode Fuzzy Hash: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
                                                                                        • Instruction Fuzzy Hash: FFF089367082086BD7104F55DC04B9B7BA8DF91750F10803BFA049A191D6B4B9548B59
                                                                                        Function 00402003 Relevance: 7.6, APIs: 5, Instructions: 73libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 724 402003-40200f 725 402015-40202b call 402acb * 2 724->725 726 4020ca-4020cc 724->726 736 40203a-402048 LoadLibraryExA 725->736 737 40202d-402038 GetModuleHandleA 725->737 727 40223d-402242 call 401423 726->727 734 402957-402966 727->734 735 40271c-402723 727->735 735->734 739 40204a-402057 GetProcAddress 736->739 740 4020c3-4020c5 736->740 737->736 737->739 742 402096-40209b call 405091 739->742 743 402059-40205f 739->743 740->727 748 4020a0-4020a3 742->748 744 402061-40206d call 401423 743->744 745 402078-402094 KiUserCallbackDispatcher 743->745 744->748 755 40206f-402076 744->755 745->748 748->734 750 4020a9-4020b1 call 403738 748->750 750->734 754 4020b7-4020be FreeLibrary 750->754 754->734 755->748
                                                                                        APIs
                                                                                        • GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 0040202E
                                                                                        • LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040203E
                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 0040204E
                                                                                        • KiUserCallbackDispatcher.NTDLL(?,00000400,00424000,0040A828,00409000,?,00000008,00000001,000000F0), ref: 0040208F
                                                                                          • Part of subcall function 00405091: lstrlenA.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000,?), ref: 004050CA
                                                                                          • Part of subcall function 00405091: lstrlenA.KERNEL32(004030CC,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,004030CC,00000000), ref: 004050DA
                                                                                          • Part of subcall function 00405091: lstrcatA.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,004030CC,004030CC,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,00000000,0040E8C0,00000000), ref: 004050ED
                                                                                          • Part of subcall function 00405091: SetWindowTextA.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\), ref: 004050FF
                                                                                          • Part of subcall function 00405091: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405125
                                                                                          • Part of subcall function 00405091: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 0040513F
                                                                                          • Part of subcall function 00405091: SendMessageA.USER32(?,00001013,?,00000000), ref: 0040514D
                                                                                        • FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$Librarylstrlen$AddressCallbackDispatcherFreeHandleLoadModuleProcTextUserWindowlstrcat
                                                                                        • String ID:
                                                                                        • API String ID: 4236411475-0
                                                                                        • Opcode ID: bafb678c57b6c6e5e3398695d0d647fb5217cfac268e9a23cc0773f3fca1d504
                                                                                        • Instruction ID: fd60b9c6cfc4bddbe94fc7e5a8503348695d94644a3847b69ed94d97695b539d
                                                                                        • Opcode Fuzzy Hash: bafb678c57b6c6e5e3398695d0d647fb5217cfac268e9a23cc0773f3fca1d504
                                                                                        • Instruction Fuzzy Hash: BC21C971A00215BBCF207FA48E49BAE75B0AB54359F20413BF601B22D0C6BD4A42D66E
                                                                                        Function 00401C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 756 401c0a-401c2a call 402aa9 * 2 761 401c36-401c3a 756->761 762 401c2c-401c33 call 402acb 756->762 764 401c46-401c4c 761->764 765 401c3c-401c43 call 402acb 761->765 762->761 768 401c9a-401cc0 call 402acb * 2 FindWindowExA 764->768 769 401c4e-401c6a call 402aa9 * 2 764->769 765->764 781 401cc6 768->781 779 401c8a-401c98 SendMessageA 769->779 780 401c6c-401c88 SendMessageTimeoutA 769->780 779->781 782 401cc9-401ccc 780->782 781->782 783 401cd2 782->783 784 402957-402966 782->784 783->784
                                                                                        APIs
                                                                                        • SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C7A
                                                                                        • SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C92
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$Timeout
                                                                                        • String ID: !
                                                                                        • API String ID: 1777923405-2657877971
                                                                                        • Opcode ID: 5c5cc43d9ea2f1c4f8babb9c5b306aab98c19b0d16ecc4efa158615eb64d646c
                                                                                        • Instruction ID: 3953527ca16890ec8ab59ce35194567eea46ff7bd29c8182c04533b3460f2dbd
                                                                                        • Opcode Fuzzy Hash: 5c5cc43d9ea2f1c4f8babb9c5b306aab98c19b0d16ecc4efa158615eb64d646c
                                                                                        • Instruction Fuzzy Hash: 0C21A2B1E44209BEEF15DFA5D986AAD7BB4EF84304F24843EF501B61D0CB7886418F28
                                                                                        Function 004023D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nstDC9E.tmp,00000023,00000011,00000002), ref: 00402421
                                                                                        • RegSetValueExA.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nstDC9E.tmp,00000000,00000011,00000002), ref: 0040245E
                                                                                        • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nstDC9E.tmp,00000000,00000011,00000002), ref: 00402542
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseValuelstrlen
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp
                                                                                        • API String ID: 2655323295-2655717256
                                                                                        • Opcode ID: 2bc70051c4650a96d1eb6b557fc8345eae1fa602d506a92a03f92bc36fac16b8
                                                                                        • Instruction ID: 1fc307ab1697ef986dd5cd2868f3fef353c7a70d956ff55dcab5481d81c0b37e
                                                                                        • Opcode Fuzzy Hash: 2bc70051c4650a96d1eb6b557fc8345eae1fa602d506a92a03f92bc36fac16b8
                                                                                        • Instruction Fuzzy Hash: E2119371E00115BEDF10EFA5DE49AAEBA74EB54318F20843BF504F71D1C6B95D419B28
                                                                                        Function 004059F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00405F6A: lstrcpynA.KERNEL32(?,?,00000400,004032A8,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405F77
                                                                                          • Part of subcall function 0040599B: CharNextA.USER32(?,?,C:\,?,00405A07,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004059A9
                                                                                          • Part of subcall function 0040599B: CharNextA.USER32(00000000), ref: 004059AE
                                                                                          • Part of subcall function 0040599B: CharNextA.USER32(00000000), ref: 004059C2
                                                                                        • lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A43
                                                                                        • GetFileAttributesA.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 00405A53
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                        • String ID: C:\$C:\Users\user\AppData\Local\Temp\
                                                                                        • API String ID: 3248276644-3049482934
                                                                                        • Opcode ID: 3317ae5885fe5557bfe6bd01748d3a5579ce53a26439151f89887cafc9669dc2
                                                                                        • Instruction ID: b63be7d1610f08e16cf97c71acc26f165dc25b1935d551b17c13779f5e49e68e
                                                                                        • Opcode Fuzzy Hash: 3317ae5885fe5557bfe6bd01748d3a5579ce53a26439151f89887cafc9669dc2
                                                                                        • Instruction Fuzzy Hash: 24F0C826315D6156C622237A2C86AAF5644CE87324709473FF851B22D2DA3C89539E7E
                                                                                        Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0040599B: CharNextA.USER32(?,?,C:\,?,00405A07,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004059A9
                                                                                          • Part of subcall function 0040599B: CharNextA.USER32(00000000), ref: 004059AE
                                                                                          • Part of subcall function 0040599B: CharNextA.USER32(00000000), ref: 004059C2
                                                                                        • GetFileAttributesA.KERNEL32(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D
                                                                                          • Part of subcall function 00405557: CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040559A
                                                                                        • SetCurrentDirectoryA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\nstDC9E.tmp,00000000,00000000,000000F0), ref: 0040163C
                                                                                        Strings
                                                                                        • C:\Users\user\AppData\Local\Temp\nstDC9E.tmp, xrefs: 00401631
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp
                                                                                        • API String ID: 1892508949-2655717256
                                                                                        • Opcode ID: 77366072376007a81e873d624303f28143037452507457246f6624776d99043d
                                                                                        • Instruction ID: 1397d73bc892ae661a741dfecf38a44b6d03d9e6e7f57cd6dcc913c124f66756
                                                                                        • Opcode Fuzzy Hash: 77366072376007a81e873d624303f28143037452507457246f6624776d99043d
                                                                                        • Instruction Fuzzy Hash: 59110431608152EBCF217FA55C415BF66B09A96324B28093FE5D2B22E2D63D4E43973F
                                                                                        Function 00405609 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 00405632
                                                                                        • CloseHandle.KERNEL32(?), ref: 0040563F
                                                                                        Strings
                                                                                        • Error launching installer, xrefs: 0040561C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseCreateHandleProcess
                                                                                        • String ID: Error launching installer
                                                                                        • API String ID: 3712363035-66219284
                                                                                        • Opcode ID: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
                                                                                        • Instruction ID: 9728a5d5e843408a2f651da6c1778568bac2657747ba6051cf584ee7dfff0d45
                                                                                        • Opcode Fuzzy Hash: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
                                                                                        • Instruction Fuzzy Hash: B0E046F0A00209BFEB009B60EC09F7B7AACEB10748F404861BD11F32A0E374A9108A79
                                                                                        Function 00403703 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNEL32(?,74DF3410,00000000,C:\Users\user\AppData\Local\Temp\,004036DB,004034F5,?,?,00000006,00000008,0000000A), ref: 0040371D
                                                                                        • GlobalFree.KERNEL32(?), ref: 00403724
                                                                                        Strings
                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00403703
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Free$GlobalLibrary
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                        • API String ID: 1100898210-3081826266
                                                                                        • Opcode ID: 35d1f02da0abf4a3a5ea65bd0cdd12c9264502c99e7b9c945f64e5a7c8fdc6a2
                                                                                        • Instruction ID: 9ffce7b129726733408ddd2483fbf3d013749e605b0eca4be9f0b214f3a53a2d
                                                                                        • Opcode Fuzzy Hash: 35d1f02da0abf4a3a5ea65bd0cdd12c9264502c99e7b9c945f64e5a7c8fdc6a2
                                                                                        • Instruction Fuzzy Hash: 25E01273805121A7C7355F56ED04B5E7768AF49B22F05806BEC407B3A0C7746C418BD9
                                                                                        Function 00406A2B Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: b2818476e1d6469588ef8d75e2f77556e52d803f704a1a77dfe7aba4081c4173
                                                                                        • Instruction ID: ffc4466fd7e1a84d1c0fc4b16d1a76bfc4ed23806840a2aa82a83de6544419ef
                                                                                        • Opcode Fuzzy Hash: b2818476e1d6469588ef8d75e2f77556e52d803f704a1a77dfe7aba4081c4173
                                                                                        • Instruction Fuzzy Hash: D6A15371E00229DBDF28CFA8C8547ADBBB1FF44305F15802AD856BB281C7789A96DF44
                                                                                        Function 00406C2C Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 56f2a3a3000d6c7273ab2248f4ff10f601781423d0ca2bb331c25efff9829afe
                                                                                        • Instruction ID: 3b3aa2dd6ba4133719dd3176c6350ec32f9f513342808bce88e7bfcf8f6a0710
                                                                                        • Opcode Fuzzy Hash: 56f2a3a3000d6c7273ab2248f4ff10f601781423d0ca2bb331c25efff9829afe
                                                                                        • Instruction Fuzzy Hash: F4913370E00229DBDF28CF98C8587ADBBB1FF44305F15802AD852BB291C7789A96DF44
                                                                                        Function 00406942 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 7fc8b0fe229dbff43726b3aa98382c4509895189392f9f8db1d3ee082f796570
                                                                                        • Instruction ID: 583e61d198cc77022754fa770bf55cdcc509db116518bb017f27c6a68360c261
                                                                                        • Opcode Fuzzy Hash: 7fc8b0fe229dbff43726b3aa98382c4509895189392f9f8db1d3ee082f796570
                                                                                        • Instruction Fuzzy Hash: B9814471D04229DBDF24CFA8C884BADBBB1FF44305F25816AD446BB281C7389A96DF54
                                                                                        Function 00406447 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 27bf3f2d71280db305e6514bcdeee96470c11e7b3e186f58d433be2447d111a6
                                                                                        • Instruction ID: 20cbf149701654aecfc40dff313aa48f1da8dd35a22a44c357500b5e58bb095b
                                                                                        • Opcode Fuzzy Hash: 27bf3f2d71280db305e6514bcdeee96470c11e7b3e186f58d433be2447d111a6
                                                                                        • Instruction Fuzzy Hash: 1B816571D04229DBDF28CFA8C844BADBBB0FF44305F21816AD856BB281C7785A96DF54
                                                                                        Function 00406895 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: f7de7d62d5bd7f5964df27a39736f706d5b0cb98cf3e46e90e0dfc1ab4ed8f1c
                                                                                        • Instruction ID: 803a34037b0f7f5be0b8e0f61a876c36f0b5510bb0b2ab0f73e67388892f039f
                                                                                        • Opcode Fuzzy Hash: f7de7d62d5bd7f5964df27a39736f706d5b0cb98cf3e46e90e0dfc1ab4ed8f1c
                                                                                        • Instruction Fuzzy Hash: 95710471D04229DBDF24CFA8C8447ADBBB1FB44305F15806AD846BB281D7385A96DF54
                                                                                        Function 004069B3 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 8e17704cfcf72c8df979941797e4b0b3defb04d6abbfe177bdd58f92bded9ed7
                                                                                        • Instruction ID: ad71f402e4a9b92a37c553ea73d368b4d72ad24497358f0b079e3127edd250f9
                                                                                        • Opcode Fuzzy Hash: 8e17704cfcf72c8df979941797e4b0b3defb04d6abbfe177bdd58f92bded9ed7
                                                                                        • Instruction Fuzzy Hash: 5D713571D04229DBDF28CF98C844BADBBB1FF44305F15806AD856BB281C7389A96DF54
                                                                                        Function 004068FF Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 721cf2a7e84b7ceee3b40c5675287f3d3981b6f25cb9f163efdac731e148116f
                                                                                        • Instruction ID: 5c7df32a9af3fd0bcd177ef93077855236352ac101eaea0ca8dc2b1de7da3dc3
                                                                                        • Opcode Fuzzy Hash: 721cf2a7e84b7ceee3b40c5675287f3d3981b6f25cb9f163efdac731e148116f
                                                                                        • Instruction Fuzzy Hash: B5715571D04229DBEF28CF98C844BADBBB1FF44305F15806AD842BB281C7389A96DF44
                                                                                        Function 004056EA Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00405ADE: GetFileAttributesA.KERNEL32(?,?,004056F6,?,?,00000000,004058D9,?,?,?,?), ref: 00405AE3
                                                                                          • Part of subcall function 00405ADE: SetFileAttributesA.KERNEL32(?,00000000), ref: 00405AF7
                                                                                        • RemoveDirectoryA.KERNEL32(?,?,?,00000000,004058D9), ref: 00405705
                                                                                        • DeleteFileA.KERNEL32(?,?,?,00000000,004058D9), ref: 0040570D
                                                                                        • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405725
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                        • String ID:
                                                                                        • API String ID: 1655745494-0
                                                                                        • Opcode ID: 4526b13c13977a81b347ddf21e43b981b877d45027d35de2861a06aa596b0a5f
                                                                                        • Instruction ID: 00cd3eab12882a3f19659206189ea3ab42d92ca9329beb30f1c3f95a05fa073d
                                                                                        • Opcode Fuzzy Hash: 4526b13c13977a81b347ddf21e43b981b877d45027d35de2861a06aa596b0a5f
                                                                                        • Instruction Fuzzy Hash: E5E02B31229A91D6C22077749D08A5F2ED8DFC6364F050A36F452F31D0D37888079A7F
                                                                                        Function 00406377 Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WaitForSingleObject.KERNEL32(?,00000064), ref: 00406388
                                                                                        • WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 0040639D
                                                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 004063AA
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: ObjectSingleWait$CodeExitProcess
                                                                                        • String ID:
                                                                                        • API String ID: 2567322000-0
                                                                                        • Opcode ID: 3fc5be53c9690b6a646de8aa25a9e0199d8a61bbccea04230adebb2fbe6478e9
                                                                                        • Instruction ID: 0cd4ec7952b05a248ebb9965792abe1936208e1f1afb4a0845a4287efd2e2f9a
                                                                                        • Opcode Fuzzy Hash: 3fc5be53c9690b6a646de8aa25a9e0199d8a61bbccea04230adebb2fbe6478e9
                                                                                        • Instruction Fuzzy Hash: D3E09231A00118BBDB009B45CC01E9E7B6EDB44700F114033FA05B61A0D6B1AE219AE5
                                                                                        Function 00403FE2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageA.USER32(00000408,?,00000000,00403C43), ref: 00404000
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID: x
                                                                                        • API String ID: 3850602802-2363233923
                                                                                        • Opcode ID: 4abed480df06463fe70b265df910d27f296d08dbe05985cee4a365d3d87faa03
                                                                                        • Instruction ID: 9402124811725ca1a17dce1b4f62370aade9c0de9cdbc8c055a01be29c05fafa
                                                                                        • Opcode Fuzzy Hash: 4abed480df06463fe70b265df910d27f296d08dbe05985cee4a365d3d87faa03
                                                                                        • Instruction Fuzzy Hash: B2C012B1A44201BADB254F80DE04F067A70FBA0703F21D039F341210B0C2B11522EB2D
                                                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                        • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID:
                                                                                        • API String ID: 3850602802-0
                                                                                        • Opcode ID: 3be8b2c82b9d5296ba031bde5fc3ac6967fc1ef6e00b1cb2986e69e81292ed92
                                                                                        • Instruction ID: 2eeecbca978bd34a3a2c87f0a48c5f542c226d41099ae67583a71d3d142e8862
                                                                                        • Opcode Fuzzy Hash: 3be8b2c82b9d5296ba031bde5fc3ac6967fc1ef6e00b1cb2986e69e81292ed92
                                                                                        • Instruction Fuzzy Hash: 80012831724210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D
                                                                                        Function 00401E2B Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ShowWindow.USER32(00000000,00000000), ref: 00401E49
                                                                                        • EnableWindow.USER32(00000000,00000000), ref: 00401E54
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$EnableShow
                                                                                        • String ID:
                                                                                        • API String ID: 1136574915-0
                                                                                        • Opcode ID: fb89bb2f38fe5b8984a52f5cfda2f345f39b2a72ed458b6a7c2d67b6650651d2
                                                                                        • Instruction ID: 03bd5150381a8100516e4bd6b800a38f5b51aa9a4917fb4b876f9ca09f65a04e
                                                                                        • Opcode Fuzzy Hash: fb89bb2f38fe5b8984a52f5cfda2f345f39b2a72ed458b6a7c2d67b6650651d2
                                                                                        • Instruction Fuzzy Hash: 7FE092B2F08202AFDB14EBE5E9485EEB7B0DF40319B10403BE001F11D0DA7849419F59
                                                                                        Function 00406302 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleA.KERNEL32(?,?,?,00403249,0000000A), ref: 00406314
                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 0040632F
                                                                                          • Part of subcall function 00406294: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004062AB
                                                                                          • Part of subcall function 00406294: wsprintfA.USER32 ref: 004062E4
                                                                                          • Part of subcall function 00406294: LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 004062F8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                        • String ID:
                                                                                        • API String ID: 2547128583-0
                                                                                        • Opcode ID: e3eb2b64292a1dc6e1ff803c1c8bcb3d8649d8f5040aa353a247b19c86812e57
                                                                                        • Instruction ID: 7792f7d89acf823de2699a2c6bb45250695d03a410eb934ddee53f05324a8379
                                                                                        • Opcode Fuzzy Hash: e3eb2b64292a1dc6e1ff803c1c8bcb3d8649d8f5040aa353a247b19c86812e57
                                                                                        • Instruction Fuzzy Hash: D2E08C32A08221ABD3106B74AD0493B73E8DB99740702487EFA06F2180D738EC2296A9
                                                                                        Function 00405B03 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetFileAttributesA.KERNEL32(00000003,00402DA3,C:\Users\user\Desktop\Wave Browser.exe,80000000,00000003), ref: 00405B07
                                                                                        • CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B29
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$AttributesCreate
                                                                                        • String ID:
                                                                                        • API String ID: 415043291-0
                                                                                        • Opcode ID: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
                                                                                        • Instruction ID: 2f873e3f3c43f12a3908621a4267836d753c9203ad123c8b10a06e7f93ada197
                                                                                        • Opcode Fuzzy Hash: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
                                                                                        • Instruction Fuzzy Hash: C7D09E31658201EFEF098F20DD16F2EBBA2EB84B00F10962CB642944E0D6715815AB16
                                                                                        Function 00405ADE Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetFileAttributesA.KERNEL32(?,?,004056F6,?,?,00000000,004058D9,?,?,?,?), ref: 00405AE3
                                                                                        • SetFileAttributesA.KERNEL32(?,00000000), ref: 00405AF7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: AttributesFile
                                                                                        • String ID:
                                                                                        • API String ID: 3188754299-0
                                                                                        • Opcode ID: 7ab00c422df54d36d0d1c47ad5130eeae7fd73d224c9059dc67d6d60f2aac68c
                                                                                        • Instruction ID: b7bec259a7406421912cbc46aebe03861170fd98e68390908d479edd226f6e0d
                                                                                        • Opcode Fuzzy Hash: 7ab00c422df54d36d0d1c47ad5130eeae7fd73d224c9059dc67d6d60f2aac68c
                                                                                        • Instruction Fuzzy Hash: E5D01272908121BFC2112728ED0C89BBF95DB543B1702CB31FD79A26F0E7304C52AAA5
                                                                                        Function 004036BE Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,004034F5,?,?,00000006,00000008,0000000A), ref: 004036C9
                                                                                        Strings
                                                                                        • C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\, xrefs: 004036DD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseHandle
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\
                                                                                        • API String ID: 2962429428-1394782791
                                                                                        • Opcode ID: 74bbd10c700ad04cd4501273d328f723aec36b298a8b384acbe559924b06b6a2
                                                                                        • Instruction ID: 396606c85901c53f59bd577b7c6b05ad80c12e20c965e706032c1b0f9cf5384f
                                                                                        • Opcode Fuzzy Hash: 74bbd10c700ad04cd4501273d328f723aec36b298a8b384acbe559924b06b6a2
                                                                                        • Instruction Fuzzy Hash: 54C02230A0420093D1302F74ED4B9043A146740331BA00731F479B20F2C33C2A41446E
                                                                                        Function 004055D4 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CreateDirectoryA.KERNEL32(?,00000000,004031C9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 004055DA
                                                                                        • GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004055E8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateDirectoryErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 1375471231-0
                                                                                        • Opcode ID: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
                                                                                        • Instruction ID: 176dbb695fa69d1773a7d690fb999828ada584b34c1629d79551d48c85d86b1a
                                                                                        • Opcode Fuzzy Hash: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
                                                                                        • Instruction Fuzzy Hash: E1C08C30608101BBD6000B318D09B073A56AB00340F1084356002E00F4C6309100C93F
                                                                                        Function 00405E1E Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegCreateKeyExA.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402B7C,00000000,?,?), ref: 00405E47
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Create
                                                                                        • String ID:
                                                                                        • API String ID: 2289755597-0
                                                                                        • Opcode ID: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
                                                                                        • Instruction ID: 614deb5803ecfea412708c7c06f6093feae3e2eaa5d1670ea64157aa9e0e4aa4
                                                                                        • Opcode Fuzzy Hash: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
                                                                                        • Instruction Fuzzy Hash: 1AE0ECB201454DBFEF095F90ED0ADBB371DEB14310F00492EFA16E40A0F6B5A920AA75
                                                                                        Function 00405B7B Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040318B,00000000,00000000,00402FE8,000000FF,00000004,00000000,00000000,00000000), ref: 00405B8F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileRead
                                                                                        • String ID:
                                                                                        • API String ID: 2738559852-0
                                                                                        • Opcode ID: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
                                                                                        • Instruction ID: 82daff948be82a3a54a064a8b67bdb156262b24a8193569c828015c470817b44
                                                                                        • Opcode Fuzzy Hash: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
                                                                                        • Instruction Fuzzy Hash: AFE0EC3265425AABDF509E559C00BEB7BACEB453A0F008832F915E3190D235F9219BA5
                                                                                        Function 00405BAA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,00000020,?,00403159,00000000,0040A8C0,00000020,0040A8C0,00000020,000000FF,00000004,00000000), ref: 00405BBE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileWrite
                                                                                        • String ID:
                                                                                        • API String ID: 3934441357-0
                                                                                        • Opcode ID: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
                                                                                        • Instruction ID: 29870a228079f63f45527f16aa4763e95840d14b1a08b3071f6f7043dbe3ced8
                                                                                        • Opcode Fuzzy Hash: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
                                                                                        • Instruction Fuzzy Hash: EBE0EC3261429AABDF109F559C00EEB7B6CEB05361F144832FD15E6150E271F8219BB5
                                                                                        Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetFileAttributesA.KERNEL32(00000000,?,000000F0), ref: 004015A8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: AttributesFile
                                                                                        • String ID:
                                                                                        • API String ID: 3188754299-0
                                                                                        • Opcode ID: df0c4868b8f5e0a15e0aad09ae5e8ad91aee1276abd3d8c53a65693304450b05
                                                                                        • Instruction ID: 6b6e43e0d42c625d8266bfea82bd0fe16559fb602912bc7a2e5d3c6a4b8464c0
                                                                                        • Opcode Fuzzy Hash: df0c4868b8f5e0a15e0aad09ae5e8ad91aee1276abd3d8c53a65693304450b05
                                                                                        • Instruction Fuzzy Hash: 4ED012B2704111ABCF10DBE89A489DDB7A49B40329B308537D111F21D0D2B98A45A72E
                                                                                        Function 00405D49 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • MoveFileExA.KERNEL32(?,?,00000005(MOVEFILE_REPLACE_EXISTING|MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00405D53
                                                                                          • Part of subcall function 00405BD9: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405D6A,?,?), ref: 00405C0A
                                                                                          • Part of subcall function 00405BD9: GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405C13
                                                                                          • Part of subcall function 00405BD9: GetShortPathNameA.KERNEL32(?,00421E98,00000400), ref: 00405C30
                                                                                          • Part of subcall function 00405BD9: wsprintfA.USER32 ref: 00405C4E
                                                                                          • Part of subcall function 00405BD9: GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405C89
                                                                                          • Part of subcall function 00405BD9: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405C98
                                                                                          • Part of subcall function 00405BD9: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CD0
                                                                                          • Part of subcall function 00405BD9: SetFilePointer.KERNEL32(004093B8,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D26
                                                                                          • Part of subcall function 00405BD9: GlobalFree.KERNEL32(00000000), ref: 00405D37
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$GlobalNamePathShort$AllocCloseFreeHandleMovePointerSizelstrcpywsprintf
                                                                                        • String ID:
                                                                                        • API String ID: 299535525-0
                                                                                        • Opcode ID: a7c86fb983e4a2a6b39add72e13c44e1fb896256edc90134224cd530a86ba537
                                                                                        • Instruction ID: a26933083b4c0f9a0fa58553d7c0e54d140117203494a92baae2d10ee0292597
                                                                                        • Opcode Fuzzy Hash: a7c86fb983e4a2a6b39add72e13c44e1fb896256edc90134224cd530a86ba537
                                                                                        • Instruction Fuzzy Hash: 26D09E31118641AEDA111B11EC05A1B7BB1FB91355F10C42AF185500B1E7359451DF15
                                                                                        Function 00404009 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetDlgItemTextA.USER32(?,?,00000000), ref: 00404023
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: ItemText
                                                                                        • String ID:
                                                                                        • API String ID: 3367045223-0
                                                                                        • Opcode ID: 54d02c50c7e2296ddc8c34b1165c5deb25cf1e81ae88b04e05fefa6a0fdd8374
                                                                                        • Instruction ID: 949d117cf3dd3f54baa00a1886a883e9003fccaf101d35cf0c4e59632c7dfeb9
                                                                                        • Opcode Fuzzy Hash: 54d02c50c7e2296ddc8c34b1165c5deb25cf1e81ae88b04e05fefa6a0fdd8374
                                                                                        • Instruction Fuzzy Hash: 0BC04C75148700BFD641A755CC42F1FB799EFA4316F44C92EB55CA61D2CA3988209A2A
                                                                                        Function 00404055 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageA.USER32(0002045A,00000000,00000000,00000000), ref: 00404067
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID:
                                                                                        • API String ID: 3850602802-0
                                                                                        • Opcode ID: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
                                                                                        • Instruction ID: b219db4bd4a8167c49179a39135beeb084f81f4a85e7e9c76e455f2dfd64676a
                                                                                        • Opcode Fuzzy Hash: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
                                                                                        • Instruction Fuzzy Hash: C6C09B717443007BEA31CB609D49F0777586B90B00F5584357311F50D0C6B4E451D62D
                                                                                        Function 0040403E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageA.USER32(00000028,?,00000001,00403E6E), ref: 0040404C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend
                                                                                        • String ID:
                                                                                        • API String ID: 3850602802-0
                                                                                        • Opcode ID: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
                                                                                        • Instruction ID: 7b5ccc39adf6f72de5191684d4495c6b43ffe58f78915606d69c4a7e6f44d702
                                                                                        • Opcode Fuzzy Hash: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
                                                                                        • Instruction Fuzzy Hash: F3B092B5684200BAEE224B40DD09F457EA2E7A4702F008024B300240B0C6B200A1DB19
                                                                                        Function 0040318E Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00402F2A,?), ref: 0040319C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: FilePointer
                                                                                        • String ID:
                                                                                        • API String ID: 973152223-0
                                                                                        • Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                                                                                        • Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
                                                                                        • Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                                                                                        • Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D
                                                                                        Function 0040402B Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • KiUserCallbackDispatcher.NTDLL(?,00403E07), ref: 00404035
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CallbackDispatcherUser
                                                                                        • String ID:
                                                                                        • API String ID: 2492992576-0
                                                                                        • Opcode ID: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
                                                                                        • Instruction ID: 627edf876ec6fe827e8ded8b6e0f84c3e1bff33d3b07c91bc4a796ca35ff40dd
                                                                                        • Opcode Fuzzy Hash: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
                                                                                        • Instruction Fuzzy Hash: CAA00176808101ABCB029B50FF09D9ABF62ABA5705B028435E65694174C7325865FF1A

                                                                                        Non-executed Functions

                                                                                        Function 00404A0E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404A26
                                                                                        • GetDlgItem.USER32(?,00000408), ref: 00404A31
                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 00404A7B
                                                                                        • LoadBitmapA.USER32(0000006E), ref: 00404A8E
                                                                                        • SetWindowLongA.USER32(?,000000FC,00405005), ref: 00404AA7
                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404ABB
                                                                                        • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404ACD
                                                                                        • SendMessageA.USER32(?,00001109,00000002), ref: 00404AE3
                                                                                        • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404AEF
                                                                                        • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B01
                                                                                        • DeleteObject.GDI32(00000000), ref: 00404B04
                                                                                        • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404B2F
                                                                                        • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404B3B
                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404BD0
                                                                                        • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404BFB
                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C0F
                                                                                        • GetWindowLongA.USER32(?,000000F0), ref: 00404C3E
                                                                                        • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404C4C
                                                                                        • ShowWindow.USER32(?,00000005), ref: 00404C5D
                                                                                        • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404D5A
                                                                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404DBF
                                                                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404DD4
                                                                                        • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404DF8
                                                                                        • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E18
                                                                                        • ImageList_Destroy.COMCTL32(00000000), ref: 00404E2D
                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00404E3D
                                                                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404EB6
                                                                                        • SendMessageA.USER32(?,00001102,?,?), ref: 00404F5F
                                                                                        • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404F6E
                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00404F8E
                                                                                        • ShowWindow.USER32(?,00000000), ref: 00404FDC
                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 00404FE7
                                                                                        • ShowWindow.USER32(00000000), ref: 00404FEE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                        • String ID: $M$N
                                                                                        • API String ID: 1638840714-813528018
                                                                                        • Opcode ID: 93c98d4ec4668bcb2a28b794a0b84e11ead12c18dbcc0c9b8545a6ab8116134d
                                                                                        • Instruction ID: e53edbee2b152b0549b5e4175851bd50996010034005c2ce37e30fc0cedab0f1
                                                                                        • Opcode Fuzzy Hash: 93c98d4ec4668bcb2a28b794a0b84e11ead12c18dbcc0c9b8545a6ab8116134d
                                                                                        • Instruction Fuzzy Hash: A50260B0900209AFEB20DF94DC85AAE7BB5FB84315F10817AF610B62E1D7799D42DF58
                                                                                        Function 0040449B Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 274stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 004044EA
                                                                                        • SetWindowTextA.USER32(00000000,?), ref: 00404514
                                                                                        • SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 004045C5
                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 004045D0
                                                                                        • lstrcmpiA.KERNEL32(Delete on reboot: ,WaveBrowser Setup: Installing), ref: 00404602
                                                                                        • lstrcatA.KERNEL32(?,Delete on reboot: ), ref: 0040460E
                                                                                        • SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404620
                                                                                          • Part of subcall function 0040566A: GetDlgItemTextA.USER32(?,?,00000400,00404657), ref: 0040567D
                                                                                          • Part of subcall function 004061D4: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Wave Browser.exe",74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040622C
                                                                                          • Part of subcall function 004061D4: CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406239
                                                                                          • Part of subcall function 004061D4: CharNextA.USER32(?,"C:\Users\user\Desktop\Wave Browser.exe",74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040623E
                                                                                          • Part of subcall function 004061D4: CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040624E
                                                                                        • GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,?,00000001,0041ECD8,?,?,000003FB,?), ref: 004046DE
                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 004046F9
                                                                                          • Part of subcall function 00404852: lstrlenA.KERNEL32(WaveBrowser Setup: Installing,WaveBrowser Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040476D,000000DF,00000000,00000400,?), ref: 004048F0
                                                                                          • Part of subcall function 00404852: wsprintfA.USER32 ref: 004048F8
                                                                                          • Part of subcall function 00404852: SetDlgItemTextA.USER32(?,WaveBrowser Setup: Installing), ref: 0040490B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                        • String ID: A$C:\Users\user\Wavesor Software\WaveBrowser$Delete on reboot: $DS$WaveBrowser Setup: Installing
                                                                                        • API String ID: 2624150263-2412726118
                                                                                        • Opcode ID: 03e8bc56e4921ad75bea8cd1f1782dda8109c9e19b56ba20b71ffa0d74a477b0
                                                                                        • Instruction ID: 64b5da15ede57aab044e7fe1d22d086372aa44ea1ea65b7a694081baf4ac5fa5
                                                                                        • Opcode Fuzzy Hash: 03e8bc56e4921ad75bea8cd1f1782dda8109c9e19b56ba20b71ffa0d74a477b0
                                                                                        • Instruction Fuzzy Hash: 09A1A0B1900209ABDB11AFA5CC41AEFB7B8EF85314F14843BF611B72D1D77C8A418B69
                                                                                        Function 004020D1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CoCreateInstance.OLE32(00407410,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402153
                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402202
                                                                                        Strings
                                                                                        • C:\Users\user\AppData\Local\Temp\nstDC9E.tmp, xrefs: 00402193
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharCreateInstanceMultiWide
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp
                                                                                        • API String ID: 123533781-2655717256
                                                                                        • Opcode ID: b6cce7b5fc8f413cb05d008d6efc400a78cc0e54adead5979a01876e38bd8550
                                                                                        • Instruction ID: 6501524f140c77e19c8f4c8bf6c33f72b20f6566a7f2a320fdf5b89632137862
                                                                                        • Opcode Fuzzy Hash: b6cce7b5fc8f413cb05d008d6efc400a78cc0e54adead5979a01876e38bd8550
                                                                                        • Instruction Fuzzy Hash: EE5137B1A00208BFCB10DFE4C989A9D7BB5AF48318F2085AAF515EB2D1DA799941CF14
                                                                                        Function 004026FE Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040270D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileFindFirst
                                                                                        • String ID:
                                                                                        • API String ID: 1974802433-0
                                                                                        • Opcode ID: db84967a17207f02c6d0b5dcd89b339aa32118489e577b3dc6649bab2232210f
                                                                                        • Instruction ID: 595bc86bb0b87b603365eb58ea040ec14d9195657b0818bf84ef9d27f643e594
                                                                                        • Opcode Fuzzy Hash: db84967a17207f02c6d0b5dcd89b339aa32118489e577b3dc6649bab2232210f
                                                                                        • Instruction Fuzzy Hash: AAF0A772604151EAD700E7A499499EEB768CB15315F60457BE281F20C1C6B88A469B3E
                                                                                        Function 00404174 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 202windowstringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004041FF
                                                                                        • GetDlgItem.USER32(00000000,000003E8), ref: 00404213
                                                                                        • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404231
                                                                                        • GetSysColor.USER32(?), ref: 00404242
                                                                                        • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404251
                                                                                        • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404260
                                                                                        • lstrlenA.KERNEL32(?), ref: 00404263
                                                                                        • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404272
                                                                                        • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404287
                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 004042E9
                                                                                        • SendMessageA.USER32(00000000), ref: 004042EC
                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404317
                                                                                        • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404357
                                                                                        • LoadCursorA.USER32(00000000,00007F02), ref: 00404366
                                                                                        • SetCursor.USER32(00000000), ref: 0040436F
                                                                                        • LoadCursorA.USER32(00000000,00007F00), ref: 00404385
                                                                                        • SetCursor.USER32(00000000), ref: 00404388
                                                                                        • SendMessageA.USER32(00000111,00000001,00000000), ref: 004043B4
                                                                                        • SendMessageA.USER32(00000010,00000000,00000000), ref: 004043C8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                        • String ID: ?A@$Delete on reboot: $DS$N
                                                                                        • API String ID: 3103080414-2610532037
                                                                                        • Opcode ID: 073baeb7e2e56e8e61070ac22e94b8c547292f2e7e559fc5b4704c6dbdd391f8
                                                                                        • Instruction ID: 58642e7cad261c001b024910741a92c2a1970d4d91afa6865c69404cbc82dd24
                                                                                        • Opcode Fuzzy Hash: 073baeb7e2e56e8e61070ac22e94b8c547292f2e7e559fc5b4704c6dbdd391f8
                                                                                        • Instruction Fuzzy Hash: F061B2B1A40209BFEB109F61DD45B6A7B69FB84715F008036FB04BA2D1C7B8A951CB99
                                                                                        Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                        • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                        • DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                        • String ID: F
                                                                                        • API String ID: 941294808-1304234792
                                                                                        • Opcode ID: 0195cc9bd3a679183555b6c9b2658d6023a39abd86bfcdd07458fb5c51006648
                                                                                        • Instruction ID: d756f8073455ec7f94eaaa006bac723f94b68f9cc4de0a6a70f3062e944f429a
                                                                                        • Opcode Fuzzy Hash: 0195cc9bd3a679183555b6c9b2658d6023a39abd86bfcdd07458fb5c51006648
                                                                                        • Instruction Fuzzy Hash: 6E419B71804249AFCF058FA4CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5
                                                                                        Function 00405BD9 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405D6A,?,?), ref: 00405C0A
                                                                                        • GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405C13
                                                                                          • Part of subcall function 00405A68: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405A78
                                                                                          • Part of subcall function 00405A68: lstrlenA.KERNEL32(00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AAA
                                                                                        • GetShortPathNameA.KERNEL32(?,00421E98,00000400), ref: 00405C30
                                                                                        • wsprintfA.USER32 ref: 00405C4E
                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405C89
                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405C98
                                                                                        • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CD0
                                                                                        • SetFilePointer.KERNEL32(004093B8,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D26
                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00405D37
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405D3E
                                                                                          • Part of subcall function 00405B03: GetFileAttributesA.KERNEL32(00000003,00402DA3,C:\Users\user\Desktop\Wave Browser.exe,80000000,00000003), ref: 00405B07
                                                                                          • Part of subcall function 00405B03: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B29
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                        • String ID: %s=%s$[Rename]
                                                                                        • API String ID: 2171350718-1727408572
                                                                                        • Opcode ID: 7a3cbcd02f5254dce29d3f588390a4d70db6fad4625d33ef473b20247575bd2a
                                                                                        • Instruction ID: 5deb0727307c374d823852481fd1d72290d2d80dc16b0ec149a77f792b4fa3ea
                                                                                        • Opcode Fuzzy Hash: 7a3cbcd02f5254dce29d3f588390a4d70db6fad4625d33ef473b20247575bd2a
                                                                                        • Instruction Fuzzy Hash: 0F31F231605B156BD6206B659C49F6B3AACDF45754F14043BBE01FA2D2E67CAC008EBD
                                                                                        Function 004061D4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Wave Browser.exe",74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040622C
                                                                                        • CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 00406239
                                                                                        • CharNextA.USER32(?,"C:\Users\user\Desktop\Wave Browser.exe",74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040623E
                                                                                        • CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004031B1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 0040624E
                                                                                        Strings
                                                                                        • "C:\Users\user\Desktop\Wave Browser.exe", xrefs: 00406210
                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004061D5
                                                                                        • *?|<>/":, xrefs: 0040621C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Char$Next$Prev
                                                                                        • String ID: "C:\Users\user\Desktop\Wave Browser.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                        • API String ID: 589700163-2603800200
                                                                                        • Opcode ID: 7d136cfff8c7bf043451e4c65a0ab86a2e72481698e5121a5e115d190c3ec359
                                                                                        • Instruction ID: 78b5553556e1b29770c7274e4e8764cd0b55728b37568efcb800383df96c7a9c
                                                                                        • Opcode Fuzzy Hash: 7d136cfff8c7bf043451e4c65a0ab86a2e72481698e5121a5e115d190c3ec359
                                                                                        • Instruction Fuzzy Hash: FF11045180839029FB3226380C40BB76F994F6A760F1900BFE8D2722C2D67C5CA2976E
                                                                                        Function 00404070 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetWindowLongA.USER32(?,000000EB), ref: 0040408D
                                                                                        • GetSysColor.USER32(00000000), ref: 004040CB
                                                                                        • SetTextColor.GDI32(?,00000000), ref: 004040D7
                                                                                        • SetBkMode.GDI32(?,?), ref: 004040E3
                                                                                        • GetSysColor.USER32(?), ref: 004040F6
                                                                                        • SetBkColor.GDI32(?,?), ref: 00404106
                                                                                        • DeleteObject.GDI32(?), ref: 00404120
                                                                                        • CreateBrushIndirect.GDI32(?), ref: 0040412A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                        • String ID:
                                                                                        • API String ID: 2320649405-0
                                                                                        • Opcode ID: c86d0c104538bc307405f6e360d8371e1c040facf7e5af7d22035c6604205aa7
                                                                                        • Instruction ID: dc807fd0e826fa60b9ec6720df696095df3ef071cd79e71149a0dd006d979902
                                                                                        • Opcode Fuzzy Hash: c86d0c104538bc307405f6e360d8371e1c040facf7e5af7d22035c6604205aa7
                                                                                        • Instruction Fuzzy Hash: D021B2709047059BCB309F28DC48A4BBBF8AF81715F048A2AFA96B62E0C334E844CB55
                                                                                        Function 0040495C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404977
                                                                                        • GetMessagePos.USER32 ref: 0040497F
                                                                                        • ScreenToClient.USER32(?,?), ref: 00404999
                                                                                        • SendMessageA.USER32(?,00001111,00000000,?), ref: 004049AB
                                                                                        • SendMessageA.USER32(?,0000110C,00000000,?), ref: 004049D1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Message$Send$ClientScreen
                                                                                        • String ID: f
                                                                                        • API String ID: 41195575-1993550816
                                                                                        • Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                                                                                        • Instruction ID: 064635845699c0f4496499246dda67b20ede28c923f9f6f9e3dc5f389f782763
                                                                                        • Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                                                                                        • Instruction Fuzzy Hash: 38015271D00219BADB01DBA4DD85BFFBBBCAF55711F10412BBA10B61C0D7B469018BA5
                                                                                        Function 00401D9B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetDC.USER32(?), ref: 00401D9E
                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB8
                                                                                        • MulDiv.KERNEL32(00000000,00000000), ref: 00401DC0
                                                                                        • ReleaseDC.USER32(?,00000000), ref: 00401DD1
                                                                                        • CreateFontIndirectA.GDI32(0040A7E8), ref: 00401E20
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                        • String ID: MS Shell Dlg
                                                                                        • API String ID: 3808545654-76309092
                                                                                        • Opcode ID: 6a8c14db2f1d773d547e4ece9ff7750bd8912a8ea0f13da685b557514c98691f
                                                                                        • Instruction ID: 85430ec79d7d493a62f5c90f0650e63f0d0faf8675fc45e27afe54df9b067c18
                                                                                        • Opcode Fuzzy Hash: 6a8c14db2f1d773d547e4ece9ff7750bd8912a8ea0f13da685b557514c98691f
                                                                                        • Instruction Fuzzy Hash: CD019271948341AFE7009BB0AE49E9A7FB4DB55305F108479F101BB2E2CA7841909F2F
                                                                                        Function 00402C7C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C97
                                                                                        • MulDiv.KERNEL32(00033600,00000064,000FCD50), ref: 00402CC2
                                                                                        • wsprintfA.USER32 ref: 00402CD2
                                                                                        • SetWindowTextA.USER32(?,?), ref: 00402CE2
                                                                                        • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402CF4
                                                                                        Strings
                                                                                        • verifying installer: %d%%, xrefs: 00402CCC
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                        • String ID: verifying installer: %d%%
                                                                                        • API String ID: 1451636040-82062127
                                                                                        • Opcode ID: bae99d8ff7e2baad353350c7eaeb5d71397e6bffa89abe4dcb3f34ba705061ab
                                                                                        • Instruction ID: 8c289f0fb36a9d27d262e5defce623c0a4e81db89a67886656150a2c4b5e1d8a
                                                                                        • Opcode Fuzzy Hash: bae99d8ff7e2baad353350c7eaeb5d71397e6bffa89abe4dcb3f34ba705061ab
                                                                                        • Instruction Fuzzy Hash: 00014F70944208BBEF249F60DD09EEE37A9EB04704F008039FA06B92E0D7B99955CF59
                                                                                        Function 0040273C Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402790
                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027AC
                                                                                        • GlobalFree.KERNEL32(?), ref: 004027EB
                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004027FE
                                                                                        • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402816
                                                                                        • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040282A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                        • String ID:
                                                                                        • API String ID: 2667972263-0
                                                                                        • Opcode ID: 944d5df4e2bd3612c872eafde47f1d1a1e97deb8d5b3e09ab1338a5e9f264a1b
                                                                                        • Instruction ID: 69dabb1dc5664d4cb3e0aedb1da4cd8560a2ff3041f204a353ec2f52c38cd3f1
                                                                                        • Opcode Fuzzy Hash: 944d5df4e2bd3612c872eafde47f1d1a1e97deb8d5b3e09ab1338a5e9f264a1b
                                                                                        • Instruction Fuzzy Hash: 7C21BF71C00128BBCF206FA5CE49D9E7A79EF04364F14423AF410762E0C7791D009FA9
                                                                                        Function 00404852 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrlenA.KERNEL32(WaveBrowser Setup: Installing,WaveBrowser Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040476D,000000DF,00000000,00000400,?), ref: 004048F0
                                                                                        • wsprintfA.USER32 ref: 004048F8
                                                                                        • SetDlgItemTextA.USER32(?,WaveBrowser Setup: Installing), ref: 0040490B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                        • String ID: %u.%u%s%s$WaveBrowser Setup: Installing
                                                                                        • API String ID: 3540041739-1800912575
                                                                                        • Opcode ID: fc39b083cafe0faf60dc0761f43273384c7893e0f8fea42348e0b2d59e8b85dc
                                                                                        • Instruction ID: 0ac14a548df83272d562d6c5522d93b353c1d491cf82d9c84c752126d1ac48ba
                                                                                        • Opcode Fuzzy Hash: fc39b083cafe0faf60dc0761f43273384c7893e0f8fea42348e0b2d59e8b85dc
                                                                                        • Instruction Fuzzy Hash: 2A11D573A041243BDB0065A99C45EAF3288DB85374F254637FE25F71D2EA78CC1285A8
                                                                                        Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetDlgItem.USER32(?), ref: 00401D45
                                                                                        • GetClientRect.USER32(00000000,?), ref: 00401D52
                                                                                        • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D73
                                                                                        • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D81
                                                                                        • DeleteObject.GDI32(00000000), ref: 00401D90
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                        • String ID:
                                                                                        • API String ID: 1849352358-0
                                                                                        • Opcode ID: 3e98e30495b11ed96e9f76979364d05835fcfdae40f81675b092c7602420f547
                                                                                        • Instruction ID: 236c2df16a83e1707d8be159829b3a1190eecd98233effbe731bed35476ffb6f
                                                                                        • Opcode Fuzzy Hash: 3e98e30495b11ed96e9f76979364d05835fcfdae40f81675b092c7602420f547
                                                                                        • Instruction Fuzzy Hash: 01F0ECB2A04115BFDB01ABA4DE89DEFBBBCEB44305B044466F601F2191C6749D018B79
                                                                                        Function 00405902 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004031C3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 00405908
                                                                                        • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004031C3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004033E8,?,00000006,00000008,0000000A), ref: 00405911
                                                                                        • lstrcatA.KERNEL32(?,00409014,?,00000006,00000008,0000000A), ref: 00405922
                                                                                        Strings
                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405902
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CharPrevlstrcatlstrlen
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                        • API String ID: 2659869361-3081826266
                                                                                        • Opcode ID: 7d86c92969947f3077f9a158046bd063bc506289d00538d24d19a3cace2b88b5
                                                                                        • Instruction ID: bd87ec63c1f35a98f82bf41febae71866d1aa3f85b5b5a32f8f6ee96ed89cac6
                                                                                        • Opcode Fuzzy Hash: 7d86c92969947f3077f9a158046bd063bc506289d00538d24d19a3cace2b88b5
                                                                                        • Instruction Fuzzy Hash: C6D0A9A26069316ED2022315AC09EEB2A0CCF16319B040022F600B62A2CA3C1D418BFE
                                                                                        Function 00402BCD Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402C32
                                                                                        • RegCloseKey.ADVAPI32(?,?,?), ref: 00402C3B
                                                                                        • RegCloseKey.ADVAPI32(?,?,?), ref: 00402C5C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Close$Enum
                                                                                        • String ID:
                                                                                        • API String ID: 464197530-0
                                                                                        • Opcode ID: 3334b5ba8839b6b08f8d1b22820b7a27cd9b98a0074514e5335d38f885d40b59
                                                                                        • Instruction ID: 3f870e478545c218cbf8d1d8c83e1046b3ec80cd8b5b23ff6fd5b08b87a912e1
                                                                                        • Opcode Fuzzy Hash: 3334b5ba8839b6b08f8d1b22820b7a27cd9b98a0074514e5335d38f885d40b59
                                                                                        • Instruction Fuzzy Hash: 76112B36504109FBEF129F91CE09F9E7B69AB48340F104072BE05B51E0E7B5AE11ABA9
                                                                                        Function 0040599B Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • CharNextA.USER32(?,?,C:\,?,00405A07,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,00405752,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004059A9
                                                                                        • CharNextA.USER32(00000000), ref: 004059AE
                                                                                        • CharNextA.USER32(00000000), ref: 004059C2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CharNext
                                                                                        • String ID: C:\
                                                                                        • API String ID: 3213498283-3404278061
                                                                                        • Opcode ID: 10bc9b63e27fd2895a2a79afc72dfc96a7ed1041d934c6f985c348dce719f526
                                                                                        • Instruction ID: b251aa3e985fa887116ab65003500a8f213bfb7e3cc2aa31c3213714dbeb82a6
                                                                                        • Opcode Fuzzy Hash: 10bc9b63e27fd2895a2a79afc72dfc96a7ed1041d934c6f985c348dce719f526
                                                                                        • Instruction Fuzzy Hash: 22F0CDD1908F60AAFB3252684C45B675E88CB56371F1800ABE240A62C282B848408FAA
                                                                                        Function 00402CFF Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DestroyWindow.USER32(00000000,00000000,00402EDF,00000001), ref: 00402D12
                                                                                        • GetTickCount.KERNEL32 ref: 00402D30
                                                                                        • CreateDialogParamA.USER32(0000006F,00000000,00402C7C,00000000), ref: 00402D4D
                                                                                        • ShowWindow.USER32(00000000,00000005), ref: 00402D5B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                        • String ID:
                                                                                        • API String ID: 2102729457-0
                                                                                        • Opcode ID: 10c80b0613a78b839ad02c7969bec3604bf4f1206715e27e9f15991f3fdd17a2
                                                                                        • Instruction ID: f5aaf9fad63db9690dbd9b3812727a8d708a0014de572c02bbf4379bbf317f26
                                                                                        • Opcode Fuzzy Hash: 10c80b0613a78b839ad02c7969bec3604bf4f1206715e27e9f15991f3fdd17a2
                                                                                        • Instruction Fuzzy Hash: 42F05E70906220ABCA217F64FE4CACB7BA4FB45B527014576F145B11E4C3799C8ACBDD
                                                                                        Function 00405005 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsWindowVisible.USER32(?), ref: 00405034
                                                                                        • CallWindowProcA.USER32(?,?,?,?), ref: 00405085
                                                                                          • Part of subcall function 00404055: SendMessageA.USER32(0002045A,00000000,00000000,00000000), ref: 00404067
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                        • String ID:
                                                                                        • API String ID: 3748168415-3916222277
                                                                                        • Opcode ID: 3aee37f21ff99dc198a5fd33356f68d884607a106991554e7d1ecd4dd831c2ab
                                                                                        • Instruction ID: 5be162d7cd7d71c2ccb341d7130f59d8c0266776e22eb2788f3d6f03133d665e
                                                                                        • Opcode Fuzzy Hash: 3aee37f21ff99dc198a5fd33356f68d884607a106991554e7d1ecd4dd831c2ab
                                                                                        • Instruction Fuzzy Hash: 2D019A7150060DABDF209F20DC80EAF3A25EB80354F204036FA14792D0C73A8891AEAA
                                                                                        Function 00405E51 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,Delete on reboot: ,?,?,?,?,00000002,Delete on reboot: ,?,00406095,80000002), ref: 00405E97
                                                                                        • RegCloseKey.ADVAPI32(?,?,00406095,80000002,Software\Microsoft\Windows\CurrentVersion,Delete on reboot: ,Delete on reboot: ,Delete on reboot: ,?,Delete on reboot: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\), ref: 00405EA2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseQueryValue
                                                                                        • String ID: Delete on reboot:
                                                                                        • API String ID: 3356406503-2410499825
                                                                                        • Opcode ID: 3949dd6c93d052dc7270a5251cfef74d8147a6dfb4195bf0c528e32bcb56f74b
                                                                                        • Instruction ID: d4591e39b0d39d961dff3dfa4a9982e28399459fd93e33a5317855cc39530622
                                                                                        • Opcode Fuzzy Hash: 3949dd6c93d052dc7270a5251cfef74d8147a6dfb4195bf0c528e32bcb56f74b
                                                                                        • Instruction Fuzzy Hash: 92019A72510609ABDF228F20CC09FDB3FA9EF48360F008026FA45A2190D338DA11CBA4
                                                                                        Function 00405949 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402DCF,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Wave Browser.exe,C:\Users\user\Desktop\Wave Browser.exe,80000000,00000003), ref: 0040594F
                                                                                        • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402DCF,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Wave Browser.exe,C:\Users\user\Desktop\Wave Browser.exe,80000000,00000003), ref: 0040595D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: CharPrevlstrlen
                                                                                        • String ID: C:\Users\user\Desktop
                                                                                        • API String ID: 2709904686-224404859
                                                                                        • Opcode ID: 714da30cf500cccbdd7b4a4277d37f3a4e299a669b52a45b343dae58782ad56f
                                                                                        • Instruction ID: c4fcca613fcdd7c15110d01ecf8f186c4298fc2a4ba311cc039d9d6f64372384
                                                                                        • Opcode Fuzzy Hash: 714da30cf500cccbdd7b4a4277d37f3a4e299a669b52a45b343dae58782ad56f
                                                                                        • Instruction Fuzzy Hash: B7D0A7A3408D705EE3036310DC04B9F6A48CF12314F490062F080B61A5C67C1C424BAE
                                                                                        Function 00405A68 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405A78
                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405A90
                                                                                        • CharNextA.USER32(00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AA1
                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00405CC3,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AAA
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000000.00000002.3118719506.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                        • Associated: 00000000.00000002.3118668113.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118748530.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3118799216.0000000000433000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                        • Associated: 00000000.00000002.3119106379.000000000043A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_0_2_400000_Wave Browser.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                        • String ID:
                                                                                        • API String ID: 190613189-0
                                                                                        • Opcode ID: 57b21f4120e00b08a3941e9ed4e610408d9ca53935617fe6296070accebd3829
                                                                                        • Instruction ID: 037941339f6bd63fe355126afe518e0153d46939b0274778cc0aadc7e03f3bf8
                                                                                        • Opcode Fuzzy Hash: 57b21f4120e00b08a3941e9ed4e610408d9ca53935617fe6296070accebd3829
                                                                                        • Instruction Fuzzy Hash: 29F0C231605414AFC702DBA5DC40D9FBBA8EF46350B2541A6E800F7251D234EE01AFA9

                                                                                        Execution Graph

                                                                                        Execution Coverage:8.1%
                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                        Signature Coverage:5.4%
                                                                                        Total number of Nodes:1880
                                                                                        Total number of Limit Nodes:27
                                                                                        execution_graph 12109 d7d1dd 12110 d7d1f6 12109->12110 12111 d7d214 12109->12111 12110->12111 12112 d7c20d 30 API calls 12110->12112 12112->12110 11936 d7c540 11937 d7c57e 11936->11937 11942 d7c54e __dosmaperr 11936->11942 11939 d7a86b _free 14 API calls 11937->11939 11938 d7c569 RtlAllocateHeap 11940 d7c57c 11938->11940 11938->11942 11939->11940 11941 d7d28e __dosmaperr 2 API calls 11941->11942 11942->11937 11942->11938 11942->11941 11943 d72bca 11944 d72bdb 11943->11944 11945 d72ccd 15 API calls 11944->11945 11946 d72bec 11944->11946 11945->11946 12617 d7a277 12618 d7a292 12617->12618 12619 d7a282 12617->12619 12623 d7a298 12619->12623 12622 d7a8db _free 14 API calls 12622->12618 12624 d7a2b3 12623->12624 12625 d7a2ad 12623->12625 12627 d7a8db _free 14 API calls 12624->12627 12626 d7a8db _free 14 API calls 12625->12626 12626->12624 12628 d7a2bf 12627->12628 12629 d7a8db _free 14 API calls 12628->12629 12630 d7a2ca 12629->12630 12631 d7a8db _free 14 API calls 12630->12631 12632 d7a2d5 12631->12632 12633 d7a8db _free 14 API calls 12632->12633 12634 d7a2e0 12633->12634 12635 d7a8db _free 14 API calls 12634->12635 12636 d7a2eb 12635->12636 12637 d7a8db _free 14 API calls 12636->12637 12638 d7a2f6 12637->12638 12639 d7a8db _free 14 API calls 12638->12639 12640 d7a301 12639->12640 12641 d7a8db _free 14 API calls 12640->12641 12642 d7a30c 12641->12642 12643 d7a8db _free 14 API calls 12642->12643 12644 d7a31a 12643->12644 12649 d7a0c4 12644->12649 12650 d7a0d0 ___scrt_is_nonwritable_in_current_image 12649->12650 12665 d7bd84 EnterCriticalSection 12650->12665 12652 d7a104 12666 d7a123 12652->12666 12654 d7a0da 12654->12652 12656 d7a8db _free 14 API calls 12654->12656 12656->12652 12657 d7a12f 12658 d7a13b ___scrt_is_nonwritable_in_current_image 12657->12658 12670 d7bd84 EnterCriticalSection 12658->12670 12660 d7a145 12661 d7a365 __dosmaperr 14 API calls 12660->12661 12662 d7a158 12661->12662 12671 d7a178 12662->12671 12665->12654 12669 d7bdcc LeaveCriticalSection 12666->12669 12668 d7a111 12668->12657 12669->12668 12670->12660 12674 d7bdcc LeaveCriticalSection 12671->12674 12673 d7a166 12673->12622 12674->12673 12720 d77c12 12723 d77b77 12720->12723 12724 d77b83 ___scrt_is_nonwritable_in_current_image 12723->12724 12731 d7bd84 EnterCriticalSection 12724->12731 12726 d77b8d 12727 d77bbb 12726->12727 12730 d7ccd3 __fassign 14 API calls 12726->12730 12732 d77bd9 12727->12732 12730->12726 12731->12726 12735 d7bdcc LeaveCriticalSection 12732->12735 12734 d77bc7 12735->12734 12381 d7d989 12382 d7d8b8 ___scrt_uninitialize_crt 66 API calls 12381->12382 12383 d7d991 12382->12383 12391 d80189 12383->12391 12385 d7d996 12401 d80234 12385->12401 12388 d7d9c0 12389 d7a8db _free 14 API calls 12388->12389 12390 d7d9cb 12389->12390 12392 d80195 ___scrt_is_nonwritable_in_current_image 12391->12392 12405 d7bd84 EnterCriticalSection 12392->12405 12394 d8020c 12419 d8022b 12394->12419 12395 d801a0 12395->12394 12397 d801e0 DeleteCriticalSection 12395->12397 12406 d81fc7 12395->12406 12400 d7a8db _free 14 API calls 12397->12400 12400->12395 12402 d8024b 12401->12402 12403 d7d9a5 DeleteCriticalSection 12401->12403 12402->12403 12404 d7a8db _free 14 API calls 12402->12404 12403->12385 12403->12388 12404->12403 12405->12395 12407 d81fd3 ___scrt_is_nonwritable_in_current_image 12406->12407 12408 d81fdd 12407->12408 12409 d81ff2 12407->12409 12410 d7a86b _free 14 API calls 12408->12410 12415 d81fed 12409->12415 12422 d7d9d5 EnterCriticalSection 12409->12422 12411 d81fe2 12410->12411 12413 d7a7ae ___std_exception_copy 25 API calls 12411->12413 12413->12415 12414 d8200f 12423 d81f50 12414->12423 12415->12395 12417 d8201a 12439 d82041 12417->12439 12498 d7bdcc LeaveCriticalSection 12419->12498 12421 d80218 12421->12385 12422->12414 12424 d81f5d 12423->12424 12425 d81f72 12423->12425 12426 d7a86b _free 14 API calls 12424->12426 12427 d7d80b ___scrt_uninitialize_crt 62 API calls 12425->12427 12437 d81f6d 12425->12437 12428 d81f62 12426->12428 12429 d81f87 12427->12429 12430 d7a7ae ___std_exception_copy 25 API calls 12428->12430 12431 d80234 14 API calls 12429->12431 12430->12437 12432 d81f8f 12431->12432 12433 d7eacc ___scrt_uninitialize_crt 25 API calls 12432->12433 12434 d81f95 12433->12434 12442 d82677 12434->12442 12437->12417 12438 d7a8db _free 14 API calls 12438->12437 12497 d7d9e9 LeaveCriticalSection 12439->12497 12441 d82049 12441->12415 12443 d82688 12442->12443 12444 d8269d 12442->12444 12445 d7a858 __dosmaperr 14 API calls 12443->12445 12446 d826e6 12444->12446 12451 d826c4 12444->12451 12447 d8268d 12445->12447 12448 d7a858 __dosmaperr 14 API calls 12446->12448 12450 d7a86b _free 14 API calls 12447->12450 12449 d826eb 12448->12449 12452 d7a86b _free 14 API calls 12449->12452 12455 d81f9b 12450->12455 12457 d825eb 12451->12457 12454 d826f3 12452->12454 12456 d7a7ae ___std_exception_copy 25 API calls 12454->12456 12455->12437 12455->12438 12456->12455 12458 d825f7 ___scrt_is_nonwritable_in_current_image 12457->12458 12468 d7bf62 EnterCriticalSection 12458->12468 12460 d82605 12461 d8262c 12460->12461 12462 d82637 12460->12462 12469 d82704 12461->12469 12464 d7a86b _free 14 API calls 12462->12464 12465 d82632 12464->12465 12484 d8266b 12465->12484 12468->12460 12470 d7c039 ___scrt_uninitialize_crt 25 API calls 12469->12470 12472 d82714 12470->12472 12471 d8271a 12487 d7bfa8 12471->12487 12472->12471 12474 d7c039 ___scrt_uninitialize_crt 25 API calls 12472->12474 12483 d8274c 12472->12483 12477 d82743 12474->12477 12475 d7c039 ___scrt_uninitialize_crt 25 API calls 12478 d82758 CloseHandle 12475->12478 12480 d7c039 ___scrt_uninitialize_crt 25 API calls 12477->12480 12478->12471 12481 d82764 GetLastError 12478->12481 12479 d82794 12479->12465 12480->12483 12481->12471 12482 d7a835 __dosmaperr 14 API calls 12482->12479 12483->12471 12483->12475 12496 d7bf85 LeaveCriticalSection 12484->12496 12486 d82654 12486->12455 12488 d7bfb7 12487->12488 12489 d7c01e 12487->12489 12488->12489 12494 d7bfe1 12488->12494 12490 d7a86b _free 14 API calls 12489->12490 12491 d7c023 12490->12491 12492 d7a858 __dosmaperr 14 API calls 12491->12492 12493 d7c00e 12492->12493 12493->12479 12493->12482 12494->12493 12495 d7c008 SetStdHandle 12494->12495 12495->12493 12496->12486 12497->12441 12498->12421 9825 d74ea4 9826 d74eb0 ___scrt_is_nonwritable_in_current_image 9825->9826 9853 d750a0 9826->9853 9828 d7500a 9916 d7538b IsProcessorFeaturePresent 9828->9916 9830 d74eb7 9830->9828 9840 d74ee1 ___scrt_is_nonwritable_in_current_image __fassign ___scrt_release_startup_lock 9830->9840 9831 d75011 9896 d77b24 9831->9896 9836 d74f00 9837 d74f81 9864 d754a5 9837->9864 9840->9836 9840->9837 9899 d77afe 9840->9899 9848 d74fa7 9849 d74fb0 9848->9849 9907 d77ad9 9848->9907 9910 d75211 9849->9910 9854 d750a9 9853->9854 9923 d75638 IsProcessorFeaturePresent 9854->9923 9858 d750ba 9859 d750be 9858->9859 9933 d7812a 9858->9933 9859->9830 9862 d750d5 9862->9830 10194 d75c40 9864->10194 9867 d74f87 9868 d777c2 9867->9868 10196 d7b808 9868->10196 9870 d74f8f 9873 d72445 GetModuleHandleW GetProcAddress 9870->9873 9871 d777cb 9871->9870 10202 d7bb2e 9871->10202 9874 d72466 9873->9874 9875 d7246d CoInitializeEx 9873->9875 9874->9875 9876 d7248b 9875->9876 9877 d72480 9875->9877 10713 d7238f 9876->10713 10617 d713a0 9877->10617 9882 d7249b 10622 d7274d 9882->10622 9889 d727fc 41 API calls 9890 d724c8 9889->9890 9891 d727fc 41 API calls 9890->9891 9892 d724d0 9891->9892 10640 d71889 9892->10640 11690 d779c2 9896->11690 9900 d77b14 ___scrt_is_nonwritable_in_current_image __dosmaperr 9899->9900 9900->9837 9901 d7a3b0 __fassign 37 API calls 9900->9901 9904 d781dc 9901->9904 9902 d78287 __fassign 37 API calls 9903 d78206 9902->9903 9904->9902 9905 d754db GetModuleHandleW 9906 d74fa3 9905->9906 9906->9831 9906->9848 9908 d779c2 __fassign 23 API calls 9907->9908 9909 d77ae4 9908->9909 9909->9849 9911 d7521d 9910->9911 9912 d74fb8 9911->9912 11760 d7813c 9911->11760 9912->9836 9914 d7522b 9915 d75b0d ___scrt_uninitialize_crt 7 API calls 9914->9915 9915->9912 9917 d753a0 ___scrt_fastfail 9916->9917 9918 d7544b IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 9917->9918 9919 d75496 ___scrt_fastfail 9918->9919 9919->9831 9920 d77ae8 9921 d779c2 __fassign 23 API calls 9920->9921 9922 d7501f 9921->9922 9924 d750b5 9923->9924 9925 d75aee 9924->9925 9942 d7606a 9925->9942 9928 d75af7 9928->9858 9930 d75aff 9931 d75b0a 9930->9931 9956 d760a6 9930->9956 9931->9858 9998 d7d1e6 9933->9998 9936 d75b0d 9937 d75b16 9936->9937 9938 d75b20 9936->9938 9939 d7604f ___vcrt_uninitialize_ptd 6 API calls 9937->9939 9938->9859 9940 d75b1b 9939->9940 9941 d760a6 ___vcrt_uninitialize_locks DeleteCriticalSection 9940->9941 9941->9938 9943 d76073 9942->9943 9945 d7609c 9943->9945 9946 d75af3 9943->9946 9960 d763f0 9943->9960 9947 d760a6 ___vcrt_uninitialize_locks DeleteCriticalSection 9945->9947 9946->9928 9948 d7601c 9946->9948 9947->9946 9979 d76301 9948->9979 9953 d7604c 9953->9930 9955 d76031 9955->9930 9957 d760b1 9956->9957 9959 d760d0 9956->9959 9958 d760bb DeleteCriticalSection 9957->9958 9958->9958 9958->9959 9959->9928 9965 d762b8 9960->9965 9963 d76428 InitializeCriticalSectionAndSpinCount 9964 d76413 9963->9964 9964->9943 9966 d762f3 9965->9966 9967 d762d0 9965->9967 9966->9963 9966->9964 9967->9966 9971 d7621e 9967->9971 9970 d762e5 GetProcAddress 9970->9966 9973 d7622a ___vcrt_FlsFree 9971->9973 9972 d7629e 9972->9966 9972->9970 9973->9972 9974 d76240 LoadLibraryExW 9973->9974 9978 d76280 LoadLibraryExW 9973->9978 9975 d762a5 9974->9975 9976 d7625e GetLastError 9974->9976 9975->9972 9977 d762ad FreeLibrary 9975->9977 9976->9973 9977->9972 9978->9973 9978->9975 9980 d762b8 ___vcrt_FlsFree 5 API calls 9979->9980 9981 d7631b 9980->9981 9982 d76334 TlsAlloc 9981->9982 9983 d76026 9981->9983 9983->9955 9984 d763b2 9983->9984 9985 d762b8 ___vcrt_FlsFree 5 API calls 9984->9985 9986 d763cc 9985->9986 9987 d763e7 TlsSetValue 9986->9987 9988 d7603f 9986->9988 9987->9988 9988->9953 9989 d7604f 9988->9989 9990 d7605f 9989->9990 9991 d76059 9989->9991 9990->9955 9993 d7633c 9991->9993 9994 d762b8 ___vcrt_FlsFree 5 API calls 9993->9994 9995 d76356 9994->9995 9996 d7636e TlsFree 9995->9996 9997 d76362 9995->9997 9996->9997 9997->9990 9999 d7d1f6 9998->9999 10000 d750c7 9998->10000 9999->10000 10002 d7c20d 9999->10002 10000->9862 10000->9936 10003 d7c219 ___scrt_is_nonwritable_in_current_image 10002->10003 10014 d7bd84 EnterCriticalSection 10003->10014 10005 d7c220 10015 d7bec4 10005->10015 10008 d7c23e 10039 d7c264 10008->10039 10014->10005 10016 d7bed0 ___scrt_is_nonwritable_in_current_image 10015->10016 10017 d7befa 10016->10017 10018 d7bed9 10016->10018 10042 d7bd84 EnterCriticalSection 10017->10042 10050 d7a86b 10018->10050 10023 d7bee8 10023->10008 10028 d7c0a3 GetStartupInfoW 10023->10028 10024 d7bf06 10027 d7bf32 10024->10027 10043 d7be14 10024->10043 10056 d7bf59 10027->10056 10029 d7c0c0 10028->10029 10031 d7c154 10028->10031 10030 d7bec4 26 API calls 10029->10030 10029->10031 10032 d7c0e8 10030->10032 10034 d7c159 10031->10034 10032->10031 10033 d7c118 GetFileType 10032->10033 10033->10032 10036 d7c160 10034->10036 10035 d7c1a3 GetStdHandle 10035->10036 10036->10035 10037 d7c209 10036->10037 10038 d7c1b6 GetFileType 10036->10038 10037->10008 10038->10036 10193 d7bdcc LeaveCriticalSection 10039->10193 10041 d7c24f 10041->9999 10042->10024 10059 d7a87e 10043->10059 10045 d7be33 10071 d7a8db 10045->10071 10047 d7be26 10047->10045 10066 d7d019 10047->10066 10049 d7be88 10049->10024 10103 d7a507 GetLastError 10050->10103 10052 d7a870 10053 d7a7ae 10052->10053 10167 d7a74a 10053->10167 10055 d7a7ba 10055->10023 10192 d7bdcc LeaveCriticalSection 10056->10192 10058 d7bf60 10058->10023 10064 d7a88b __dosmaperr 10059->10064 10060 d7a8b6 RtlAllocateHeap 10062 d7a8c9 10060->10062 10060->10064 10061 d7a8cb 10063 d7a86b _free 13 API calls 10061->10063 10062->10047 10063->10062 10064->10060 10064->10061 10077 d7d28e 10064->10077 10090 d7ce38 10066->10090 10068 d7d035 10069 d7d053 InitializeCriticalSectionAndSpinCount 10068->10069 10070 d7d03e 10068->10070 10069->10070 10070->10047 10072 d7a8e6 RtlFreeHeap 10071->10072 10076 d7a90f _free 10071->10076 10073 d7a8fb 10072->10073 10072->10076 10074 d7a86b _free 12 API calls 10073->10074 10075 d7a901 GetLastError 10074->10075 10075->10076 10076->10049 10080 d7d2bb 10077->10080 10081 d7d2c7 ___scrt_is_nonwritable_in_current_image 10080->10081 10086 d7bd84 EnterCriticalSection 10081->10086 10083 d7d2d2 10087 d7d30e 10083->10087 10086->10083 10088 d7bdcc __fassign LeaveCriticalSection 10087->10088 10089 d7d299 10088->10089 10089->10064 10091 d7ce66 10090->10091 10095 d7ce62 __dosmaperr 10090->10095 10091->10095 10096 d7cd71 10091->10096 10094 d7ce80 GetProcAddress 10094->10095 10095->10068 10101 d7cd82 ___vcrt_FlsFree 10096->10101 10097 d7ce2d 10097->10094 10097->10095 10098 d7cda0 LoadLibraryExW 10099 d7cdbb GetLastError 10098->10099 10098->10101 10099->10101 10100 d7ce16 FreeLibrary 10100->10101 10101->10097 10101->10098 10101->10100 10102 d7cdee LoadLibraryExW 10101->10102 10102->10101 10104 d7a51e 10103->10104 10107 d7a524 10103->10107 10126 d7cf98 10104->10126 10125 d7a52a SetLastError 10107->10125 10131 d7cfd7 10107->10131 10109 d7a87e __dosmaperr 12 API calls 10111 d7a552 10109->10111 10112 d7a571 10111->10112 10113 d7a55a 10111->10113 10115 d7cfd7 __dosmaperr 6 API calls 10112->10115 10114 d7cfd7 __dosmaperr 6 API calls 10113->10114 10116 d7a568 10114->10116 10117 d7a57d 10115->10117 10122 d7a8db _free 12 API calls 10116->10122 10118 d7a592 10117->10118 10119 d7a581 10117->10119 10136 d7a1de 10118->10136 10120 d7cfd7 __dosmaperr 6 API calls 10119->10120 10120->10116 10122->10125 10124 d7a8db _free 12 API calls 10124->10125 10125->10052 10127 d7ce38 __dosmaperr 5 API calls 10126->10127 10128 d7cfb4 10127->10128 10129 d7cfcf TlsGetValue 10128->10129 10130 d7cfbd 10128->10130 10130->10107 10132 d7ce38 __dosmaperr 5 API calls 10131->10132 10133 d7cff3 10132->10133 10134 d7d011 TlsSetValue 10133->10134 10135 d7a542 10133->10135 10135->10109 10135->10125 10141 d7a072 10136->10141 10142 d7a07e ___scrt_is_nonwritable_in_current_image 10141->10142 10155 d7bd84 EnterCriticalSection 10142->10155 10144 d7a088 10156 d7a0b8 10144->10156 10147 d7a184 10148 d7a190 ___scrt_is_nonwritable_in_current_image 10147->10148 10159 d7bd84 EnterCriticalSection 10148->10159 10150 d7a19a 10160 d7a365 10150->10160 10152 d7a1b2 10164 d7a1d2 10152->10164 10155->10144 10157 d7bdcc __fassign LeaveCriticalSection 10156->10157 10158 d7a0a6 10157->10158 10158->10147 10159->10150 10161 d7a39b __dosmaperr 10160->10161 10162 d7a374 __dosmaperr 10160->10162 10161->10152 10162->10161 10163 d7ca06 __dosmaperr 14 API calls 10162->10163 10163->10161 10165 d7bdcc __fassign LeaveCriticalSection 10164->10165 10166 d7a1c0 10165->10166 10166->10124 10168 d7a507 __dosmaperr 14 API calls 10167->10168 10169 d7a755 10168->10169 10171 d7a763 10169->10171 10175 d7a7be IsProcessorFeaturePresent 10169->10175 10171->10055 10172 d7a7ad 10173 d7a74a ___std_exception_copy 25 API calls 10172->10173 10174 d7a7ba 10173->10174 10174->10055 10176 d7a7ca 10175->10176 10179 d7a602 10176->10179 10180 d7a61e ___scrt_fastfail 10179->10180 10181 d7a64a IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 10180->10181 10182 d7a71b ___scrt_fastfail 10181->10182 10185 d75814 10182->10185 10184 d7a739 GetCurrentProcess TerminateProcess 10184->10172 10186 d7581f IsProcessorFeaturePresent 10185->10186 10187 d7581d 10185->10187 10189 d75861 10186->10189 10187->10184 10190 d75825 ___raise_securityfailure SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 10189->10190 10191 d75944 10190->10191 10191->10184 10192->10058 10193->10041 10195 d754b8 GetStartupInfoW 10194->10195 10195->9867 10197 d7b811 10196->10197 10201 d7b843 10196->10201 10205 d7a46d 10197->10205 10201->9871 10614 d7bad7 10202->10614 10206 d7a47e 10205->10206 10207 d7a478 10205->10207 10208 d7cfd7 __dosmaperr 6 API calls 10206->10208 10229 d7a484 10206->10229 10209 d7cf98 __dosmaperr 6 API calls 10207->10209 10210 d7a498 10208->10210 10209->10206 10211 d7a87e __dosmaperr 14 API calls 10210->10211 10210->10229 10213 d7a4a8 10211->10213 10215 d7a4c5 10213->10215 10216 d7a4b0 10213->10216 10219 d7cfd7 __dosmaperr 6 API calls 10215->10219 10218 d7cfd7 __dosmaperr 6 API calls 10216->10218 10217 d7a4fd 10230 d7b64f 10217->10230 10223 d7a4bc 10218->10223 10220 d7a4d1 10219->10220 10221 d7a4d5 10220->10221 10222 d7a4e4 10220->10222 10224 d7cfd7 __dosmaperr 6 API calls 10221->10224 10225 d7a1de __dosmaperr 14 API calls 10222->10225 10226 d7a8db _free 14 API calls 10223->10226 10224->10223 10227 d7a4ef 10225->10227 10226->10229 10228 d7a8db _free 14 API calls 10227->10228 10228->10229 10229->10217 10249 d78287 10229->10249 10338 d7b768 10230->10338 10235 d7b67b 10235->10201 10239 d7b6be 10241 d7a8db _free 14 API calls 10239->10241 10242 d7b6cc 10241->10242 10242->10201 10243 d7b6b9 10244 d7a86b _free 14 API calls 10243->10244 10244->10239 10245 d7b700 10245->10239 10374 d7b2ea 10245->10374 10246 d7b6d4 10246->10245 10247 d7a8db _free 14 API calls 10246->10247 10247->10245 10260 d7d3e5 10249->10260 10252 d78297 10254 d782c0 10252->10254 10255 d782a1 IsProcessorFeaturePresent 10252->10255 10257 d77ae8 __fassign 23 API calls 10254->10257 10256 d782ad 10255->10256 10258 d7a602 ___std_exception_copy 8 API calls 10256->10258 10259 d782ca 10257->10259 10258->10254 10290 d7d317 10260->10290 10263 d7d433 10264 d7d43f ___scrt_is_nonwritable_in_current_image 10263->10264 10265 d7a507 __dosmaperr 14 API calls 10264->10265 10269 d7d46c __fassign 10264->10269 10270 d7d466 __fassign 10264->10270 10265->10270 10266 d7d4b1 10267 d7a86b _free 14 API calls 10266->10267 10268 d7d4b6 10267->10268 10271 d7a7ae ___std_exception_copy 25 API calls 10268->10271 10273 d7d4dd 10269->10273 10301 d7bd84 EnterCriticalSection 10269->10301 10270->10266 10270->10269 10289 d7d49b 10270->10289 10271->10289 10275 d7d525 10273->10275 10276 d7d61a 10273->10276 10286 d7d550 10273->10286 10275->10286 10302 d7d42a 10275->10302 10278 d7d625 10276->10278 10336 d7bdcc LeaveCriticalSection 10276->10336 10279 d77ae8 __fassign 23 API calls 10278->10279 10281 d7d62d 10279->10281 10285 d7d42a __fassign 37 API calls 10285->10286 10305 d7d5c6 10286->10305 10287 d7d5a4 10288 d7a3b0 __fassign 37 API calls 10287->10288 10287->10289 10288->10289 10289->10252 10291 d7d323 ___scrt_is_nonwritable_in_current_image 10290->10291 10296 d7bd84 EnterCriticalSection 10291->10296 10293 d7d331 10297 d7d36f 10293->10297 10296->10293 10300 d7bdcc LeaveCriticalSection 10297->10300 10299 d7828c 10299->10252 10299->10263 10300->10299 10301->10273 10303 d7a3b0 __fassign 37 API calls 10302->10303 10304 d7d42f 10303->10304 10304->10285 10306 d7d595 10305->10306 10307 d7d5cc 10305->10307 10306->10287 10306->10289 10309 d7a3b0 GetLastError 10306->10309 10337 d7bdcc LeaveCriticalSection 10307->10337 10310 d7a3c7 10309->10310 10311 d7a3cd 10309->10311 10312 d7cf98 __dosmaperr 6 API calls 10310->10312 10313 d7cfd7 __dosmaperr 6 API calls 10311->10313 10332 d7a3d3 SetLastError 10311->10332 10312->10311 10314 d7a3eb 10313->10314 10315 d7a87e __dosmaperr 14 API calls 10314->10315 10314->10332 10317 d7a3fb 10315->10317 10320 d7a403 10317->10320 10321 d7a41a 10317->10321 10318 d7a467 10322 d78287 __fassign 35 API calls 10318->10322 10319 d7a461 10319->10287 10324 d7cfd7 __dosmaperr 6 API calls 10320->10324 10323 d7cfd7 __dosmaperr 6 API calls 10321->10323 10325 d7a46c 10322->10325 10326 d7a426 10323->10326 10333 d7a411 10324->10333 10327 d7a43b 10326->10327 10328 d7a42a 10326->10328 10331 d7a1de __dosmaperr 14 API calls 10327->10331 10330 d7cfd7 __dosmaperr 6 API calls 10328->10330 10329 d7a8db _free 14 API calls 10329->10332 10330->10333 10334 d7a446 10331->10334 10332->10318 10332->10319 10333->10329 10335 d7a8db _free 14 API calls 10334->10335 10335->10332 10336->10278 10337->10306 10339 d7b774 ___scrt_is_nonwritable_in_current_image 10338->10339 10341 d7b78e 10339->10341 10382 d7bd84 EnterCriticalSection 10339->10382 10343 d7b662 10341->10343 10345 d78287 __fassign 37 API calls 10341->10345 10342 d7b7ca 10383 d7b7e7 10342->10383 10349 d7b3f8 10343->10349 10346 d7b807 10345->10346 10347 d7b79e 10347->10342 10348 d7a8db _free 14 API calls 10347->10348 10348->10342 10387 d787d5 10349->10387 10352 d7b42b 10354 d7b442 10352->10354 10355 d7b430 GetACP 10352->10355 10353 d7b419 GetOEMCP 10353->10354 10354->10235 10356 d7c540 10354->10356 10355->10354 10357 d7c57e 10356->10357 10362 d7c54e __dosmaperr 10356->10362 10359 d7a86b _free 14 API calls 10357->10359 10358 d7c569 RtlAllocateHeap 10360 d7b68c 10358->10360 10358->10362 10359->10360 10360->10239 10363 d7b863 10360->10363 10361 d7d28e __dosmaperr 2 API calls 10361->10362 10362->10357 10362->10358 10362->10361 10364 d7b3f8 39 API calls 10363->10364 10365 d7b883 10364->10365 10367 d7b8bd IsValidCodePage 10365->10367 10371 d7b8f9 ___scrt_fastfail 10365->10371 10366 d75814 _ValidateLocalCookies 5 API calls 10368 d7b6b1 10366->10368 10369 d7b8cf 10367->10369 10367->10371 10368->10243 10368->10246 10370 d7b8fe GetCPInfo 10369->10370 10373 d7b8d8 ___scrt_fastfail 10369->10373 10370->10371 10370->10373 10371->10366 10504 d7b4ce 10373->10504 10375 d7b2f6 ___scrt_is_nonwritable_in_current_image 10374->10375 10588 d7bd84 EnterCriticalSection 10375->10588 10377 d7b300 10589 d7b337 10377->10589 10382->10347 10386 d7bdcc LeaveCriticalSection 10383->10386 10385 d7b7ee 10385->10341 10386->10385 10388 d787f5 10387->10388 10394 d787ec 10387->10394 10389 d7a3b0 __fassign 37 API calls 10388->10389 10388->10394 10390 d78815 10389->10390 10395 d7e0ec 10390->10395 10394->10352 10394->10353 10396 d7e0ff 10395->10396 10398 d7882b 10395->10398 10396->10398 10403 d7cc52 10396->10403 10399 d7e119 10398->10399 10400 d7e141 10399->10400 10401 d7e12c 10399->10401 10400->10394 10401->10400 10499 d7b850 10401->10499 10404 d7cc5e ___scrt_is_nonwritable_in_current_image 10403->10404 10405 d7a3b0 __fassign 37 API calls 10404->10405 10406 d7cc67 10405->10406 10407 d7ccad 10406->10407 10416 d7bd84 EnterCriticalSection 10406->10416 10407->10398 10409 d7cc85 10417 d7ccd3 10409->10417 10414 d78287 __fassign 37 API calls 10415 d7ccd2 10414->10415 10416->10409 10418 d7cce1 __dosmaperr 10417->10418 10419 d7cc96 10417->10419 10418->10419 10424 d7ca06 10418->10424 10421 d7ccb2 10419->10421 10498 d7bdcc LeaveCriticalSection 10421->10498 10423 d7cca9 10423->10407 10423->10414 10425 d7ca1c 10424->10425 10427 d7ca86 10424->10427 10425->10427 10431 d7ca4f 10425->10431 10435 d7a8db _free 14 API calls 10425->10435 10428 d7a8db _free 14 API calls 10427->10428 10450 d7cad4 10427->10450 10429 d7caa8 10428->10429 10432 d7a8db _free 14 API calls 10429->10432 10430 d7ca71 10434 d7a8db _free 14 API calls 10430->10434 10431->10430 10436 d7a8db _free 14 API calls 10431->10436 10433 d7cabb 10432->10433 10437 d7a8db _free 14 API calls 10433->10437 10438 d7ca7b 10434->10438 10440 d7ca44 10435->10440 10441 d7ca66 10436->10441 10442 d7cac9 10437->10442 10443 d7a8db _free 14 API calls 10438->10443 10439 d7cb42 10444 d7a8db _free 14 API calls 10439->10444 10452 d7c299 10440->10452 10480 d7c397 10441->10480 10447 d7a8db _free 14 API calls 10442->10447 10443->10427 10448 d7cb48 10444->10448 10447->10450 10448->10419 10449 d7cae2 10449->10439 10451 d7a8db 14 API calls _free 10449->10451 10492 d7cb77 10450->10492 10451->10449 10453 d7c2aa 10452->10453 10479 d7c393 10452->10479 10454 d7c2bb 10453->10454 10455 d7a8db _free 14 API calls 10453->10455 10456 d7c2cd 10454->10456 10457 d7a8db _free 14 API calls 10454->10457 10455->10454 10458 d7c2df 10456->10458 10459 d7a8db _free 14 API calls 10456->10459 10457->10456 10460 d7a8db _free 14 API calls 10458->10460 10462 d7c2f1 10458->10462 10459->10458 10460->10462 10461 d7c303 10464 d7c315 10461->10464 10465 d7a8db _free 14 API calls 10461->10465 10462->10461 10463 d7a8db _free 14 API calls 10462->10463 10463->10461 10466 d7c327 10464->10466 10467 d7a8db _free 14 API calls 10464->10467 10465->10464 10468 d7c339 10466->10468 10469 d7a8db _free 14 API calls 10466->10469 10467->10466 10470 d7c34b 10468->10470 10471 d7a8db _free 14 API calls 10468->10471 10469->10468 10472 d7c35d 10470->10472 10473 d7a8db _free 14 API calls 10470->10473 10471->10470 10474 d7c36f 10472->10474 10475 d7a8db _free 14 API calls 10472->10475 10473->10472 10476 d7c381 10474->10476 10477 d7a8db _free 14 API calls 10474->10477 10475->10474 10478 d7a8db _free 14 API calls 10476->10478 10476->10479 10477->10476 10478->10479 10479->10431 10482 d7c3a4 10480->10482 10491 d7c3fc 10480->10491 10481 d7c3b4 10484 d7c3c6 10481->10484 10486 d7a8db _free 14 API calls 10481->10486 10482->10481 10483 d7a8db _free 14 API calls 10482->10483 10483->10481 10485 d7c3d8 10484->10485 10487 d7a8db _free 14 API calls 10484->10487 10488 d7c3ea 10485->10488 10489 d7a8db _free 14 API calls 10485->10489 10486->10484 10487->10485 10490 d7a8db _free 14 API calls 10488->10490 10488->10491 10489->10488 10490->10491 10491->10430 10493 d7cba3 10492->10493 10494 d7cb84 10492->10494 10493->10449 10494->10493 10495 d7c438 __dosmaperr 14 API calls 10494->10495 10496 d7cb9d 10495->10496 10497 d7a8db _free 14 API calls 10496->10497 10497->10493 10498->10423 10500 d7a3b0 __fassign 37 API calls 10499->10500 10501 d7b85a 10500->10501 10502 d7b768 __fassign 37 API calls 10501->10502 10503 d7b860 10502->10503 10503->10400 10505 d7b4f6 GetCPInfo 10504->10505 10506 d7b5bf 10504->10506 10505->10506 10507 d7b50e 10505->10507 10508 d75814 _ValidateLocalCookies 5 API calls 10506->10508 10515 d7c866 10507->10515 10510 d7b64d 10508->10510 10510->10371 10514 d7f45e 41 API calls 10514->10506 10516 d787d5 __fassign 37 API calls 10515->10516 10517 d7c886 10516->10517 10535 d7bb5f 10517->10535 10519 d7c944 10521 d75814 _ValidateLocalCookies 5 API calls 10519->10521 10520 d7c8b3 10520->10519 10524 d7c540 15 API calls 10520->10524 10526 d7c8d9 ___scrt_fastfail 10520->10526 10522 d7b576 10521->10522 10530 d7f45e 10522->10530 10523 d7c93e 10538 d7c969 10523->10538 10524->10526 10526->10523 10527 d7bb5f __fassign MultiByteToWideChar 10526->10527 10528 d7c927 10527->10528 10528->10523 10529 d7c92e GetStringTypeW 10528->10529 10529->10523 10531 d787d5 __fassign 37 API calls 10530->10531 10532 d7f471 10531->10532 10542 d7f274 10532->10542 10536 d7bb70 MultiByteToWideChar 10535->10536 10536->10520 10539 d7c986 10538->10539 10540 d7c975 10538->10540 10539->10519 10540->10539 10541 d7a8db _free 14 API calls 10540->10541 10541->10539 10543 d7f28f 10542->10543 10544 d7bb5f __fassign MultiByteToWideChar 10543->10544 10546 d7f2d3 10544->10546 10545 d75814 _ValidateLocalCookies 5 API calls 10547 d7b597 10545->10547 10548 d7c540 15 API calls 10546->10548 10550 d7f2f8 10546->10550 10554 d7f438 10546->10554 10547->10514 10548->10550 10549 d7f39d 10553 d7c969 __freea 14 API calls 10549->10553 10550->10549 10551 d7bb5f __fassign MultiByteToWideChar 10550->10551 10552 d7f33e 10551->10552 10552->10549 10570 d7d064 10552->10570 10553->10554 10554->10545 10557 d7f374 10557->10549 10559 d7d064 6 API calls 10557->10559 10558 d7f3ac 10561 d7c540 15 API calls 10558->10561 10564 d7f3be 10558->10564 10559->10549 10560 d7f429 10563 d7c969 __freea 14 API calls 10560->10563 10561->10564 10562 d7d064 6 API calls 10565 d7f406 10562->10565 10563->10549 10564->10560 10564->10562 10565->10560 10576 d7bbdb 10565->10576 10567 d7f420 10567->10560 10568 d7f455 10567->10568 10569 d7c969 __freea 14 API calls 10568->10569 10569->10549 10579 d7cd3d 10570->10579 10574 d7d0b5 LCMapStringW 10575 d7d075 10574->10575 10575->10549 10575->10557 10575->10558 10578 d7bbf4 WideCharToMultiByte 10576->10578 10578->10567 10580 d7ce38 __dosmaperr 5 API calls 10579->10580 10581 d7cd53 10580->10581 10581->10575 10582 d7d0c1 10581->10582 10585 d7cd57 10582->10585 10584 d7d0cc 10584->10574 10586 d7ce38 __dosmaperr 5 API calls 10585->10586 10587 d7cd6d 10586->10587 10587->10584 10588->10377 10599 d7ba56 10589->10599 10591 d7b359 10592 d7ba56 25 API calls 10591->10592 10593 d7b378 10592->10593 10594 d7b30d 10593->10594 10595 d7a8db _free 14 API calls 10593->10595 10596 d7b32b 10594->10596 10595->10594 10613 d7bdcc LeaveCriticalSection 10596->10613 10598 d7b319 10598->10239 10600 d7ba67 10599->10600 10604 d7ba63 ___scrt_uninitialize_crt 10599->10604 10601 d7ba6e 10600->10601 10606 d7ba81 ___scrt_fastfail 10600->10606 10602 d7a86b _free 14 API calls 10601->10602 10603 d7ba73 10602->10603 10605 d7a7ae ___std_exception_copy 25 API calls 10603->10605 10604->10591 10605->10604 10606->10604 10607 d7baaf 10606->10607 10608 d7bab8 10606->10608 10609 d7a86b _free 14 API calls 10607->10609 10608->10604 10610 d7a86b _free 14 API calls 10608->10610 10611 d7bab4 10609->10611 10610->10611 10612 d7a7ae ___std_exception_copy 25 API calls 10611->10612 10612->10604 10613->10598 10615 d787d5 __fassign 37 API calls 10614->10615 10616 d7baeb 10615->10616 10616->9871 10618 d75c40 ___scrt_fastfail 10617->10618 10619 d713df VerSetConditionMask VerSetConditionMask VerSetConditionMask VerifyVersionInfoW 10618->10619 10620 d75814 _ValidateLocalCookies 5 API calls 10619->10620 10621 d71442 10620->10621 10621->9876 10621->9882 10741 d711d5 10622->10741 10625 d72792 10774 d7103b 10625->10774 10628 d72783 10756 d729c1 10628->10756 10629 d7275e 10629->10628 10630 d72776 10629->10630 10765 d7266f 10630->10765 10633 d724ac 10634 d727fc 10633->10634 10635 d711d5 40 API calls 10634->10635 10636 d72804 10635->10636 10637 d724b4 10636->10637 10638 d7103b RaiseException 10636->10638 10637->9889 10639 d72822 10638->10639 10941 d71d1e IsUserAnAdmin 10640->10941 10643 d718b8 10647 d718bc 10643->10647 10965 d71e65 10643->10965 10649 d75814 _ValidateLocalCookies 5 API calls 10647->10649 10650 d71aae 10649->10650 10692 d71814 10650->10692 10652 d718e3 10653 d7192e 10652->10653 10690 d719e4 10652->10690 10990 d72fff 10652->10990 11017 d71f73 10653->11017 10658 d72b77 14 API calls 10659 d71955 10658->10659 10660 d72823 RaiseException 10659->10660 10661 d71975 PathQuoteSpacesW 10660->10661 11035 d7254a 10661->11035 10663 d71989 ___scrt_fastfail 10664 d7199a GetModuleFileNameW 10663->10664 10665 d719bc 10664->10665 10666 d719af 10664->10666 10668 d71a0c 10665->10668 10669 d719cb 10665->10669 10666->10665 11039 d714cc 10666->11039 11050 d71447 10668->11050 10671 d719cf 10669->10671 10672 d719e9 10669->10672 10675 d7238f 59 API calls 10671->10675 10673 d71447 58 API calls 10672->10673 10676 d71a07 10673->10676 10678 d719db 10675->10678 11087 d71bc1 10676->11087 11144 d72b5c 10678->11144 10682 d71a64 11108 d7328c 10682->11108 10684 d71a72 10688 d72b5c RtlFreeHeap 10684->10688 10685 d7274d 50 API calls 10686 d71a47 10685->10686 10687 d71447 58 API calls 10686->10687 10689 d71a58 10687->10689 10688->10690 10691 d72b5c RtlFreeHeap 10689->10691 11124 d72fca 10690->11124 10691->10682 10693 d71825 10692->10693 10703 d7185b 10692->10703 10694 d71842 10693->10694 10695 d72570 RaiseException 10693->10695 10696 d72595 15 API calls 10694->10696 10698 d71834 DeleteFileW 10695->10698 10699 d71849 RemoveDirectoryW 10696->10699 10697 d72b5c RtlFreeHeap 10700 d71868 10697->10700 10698->10693 10698->10694 10701 d7285f 26 API calls 10699->10701 10702 d72b5c RtlFreeHeap 10700->10702 10701->10703 10704 d7186f 10702->10704 10703->10697 10705 d72595 15 API calls 10704->10705 10706 d71876 10705->10706 10707 d72b5c RtlFreeHeap 10706->10707 10708 d7187e 10707->10708 10709 d7265b 10710 d72663 10709->10710 10711 d724ea 10709->10711 10710->10711 10712 d72668 CoUninitialize 10710->10712 10711->9905 10712->10711 10714 d727fc 41 API calls 10713->10714 10715 d723a1 10714->10715 10716 d723ae 10715->10716 10717 d723bd 10715->10717 10718 d7266f 33 API calls 10716->10718 10719 d727fc 41 API calls 10717->10719 10720 d723bb 10718->10720 10721 d723c5 10719->10721 10724 d727fc 41 API calls 10720->10724 10722 d7266f 33 API calls 10721->10722 10723 d723ce 10722->10723 11654 d72d52 10723->11654 10726 d723f2 10724->10726 10728 d727fc 41 API calls 10726->10728 10727 d723df 10729 d72b5c RtlFreeHeap 10727->10729 10730 d723fa 10728->10730 10729->10720 10731 d7266f 33 API calls 10730->10731 10732 d72403 10731->10732 10733 d72d52 58 API calls 10732->10733 10734 d72414 10733->10734 10735 d72b5c RtlFreeHeap 10734->10735 10736 d7241f MessageBoxW 10735->10736 10737 d72b5c RtlFreeHeap 10736->10737 10738 d72437 10737->10738 10739 d72b5c RtlFreeHeap 10738->10739 10740 d7243f 10739->10740 10740->10709 10742 d71203 10741->10742 10754 d711ec 10741->10754 10780 d84d32 EnterCriticalSection 10742->10780 10744 d84d32 6 API calls 10746 d71253 10744->10746 10745 d7120e 10747 d71218 GetProcessHeap 10745->10747 10745->10754 10749 d75266 28 API calls 10746->10749 10755 d711fe 10746->10755 10785 d75266 10747->10785 10751 d712a0 10749->10751 10753 d84ce8 __Init_thread_footer 5 API calls 10751->10753 10753->10755 10754->10744 10754->10755 10755->10625 10755->10629 10757 d729ce MultiByteToWideChar 10756->10757 10758 d72a0a 10756->10758 10757->10758 10760 d729e7 10757->10760 10865 d7285f 10758->10865 10861 d72823 10760->10861 10901 d84535 EnterCriticalSection 10765->10901 10767 d72684 10768 d7269a FindResourceExW 10767->10768 10769 d84535 3 API calls 10767->10769 10771 d726d2 10767->10771 10773 d726e1 10767->10773 10906 d710bf LoadResource 10767->10906 10768->10767 10769->10767 10771->10773 10910 d72933 FindResourceW 10771->10910 10773->10633 10940 d71026 RaiseException 10774->10940 10776 d7103b RaiseException 10779 d71096 10776->10779 10777 d7105b 10777->10776 10778 d7107a 10777->10778 10782 d84d46 10780->10782 10781 d84d4b LeaveCriticalSection 10781->10745 10782->10781 10793 d84dba 10782->10793 10798 d75239 10785->10798 10788 d84ce8 EnterCriticalSection LeaveCriticalSection 10789 d84d84 10788->10789 10790 d84d8f RtlWakeAllConditionVariable 10789->10790 10791 d84da0 SetEvent ResetEvent 10789->10791 10790->10754 10791->10754 10794 d84dc8 SleepConditionVariableCS 10793->10794 10795 d84de1 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 10793->10795 10796 d84e05 10794->10796 10795->10796 10796->10782 10799 d7524f 10798->10799 10800 d75248 10798->10800 10807 d77ffc 10799->10807 10804 d77f90 10800->10804 10803 d7123e 10803->10788 10805 d77ffc 28 API calls 10804->10805 10806 d77fa2 10805->10806 10806->10803 10810 d77d32 10807->10810 10811 d77d3e ___scrt_is_nonwritable_in_current_image 10810->10811 10818 d7bd84 EnterCriticalSection 10811->10818 10813 d77d4c 10819 d77d8d 10813->10819 10815 d77d59 10829 d77d81 10815->10829 10818->10813 10820 d77da9 10819->10820 10828 d77e20 __dosmaperr 10819->10828 10827 d77e00 10820->10827 10820->10828 10832 d7d15e 10820->10832 10822 d7d15e 28 API calls 10824 d77e16 10822->10824 10823 d77df6 10825 d7a8db _free 14 API calls 10823->10825 10826 d7a8db _free 14 API calls 10824->10826 10825->10827 10826->10828 10827->10822 10827->10828 10828->10815 10828->10828 10860 d7bdcc LeaveCriticalSection 10829->10860 10831 d77d6a 10831->10803 10833 d7d186 10832->10833 10834 d7d16b 10832->10834 10835 d7d195 10833->10835 10841 d7f581 10833->10841 10834->10833 10836 d7d177 10834->10836 10848 d7f5b4 10835->10848 10837 d7a86b _free 14 API calls 10836->10837 10840 d7d17c ___scrt_fastfail 10837->10840 10840->10823 10842 d7f5a1 HeapSize 10841->10842 10843 d7f58c 10841->10843 10842->10835 10844 d7a86b _free 14 API calls 10843->10844 10845 d7f591 10844->10845 10846 d7a7ae ___std_exception_copy 25 API calls 10845->10846 10847 d7f59c 10846->10847 10847->10835 10849 d7f5c1 10848->10849 10850 d7f5cc 10848->10850 10851 d7c540 15 API calls 10849->10851 10852 d7f5d4 10850->10852 10858 d7f5dd __dosmaperr 10850->10858 10856 d7f5c9 10851->10856 10853 d7a8db _free 14 API calls 10852->10853 10853->10856 10854 d7f607 HeapReAlloc 10854->10856 10854->10858 10855 d7f5e2 10857 d7a86b _free 14 API calls 10855->10857 10856->10840 10857->10856 10858->10854 10858->10855 10859 d7d28e __dosmaperr EnterCriticalSection LeaveCriticalSection 10858->10859 10859->10858 10860->10831 10862 d72854 10861->10862 10863 d7103b RaiseException 10862->10863 10864 d7285e 10863->10864 10866 d72871 10865->10866 10867 d72882 10865->10867 10866->10867 10869 d72a7a 10866->10869 10867->10633 10870 d72a84 10869->10870 10871 d72a8b 10870->10871 10872 d7103b RaiseException 10870->10872 10871->10867 10873 d72aa4 10872->10873 10874 d72ab3 10873->10874 10875 d72abd 10873->10875 10876 d7285f 26 API calls 10874->10876 10877 d72ac7 10875->10877 10878 d72b51 10875->10878 10879 d72ab8 10876->10879 10880 d72823 RaiseException 10877->10880 10881 d7103b RaiseException 10878->10881 10879->10867 10883 d72adf 10880->10883 10882 d72b5b 10881->10882 10884 d72b37 10883->10884 10885 d72aed 10883->10885 10895 d72c21 10884->10895 10887 d72afe 10885->10887 10889 d72b14 10885->10889 10891 d72b0e 10885->10891 10890 d7a86b _free 14 API calls 10887->10890 10888 d72a7a 26 API calls 10888->10879 10889->10891 10893 d7a86b _free 14 API calls 10889->10893 10892 d72b03 10890->10892 10891->10888 10894 d7a7ae ___std_exception_copy 25 API calls 10892->10894 10893->10892 10894->10891 10896 d72c33 10895->10896 10898 d72c56 ___scrt_uninitialize_crt 10895->10898 10897 d7a86b _free 14 API calls 10896->10897 10899 d72c3c ___scrt_fastfail 10896->10899 10897->10899 10898->10891 10899->10898 10900 d7a86b 14 API calls _free 10899->10900 10900->10899 10902 d8454e 10901->10902 10904 d84557 LeaveCriticalSection 10901->10904 10902->10904 10920 d72570 10902->10920 10904->10767 10907 d710f5 10906->10907 10908 d710d5 LockResource 10906->10908 10907->10767 10908->10907 10909 d710e2 SizeofResource 10908->10909 10909->10907 10911 d72954 10910->10911 10912 d72994 10910->10912 10913 d710bf 3 API calls 10911->10913 10912->10773 10914 d72961 10913->10914 10914->10912 10915 d72823 RaiseException 10914->10915 10916 d72974 10915->10916 10926 d86067 10916->10926 10918 d72983 10919 d72a7a 26 API calls 10918->10919 10919->10912 10921 d7257a 10920->10921 10922 d7257f 10921->10922 10925 d71026 RaiseException 10921->10925 10922->10904 10924 d72594 10925->10924 10927 d86078 10926->10927 10930 d86074 ___scrt_uninitialize_crt 10926->10930 10928 d8607f 10927->10928 10932 d86092 _wmemset 10927->10932 10929 d7a86b _free 14 API calls 10928->10929 10931 d86084 10929->10931 10930->10918 10933 d7a7ae ___std_exception_copy 25 API calls 10931->10933 10932->10930 10934 d860cc 10932->10934 10935 d860c3 10932->10935 10933->10930 10934->10930 10937 d7a86b _free 14 API calls 10934->10937 10936 d7a86b _free 14 API calls 10935->10936 10938 d860c8 10936->10938 10937->10938 10939 d7a7ae ___std_exception_copy 25 API calls 10938->10939 10939->10930 10940->10777 10942 d718ad 10941->10942 10943 d71d38 10941->10943 10942->10643 11131 d71dee 10942->11131 10944 d727fc 41 API calls 10943->10944 10945 d71d42 10944->10945 10946 d72823 RaiseException 10945->10946 10947 d71d58 SHGetFolderPathW 10946->10947 10948 d7254a 26 API calls 10947->10948 10949 d71d76 10948->10949 10950 d71ddf 10949->10950 11148 d7279d 10949->11148 10951 d72b5c RtlFreeHeap 10950->10951 10951->10942 10953 d71d85 11157 d724f1 10953->11157 10956 d71da0 GetLastError 10957 d71dad 10956->10957 10958 d71dd5 10956->10958 10959 d724f1 2 API calls 10957->10959 10960 d72b5c RtlFreeHeap 10958->10960 10961 d71dba 10959->10961 10960->10950 11164 d71c75 CreateDirectoryW 10961->11164 10966 d75c40 ___scrt_fastfail 10965->10966 10967 d71e94 GetTempFileNameW 10966->10967 10968 d71eb5 10967->10968 10969 d71f62 10967->10969 10971 d7279d 48 API calls 10968->10971 10970 d75814 _ValidateLocalCookies 5 API calls 10969->10970 10973 d718cb 10970->10973 10972 d71ec7 10971->10972 11183 d725ce 10972->11183 10973->10647 10986 d72b77 10973->10986 10976 d72b5c RtlFreeHeap 10977 d71ee1 FindResourceW 10976->10977 10977->10969 10978 d71ef5 LoadResource 10977->10978 10978->10969 10979 d71f02 LockResource 10978->10979 10979->10969 10980 d71f0f CreateFileW 10979->10980 10980->10969 10981 d71f30 SizeofResource 10980->10981 11191 d721aa 10981->11191 10984 d71f49 SetFilePointerEx 10984->10969 10985 d71f58 CloseHandle 10984->10985 10985->10969 10987 d72b82 10986->10987 10988 d72c21 14 API calls 10987->10988 10989 d72b90 10987->10989 10988->10989 10989->10652 11234 d84930 10990->11234 10993 d73079 10994 d75814 _ValidateLocalCookies 5 API calls 10993->10994 10995 d73221 10994->10995 10995->10652 10996 d7304f 10996->10993 10997 d72b77 14 API calls 10996->10997 10998 d730a9 10997->10998 11236 d73225 10998->11236 11001 d73225 51 API calls 11002 d730d4 CreateFileW 11001->11002 11003 d730fe 11002->11003 11013 d731fd 11002->11013 11252 d7df3c 11003->11252 11004 d72b5c RtlFreeHeap 11004->10993 11007 d731b0 FindCloseChangeNotification 11010 d731c4 11007->11010 11011 d731d8 11007->11011 11008 d7313b 11009 d73152 ReadFile 11008->11009 11015 d731a8 11008->11015 11014 d7316f WriteFile 11009->11014 11009->11015 11010->11011 11016 d725ce 15 API calls 11010->11016 11012 d731f1 SetFilePointer 11011->11012 11011->11013 11012->11013 11013->11004 11014->11008 11014->11015 11015->11007 11016->11011 11018 d727fc 41 API calls 11017->11018 11019 d71f86 11018->11019 11020 d72823 RaiseException 11019->11020 11021 d71f9d GetModuleFileNameW 11020->11021 11022 d7254a 26 API calls 11021->11022 11025 d71fb5 11022->11025 11023 d72000 11024 d72b5c RtlFreeHeap 11023->11024 11026 d71935 11024->11026 11025->11023 11027 d7279d 48 API calls 11025->11027 11026->10658 11026->10690 11028 d71fcc 11027->11028 11029 d724f1 2 API calls 11028->11029 11030 d71fd9 CopyFileW 11029->11030 11031 d71fea 11030->11031 11032 d71ff6 11030->11032 11033 d725ce 15 API calls 11031->11033 11034 d72b5c RtlFreeHeap 11032->11034 11033->11032 11034->11023 11036 d72555 11035->11036 11037 d72a7a 26 API calls 11036->11037 11038 d7256e 11037->11038 11038->10663 11040 d714d6 11039->11040 11041 d714da 11039->11041 11040->10665 11321 d72ef4 11041->11321 11043 d717fe 11044 d72f8c 3 API calls 11043->11044 11046 d7180f 11044->11046 11046->10665 11047 d71500 11047->11043 11048 d84e08 3 API calls 11047->11048 11049 d7167d ___scrt_uninitialize_crt 11047->11049 11048->11049 11331 d72f8c 11049->11331 11051 d727fc 41 API calls 11050->11051 11052 d71457 11051->11052 11053 d72823 RaiseException 11052->11053 11054 d71470 11053->11054 11338 d79693 11054->11338 11057 d7254a 26 API calls 11058 d714b4 11057->11058 11059 d728a5 26 API calls 11058->11059 11060 d714c0 11059->11060 11061 d72b5c RtlFreeHeap 11060->11061 11062 d714c8 11061->11062 11063 d71ab2 11062->11063 11064 d727fc 41 API calls 11063->11064 11065 d71ade 11064->11065 11066 d71447 58 API calls 11065->11066 11067 d71af4 11066->11067 11068 d71b21 11067->11068 11069 d71b0e 11067->11069 11071 d729a2 40 API calls 11068->11071 11070 d72b77 14 API calls 11069->11070 11074 d71b16 11070->11074 11072 d71b29 11071->11072 11620 d72a19 11072->11620 11075 d72b5c RtlFreeHeap 11074->11075 11076 d71b55 11075->11076 11077 d71ba5 11076->11077 11078 d71b59 ___scrt_fastfail 11076->11078 11079 d72b5c RtlFreeHeap 11077->11079 11080 d71b6b GetModuleFileNameW 11078->11080 11081 d71bb0 11079->11081 11080->11077 11082 d71b87 11080->11082 11083 d75814 _ValidateLocalCookies 5 API calls 11081->11083 11082->11077 11085 d71447 58 API calls 11082->11085 11084 d71bbd 11083->11084 11084->10676 11086 d71ba2 11085->11086 11086->11077 11088 d727fc 41 API calls 11087->11088 11089 d71bd0 11088->11089 11090 d71447 58 API calls 11089->11090 11091 d71be3 11090->11091 11092 d71c11 11091->11092 11093 d71c01 11091->11093 11094 d729a2 40 API calls 11092->11094 11095 d72b77 14 API calls 11093->11095 11097 d71c18 11094->11097 11096 d71c09 lstrcmpiW 11095->11096 11100 d72b5c RtlFreeHeap 11096->11100 11099 d72a19 26 API calls 11097->11099 11099->11096 11101 d71c42 11100->11101 11102 d71c5e 11101->11102 11103 d72823 RaiseException 11101->11103 11104 d72b5c RtlFreeHeap 11102->11104 11105 d71c56 11103->11105 11106 d71a35 11104->11106 11107 d72a7a 26 API calls 11105->11107 11106->10682 11106->10685 11107->11102 11109 d72b77 14 API calls 11108->11109 11110 d732a2 ___scrt_fastfail 11109->11110 11111 d732b6 GetStartupInfoW 11110->11111 11112 d732df 11111->11112 11113 d732ed CreateProcessW 11111->11113 11630 d72ccd 11112->11630 11115 d7330b GetLastError 11113->11115 11116 d73318 WaitForSingleObject 11113->11116 11118 d7334e 11115->11118 11119 d7333b 11116->11119 11120 d7332a GetExitCodeProcess 11116->11120 11122 d72b5c RtlFreeHeap 11118->11122 11121 d7333e CloseHandle CloseHandle 11119->11121 11120->11121 11121->11118 11123 d73356 11122->11123 11123->10684 11125 d72fd6 11124->11125 11126 d72fed 11124->11126 11127 d72570 RaiseException 11125->11127 11642 d72595 11126->11642 11129 d72fdf DeleteFileW 11127->11129 11129->11125 11129->11126 11132 d727fc 41 API calls 11131->11132 11133 d71e01 11132->11133 11134 d72823 RaiseException 11133->11134 11135 d71e18 GetTempPathW 11134->11135 11136 d7254a 26 API calls 11135->11136 11137 d71e2d 11136->11137 11138 d71e50 11137->11138 11139 d71c75 47 API calls 11137->11139 11140 d72b5c RtlFreeHeap 11138->11140 11141 d71e40 11139->11141 11142 d71e5e 11140->11142 11141->11138 11143 d726ec 14 API calls 11141->11143 11142->10643 11143->11138 11145 d72b76 11144->11145 11146 d72b6e 11144->11146 11145->10690 11651 d7114d 11146->11651 11149 d711d5 40 API calls 11148->11149 11150 d727a9 11149->11150 11151 d727f1 11150->11151 11154 d727af 11150->11154 11152 d7103b RaiseException 11151->11152 11153 d727fb 11152->11153 11155 d7266f 33 API calls 11154->11155 11156 d727d3 11154->11156 11155->11156 11156->10953 11158 d72823 RaiseException 11157->11158 11159 d72502 PathAppendW 11158->11159 11162 d72514 11159->11162 11160 d71d92 CreateDirectoryW 11160->10956 11160->10957 11161 d7103b RaiseException 11163 d72549 11161->11163 11162->11160 11162->11161 11165 d71ca3 11164->11165 11166 d71c92 GetLastError 11164->11166 11167 d727fc 41 API calls 11165->11167 11166->11165 11169 d71c9f 11166->11169 11168 d71cab 11167->11168 11170 d72823 RaiseException 11168->11170 11169->10958 11179 d726ec 11169->11179 11171 d71cc1 GetTempFileNameW 11170->11171 11172 d7254a 26 API calls 11171->11172 11173 d71cdd 11172->11173 11174 d71d0c 11173->11174 11175 d71ce6 DeleteFileW CreateDirectoryW 11173->11175 11176 d72b5c RtlFreeHeap 11174->11176 11175->11174 11177 d71cfd 11175->11177 11176->11169 11178 d726ec 14 API calls 11177->11178 11178->11174 11180 d72718 11179->11180 11181 d72704 11179->11181 11180->10958 11181->11180 11182 d72b77 14 API calls 11181->11182 11182->11180 11184 d725e0 11183->11184 11190 d725f0 11183->11190 11186 d72650 11184->11186 11184->11190 11185 d72b77 14 API calls 11187 d71ed6 11185->11187 11188 d7103b RaiseException 11186->11188 11187->10976 11189 d7265a 11188->11189 11190->11185 11190->11187 11192 d721da 11191->11192 11204 d721d2 11191->11204 11205 d74ac5 11192->11205 11194 d75814 _ValidateLocalCookies 5 API calls 11196 d71f44 11194->11196 11196->10984 11196->10985 11198 d72241 11199 d84e08 3 API calls 11198->11199 11198->11204 11200 d722f9 11199->11200 11220 d74b3b 11200->11220 11203 d72340 WriteFile 11203->11204 11204->11194 11206 d74ad9 11205->11206 11209 d72208 11206->11209 11224 d74a72 11206->11224 11211 d84e08 11209->11211 11212 d84e11 ___std_exception_copy 11211->11212 11213 d84e30 11212->11213 11214 d7d28e __dosmaperr 2 API calls 11212->11214 11215 d84e32 11212->11215 11213->11198 11214->11212 11219 d84ed4 11215->11219 11231 d76aee 11215->11231 11216 d76aee RaiseException 11218 d84ef1 11216->11218 11219->11216 11223 d74b9f 11220->11223 11221 d75814 _ValidateLocalCookies 5 API calls 11222 d7232e 11221->11222 11222->11203 11222->11204 11223->11221 11225 d74a91 11224->11225 11226 d74aac 11225->11226 11227 d7218e 3 API calls 11225->11227 11226->11209 11228 d7218e 11226->11228 11227->11226 11229 d84e08 3 API calls 11228->11229 11230 d72199 11229->11230 11230->11209 11232 d76b35 RaiseException 11231->11232 11233 d76b08 11231->11233 11232->11219 11233->11232 11235 d7300c ReadFile 11234->11235 11235->10993 11235->10996 11256 d729a2 11236->11256 11239 d73237 11243 d7325e 11239->11243 11244 d73250 11239->11244 11240 d73281 11241 d7103b RaiseException 11240->11241 11242 d7328b 11241->11242 11245 d729c1 28 API calls 11243->11245 11246 d7266f 33 API calls 11244->11246 11247 d7325c 11245->11247 11246->11247 11260 d728a5 11247->11260 11250 d72b5c RtlFreeHeap 11251 d730c2 11250->11251 11251->11001 11253 d7df57 11252->11253 11272 d796e8 11253->11272 11257 d729ab 11256->11257 11258 d711d5 40 API calls 11257->11258 11259 d729b9 11257->11259 11258->11259 11259->11239 11259->11240 11261 d72928 11260->11261 11264 d728cb 11260->11264 11262 d7103b RaiseException 11261->11262 11263 d72932 11262->11263 11264->11261 11265 d728f1 11264->11265 11266 d72823 RaiseException 11265->11266 11267 d728fe 11266->11267 11268 d72c21 14 API calls 11267->11268 11269 d72914 11268->11269 11270 d72a7a 26 API calls 11269->11270 11271 d72921 11270->11271 11271->11250 11290 d7952f 11272->11290 11274 d79733 11277 d787d5 __fassign 37 API calls 11274->11277 11275 d7970f 11278 d7a86b _free 14 API calls 11275->11278 11276 d796fa 11276->11274 11276->11275 11289 d7310d SetFilePointer 11276->11289 11282 d7973f 11277->11282 11279 d79714 11278->11279 11281 d7a7ae ___std_exception_copy 25 API calls 11279->11281 11281->11289 11283 d7976e 11282->11283 11297 d79f6c 11282->11297 11286 d797d8 11283->11286 11303 d79f15 11283->11303 11284 d79f15 25 API calls 11287 d798a0 11284->11287 11286->11284 11288 d7a86b _free 14 API calls 11287->11288 11287->11289 11288->11289 11289->11007 11289->11008 11291 d79547 11290->11291 11292 d79534 11290->11292 11291->11276 11293 d7a86b _free 14 API calls 11292->11293 11294 d79539 11293->11294 11295 d7a7ae ___std_exception_copy 25 API calls 11294->11295 11296 d79544 11295->11296 11296->11276 11298 d79fa9 11297->11298 11299 d79f79 11297->11299 11316 d7c51c 11298->11316 11302 d79f88 __fassign 11299->11302 11309 d7eb71 11299->11309 11302->11282 11304 d79f26 11303->11304 11305 d79f3a 11303->11305 11304->11305 11306 d7a86b _free 14 API calls 11304->11306 11305->11286 11307 d79f2f 11306->11307 11308 d7a7ae ___std_exception_copy 25 API calls 11307->11308 11308->11305 11310 d787d5 __fassign 37 API calls 11309->11310 11311 d7eb8e 11310->11311 11312 d7c866 40 API calls 11311->11312 11313 d7eb9e 11311->11313 11312->11313 11314 d75814 _ValidateLocalCookies 5 API calls 11313->11314 11315 d7ec3a 11314->11315 11315->11302 11317 d7a3b0 __fassign 37 API calls 11316->11317 11318 d7c527 11317->11318 11319 d7e0ec __fassign 37 API calls 11318->11319 11320 d7c537 11319->11320 11320->11302 11322 d72f8c 3 API calls 11321->11322 11323 d72f03 CreateFileW 11322->11323 11324 d72f26 CreateFileMappingW 11323->11324 11330 d72f6a 11323->11330 11325 d72f7d 11324->11325 11326 d72f3a MapViewOfFile 11324->11326 11329 d72f8c 3 API calls 11325->11329 11327 d72f74 CloseHandle 11326->11327 11328 d72f4f VirtualQuery 11326->11328 11327->11325 11328->11327 11328->11330 11329->11330 11330->11047 11332 d72f95 UnmapViewOfFile 11331->11332 11333 d72fa2 11331->11333 11332->11333 11334 d72fb5 11333->11334 11335 d72fa8 CloseHandle 11333->11335 11336 d72fbb CloseHandle 11334->11336 11337 d72fc8 11334->11337 11335->11334 11336->11337 11337->11043 11341 d782d6 11338->11341 11342 d78316 11341->11342 11343 d782fe 11341->11343 11342->11343 11344 d7831e 11342->11344 11345 d7a86b _free 14 API calls 11343->11345 11346 d787d5 __fassign 37 API calls 11344->11346 11347 d78303 11345->11347 11349 d7832e 11346->11349 11348 d7a7ae ___std_exception_copy 25 API calls 11347->11348 11354 d7830e 11348->11354 11356 d78a07 11349->11356 11350 d75814 _ValidateLocalCookies 5 API calls 11351 d71496 11350->11351 11351->11057 11354->11350 11357 d7952f 25 API calls 11356->11357 11363 d78a18 11357->11363 11358 d783b5 11369 d78858 11358->11369 11359 d78a27 11360 d7a86b _free 14 API calls 11359->11360 11361 d78a2c 11360->11361 11362 d7a7ae ___std_exception_copy 25 API calls 11361->11362 11362->11358 11363->11358 11363->11359 11372 d78b60 11363->11372 11379 d78f9e 11363->11379 11384 d78b9a 11363->11384 11389 d78bc1 11363->11389 11420 d78d39 11363->11420 11370 d7a8db _free 14 API calls 11369->11370 11371 d78868 11370->11371 11371->11354 11373 d78b65 11372->11373 11374 d78b7c 11373->11374 11375 d7a86b _free 14 API calls 11373->11375 11374->11363 11376 d78b6e 11375->11376 11377 d7a7ae ___std_exception_copy 25 API calls 11376->11377 11378 d78b79 11377->11378 11378->11363 11380 d78faf 11379->11380 11381 d78fa8 11379->11381 11380->11363 11444 d78991 11381->11444 11385 d78ba4 11384->11385 11387 d78bab 11384->11387 11386 d78991 38 API calls 11385->11386 11388 d78baa 11386->11388 11387->11363 11388->11363 11390 d78bcd 11389->11390 11391 d78be8 11389->11391 11392 d78d60 11390->11392 11393 d78dcb 11390->11393 11400 d78c1a 11390->11400 11394 d7a86b _free 14 API calls 11391->11394 11391->11400 11402 d78da2 11392->11402 11405 d78d6c 11392->11405 11396 d78dd2 11393->11396 11397 d78e19 11393->11397 11393->11402 11395 d78c05 11394->11395 11398 d7a7ae ___std_exception_copy 25 API calls 11395->11398 11404 d78ddc 11396->11404 11410 d78d79 11396->11410 11419 d78d9b 11396->11419 11503 d7945d 11397->11503 11401 d78c10 11398->11401 11400->11363 11401->11363 11417 d78d87 11402->11417 11402->11419 11488 d79275 11402->11488 11403 d78db2 11403->11419 11474 d791df 11403->11474 11404->11402 11408 d78de1 11404->11408 11405->11403 11405->11410 11405->11417 11412 d78de6 11408->11412 11413 d78df4 11408->11413 11409 d75814 _ValidateLocalCookies 5 API calls 11414 d78f9c 11409->11414 11410->11417 11410->11419 11497 d7907a 11410->11497 11412->11419 11478 d7943e 11412->11478 11482 d793ca 11413->11482 11414->11363 11417->11419 11506 d7958f 11417->11506 11419->11409 11421 d78d60 11420->11421 11422 d78dcb 11420->11422 11428 d78da2 11421->11428 11430 d78d6c 11421->11430 11423 d78dd2 11422->11423 11424 d78e19 11422->11424 11422->11428 11426 d78d79 11423->11426 11427 d78ddc 11423->11427 11443 d78d9b 11423->11443 11425 d7945d 26 API calls 11424->11425 11441 d78d87 11425->11441 11432 d7907a 40 API calls 11426->11432 11426->11441 11426->11443 11427->11428 11433 d78de1 11427->11433 11431 d79275 26 API calls 11428->11431 11428->11441 11428->11443 11429 d78db2 11438 d791df 38 API calls 11429->11438 11429->11443 11430->11426 11430->11429 11430->11441 11431->11441 11432->11441 11435 d78de6 11433->11435 11436 d78df4 11433->11436 11434 d75814 _ValidateLocalCookies 5 API calls 11437 d78f9c 11434->11437 11440 d7943e 26 API calls 11435->11440 11435->11443 11439 d793ca 25 API calls 11436->11439 11437->11363 11438->11441 11439->11441 11440->11441 11442 d7958f 38 API calls 11441->11442 11441->11443 11442->11443 11443->11434 11445 d789a3 11444->11445 11446 d789a8 11444->11446 11447 d7a86b _free 14 API calls 11445->11447 11452 d7df66 11446->11452 11447->11446 11450 d7a86b _free 14 API calls 11451 d789dc 11450->11451 11451->11363 11453 d7df81 11452->11453 11456 d7990d 11453->11456 11457 d7952f 25 API calls 11456->11457 11460 d79922 11457->11460 11458 d7995b 11461 d787d5 __fassign 37 API calls 11458->11461 11459 d79937 11462 d7a86b _free 14 API calls 11459->11462 11460->11458 11460->11459 11473 d789c8 11460->11473 11466 d7996a 11461->11466 11463 d7993c 11462->11463 11464 d7a7ae ___std_exception_copy 25 API calls 11463->11464 11464->11473 11465 d7eb08 GetStringTypeW 11465->11466 11466->11465 11469 d79994 11466->11469 11467 d79c6c 11468 d79f3e 25 API calls 11467->11468 11471 d79ea2 11468->11471 11469->11467 11470 d79f3e 25 API calls 11469->11470 11470->11467 11472 d7a86b _free 14 API calls 11471->11472 11471->11473 11472->11473 11473->11450 11473->11451 11475 d7920e 11474->11475 11476 d7923a 11475->11476 11510 d7df90 11475->11510 11476->11417 11479 d7944a 11478->11479 11480 d79275 26 API calls 11479->11480 11481 d7945c 11480->11481 11481->11417 11486 d793df 11482->11486 11483 d7a86b _free 14 API calls 11484 d793e8 11483->11484 11485 d7a7ae ___std_exception_copy 25 API calls 11484->11485 11487 d793f3 11485->11487 11486->11483 11486->11487 11487->11417 11489 d79288 11488->11489 11490 d792a3 11489->11490 11492 d792ba 11489->11492 11491 d7a86b _free 14 API calls 11490->11491 11493 d792a8 11491->11493 11496 d792b3 11492->11496 11532 d7850b 11492->11532 11495 d7a7ae ___std_exception_copy 25 API calls 11493->11495 11495->11496 11496->11417 11498 d7909a 11497->11498 11545 d7848e 11498->11545 11500 d790db 11555 d7e991 11500->11555 11502 d79150 11502->11417 11502->11502 11504 d79275 26 API calls 11503->11504 11505 d79474 11504->11505 11505->11417 11507 d795a2 11506->11507 11508 d795f9 11506->11508 11507->11508 11509 d7df90 __fassign 38 API calls 11507->11509 11508->11419 11509->11507 11511 d7dfa5 11510->11511 11512 d7dfb5 11510->11512 11511->11512 11513 d787d5 __fassign 37 API calls 11511->11513 11512->11476 11514 d7dfd6 11513->11514 11515 d7e003 11514->11515 11516 d7dfe2 11514->11516 11515->11512 11529 d803ee 11515->11529 11526 d80454 11516->11526 11519 d7e02e 11520 d7e076 11519->11520 11521 d7e034 11519->11521 11522 d7bb5f __fassign MultiByteToWideChar 11520->11522 11523 d7e05c 11521->11523 11524 d7bb5f __fassign MultiByteToWideChar 11521->11524 11522->11523 11523->11512 11525 d7a86b _free 14 API calls 11523->11525 11524->11523 11525->11512 11527 d8204b __fassign 19 API calls 11526->11527 11528 d8046c 11527->11528 11528->11512 11530 d787d5 __fassign 37 API calls 11529->11530 11531 d80401 __fassign 11530->11531 11531->11519 11533 d78520 11532->11533 11534 d7852f 11532->11534 11535 d7a86b _free 14 API calls 11533->11535 11536 d78525 11534->11536 11537 d7c540 15 API calls 11534->11537 11535->11536 11536->11496 11538 d78557 11537->11538 11539 d7856e 11538->11539 11542 d78872 11538->11542 11540 d7a8db _free 14 API calls 11539->11540 11540->11536 11543 d7a8db _free 14 API calls 11542->11543 11544 d78881 11543->11544 11544->11539 11546 d784a3 11545->11546 11548 d784b2 11545->11548 11547 d7a86b _free 14 API calls 11546->11547 11549 d784a8 11547->11549 11548->11549 11550 d7c540 15 API calls 11548->11550 11549->11500 11551 d784d9 11550->11551 11552 d784f0 11551->11552 11554 d78872 14 API calls 11551->11554 11553 d7a8db _free 14 API calls 11552->11553 11553->11549 11554->11552 11556 d7e9b7 11555->11556 11557 d7e9a1 11555->11557 11556->11557 11561 d7e9c9 11556->11561 11558 d7a86b _free 14 API calls 11557->11558 11559 d7e9a6 11558->11559 11560 d7a7ae ___std_exception_copy 25 API calls 11559->11560 11569 d7e9b0 11560->11569 11562 d7ea02 11561->11562 11563 d7ea30 11561->11563 11576 d7e8c8 11562->11576 11564 d7ea4e 11563->11564 11565 d7ea53 11563->11565 11567 d7ea77 11564->11567 11568 d7eaad 11564->11568 11584 d7e1a8 11565->11584 11570 d7ea95 11567->11570 11571 d7ea7c 11567->11571 11612 d7e4c1 11568->11612 11569->11502 11605 d7e6ab 11570->11605 11595 d7e807 11571->11595 11577 d7e8de 11576->11577 11578 d7e8e9 11576->11578 11577->11569 11579 d7822d ___std_exception_copy 25 API calls 11578->11579 11580 d7e944 11579->11580 11581 d7e94e 11580->11581 11582 d7a7be ___std_exception_copy 11 API calls 11580->11582 11581->11569 11583 d7e95c 11582->11583 11585 d7e1ba 11584->11585 11586 d787d5 __fassign 37 API calls 11585->11586 11587 d7e1ce 11586->11587 11588 d7e1d6 11587->11588 11589 d7e1ea 11587->11589 11590 d7a86b _free 14 API calls 11588->11590 11592 d7e4c1 39 API calls 11589->11592 11594 d7e1e5 __alldvrm ___scrt_fastfail _strrchr 11589->11594 11591 d7e1db 11590->11591 11593 d7a7ae ___std_exception_copy 25 API calls 11591->11593 11592->11594 11593->11594 11594->11569 11596 d80b08 27 API calls 11595->11596 11597 d7e835 11596->11597 11598 d805ae 25 API calls 11597->11598 11599 d7e867 11598->11599 11600 d7e86e 11599->11600 11601 d7e8a7 11599->11601 11603 d7e880 11599->11603 11600->11569 11602 d7e563 37 API calls 11601->11602 11602->11600 11604 d7e736 37 API calls 11603->11604 11604->11600 11606 d80b08 27 API calls 11605->11606 11607 d7e6d8 11606->11607 11608 d805ae 25 API calls 11607->11608 11609 d7e710 11608->11609 11610 d7e717 11609->11610 11611 d7e736 37 API calls 11609->11611 11610->11569 11611->11610 11613 d7e4d9 11612->11613 11614 d80b08 27 API calls 11613->11614 11615 d7e4f2 11614->11615 11616 d805ae 25 API calls 11615->11616 11617 d7e537 11616->11617 11618 d7e53e 11617->11618 11619 d7e563 37 API calls 11617->11619 11618->11569 11619->11618 11621 d72a34 11620->11621 11622 d72a27 11620->11622 11624 d7103b RaiseException 11621->11624 11622->11621 11623 d72a3b 11622->11623 11625 d72a74 11623->11625 11626 d72a7a 26 API calls 11623->11626 11624->11625 11627 d72a53 11626->11627 11628 d72c21 14 API calls 11627->11628 11629 d72a60 11628->11629 11629->11074 11631 d72cec 11630->11631 11637 d712ad 11631->11637 11633 d72d41 11634 d72c21 14 API calls 11635 d72d18 11634->11635 11635->11113 11638 d712bb 11637->11638 11639 d712f2 11637->11639 11638->11639 11641 d71138 RtlAllocateHeap 11638->11641 11639->11633 11639->11634 11641->11639 11643 d725a1 11642->11643 11646 d725c1 11642->11646 11644 d72b5c RtlFreeHeap 11643->11644 11647 d725b9 11643->11647 11644->11643 11648 d78207 11647->11648 11649 d7a8db _free 14 API calls 11648->11649 11650 d7821f 11649->11650 11650->11646 11652 d71156 RtlFreeHeap 11651->11652 11653 d71164 11651->11653 11652->11653 11653->11145 11655 d729a2 40 API calls 11654->11655 11656 d72d5f 11655->11656 11657 d72da9 11656->11657 11659 d7266f 33 API calls 11656->11659 11658 d7103b RaiseException 11657->11658 11660 d72dba GetLastError SetLastError FormatMessageW 11658->11660 11661 d72d7b 11659->11661 11663 d72e00 GetLastError 11660->11663 11664 d72e0a SetLastError 11660->11664 11661->11657 11668 d72d88 11661->11668 11663->11664 11665 d72ec6 11663->11665 11666 d72eaf 11664->11666 11667 d72e1a 11664->11667 11671 d72f8c 3 API calls 11665->11671 11669 d7285f 26 API calls 11666->11669 11667->11666 11672 d72e2b 11667->11672 11673 d72b5c RtlFreeHeap 11668->11673 11670 d72eb6 LocalFree 11669->11670 11670->10727 11674 d72edd _AnonymousOriginator 11671->11674 11675 d72823 RaiseException 11672->11675 11676 d72da7 11673->11676 11674->10727 11677 d72e42 11675->11677 11676->10727 11678 d72e50 11677->11678 11679 d72e98 11677->11679 11681 d72e61 11678->11681 11683 d72e77 11678->11683 11686 d72e71 11678->11686 11680 d72c21 14 API calls 11679->11680 11680->11686 11684 d7a86b _free 14 API calls 11681->11684 11682 d72a7a 26 API calls 11685 d72ead 11682->11685 11683->11686 11688 d7a86b _free 14 API calls 11683->11688 11687 d72e66 11684->11687 11685->11670 11686->11682 11689 d7a7ae ___std_exception_copy 25 API calls 11687->11689 11688->11687 11689->11686 11691 d779e2 11690->11691 11692 d779d0 11690->11692 11702 d77888 11691->11702 11693 d754db __fassign GetModuleHandleW 11692->11693 11695 d779d5 11693->11695 11695->11691 11718 d77a68 GetModuleHandleExW 11695->11718 11697 d75017 11697->9920 11701 d77a25 11703 d77894 ___scrt_is_nonwritable_in_current_image 11702->11703 11724 d7bd84 EnterCriticalSection 11703->11724 11705 d7789e 11725 d778d5 11705->11725 11707 d778ab 11729 d778c9 11707->11729 11710 d77a26 11753 d7bde3 GetPEB 11710->11753 11713 d77a55 11716 d77a68 __fassign 3 API calls 11713->11716 11714 d77a35 GetPEB 11714->11713 11715 d77a45 GetCurrentProcess TerminateProcess 11714->11715 11715->11713 11717 d77a5d ExitProcess 11716->11717 11719 d77a87 GetProcAddress 11718->11719 11720 d77aaa 11718->11720 11723 d77a9c 11719->11723 11721 d77ab0 FreeLibrary 11720->11721 11722 d779e1 11720->11722 11721->11722 11722->11691 11723->11720 11724->11705 11726 d778e1 ___scrt_is_nonwritable_in_current_image 11725->11726 11728 d77942 __fassign 11726->11728 11732 d77fa6 11726->11732 11728->11707 11752 d7bdcc LeaveCriticalSection 11729->11752 11731 d778b7 11731->11697 11731->11710 11735 d77cd7 11732->11735 11736 d77ce3 ___scrt_is_nonwritable_in_current_image 11735->11736 11743 d7bd84 EnterCriticalSection 11736->11743 11738 d77cf1 11744 d77eb6 11738->11744 11743->11738 11745 d77cfe 11744->11745 11746 d77ed5 11744->11746 11748 d77d26 11745->11748 11746->11745 11747 d7a8db _free 14 API calls 11746->11747 11747->11745 11751 d7bdcc LeaveCriticalSection 11748->11751 11750 d77d0f 11750->11728 11751->11750 11752->11731 11754 d7bdfd 11753->11754 11755 d77a30 11753->11755 11757 d7cebb 11754->11757 11755->11713 11755->11714 11758 d7ce38 __dosmaperr 5 API calls 11757->11758 11759 d7ced7 11758->11759 11759->11755 11761 d78147 11760->11761 11762 d78159 ___scrt_uninitialize_crt 11760->11762 11763 d78155 11761->11763 11765 d7d8b8 11761->11765 11762->9914 11763->9914 11768 d7d766 11765->11768 11771 d7d6ba 11768->11771 11772 d7d6c6 ___scrt_is_nonwritable_in_current_image 11771->11772 11779 d7bd84 EnterCriticalSection 11772->11779 11774 d7d73c 11788 d7d75a 11774->11788 11777 d7d6d0 ___scrt_uninitialize_crt 11777->11774 11780 d7d62e 11777->11780 11779->11777 11781 d7d63a ___scrt_is_nonwritable_in_current_image 11780->11781 11791 d7d9d5 EnterCriticalSection 11781->11791 11783 d7d644 ___scrt_uninitialize_crt 11784 d7d690 11783->11784 11792 d7d870 11783->11792 11802 d7d6ae 11784->11802 11935 d7bdcc LeaveCriticalSection 11788->11935 11790 d7d748 11790->11763 11791->11783 11793 d7d886 11792->11793 11794 d7d87d 11792->11794 11805 d7d80b 11793->11805 11796 d7d766 ___scrt_uninitialize_crt 66 API calls 11794->11796 11801 d7d883 11796->11801 11799 d7d8a2 11818 d7f6bf 11799->11818 11801->11784 11934 d7d9e9 LeaveCriticalSection 11802->11934 11804 d7d69c 11804->11777 11806 d7d848 11805->11806 11807 d7d823 11805->11807 11806->11801 11811 d7eacc 11806->11811 11807->11806 11808 d7eacc ___scrt_uninitialize_crt 25 API calls 11807->11808 11809 d7d841 11808->11809 11829 d7feb5 11809->11829 11812 d7eaed 11811->11812 11813 d7ead8 11811->11813 11812->11799 11814 d7a86b _free 14 API calls 11813->11814 11815 d7eadd 11814->11815 11816 d7a7ae ___std_exception_copy 25 API calls 11815->11816 11817 d7eae8 11816->11817 11817->11799 11819 d7f6d0 11818->11819 11820 d7f6dd 11818->11820 11821 d7a86b _free 14 API calls 11819->11821 11822 d7f726 11820->11822 11825 d7f704 11820->11825 11824 d7f6d5 11821->11824 11823 d7a86b _free 14 API calls 11822->11823 11826 d7f72b 11823->11826 11824->11801 11903 d7f61d 11825->11903 11828 d7a7ae ___std_exception_copy 25 API calls 11826->11828 11828->11824 11830 d7fec1 ___scrt_is_nonwritable_in_current_image 11829->11830 11831 d7fec9 11830->11831 11834 d7fee1 11830->11834 11854 d7a858 11831->11854 11833 d7ff7c 11836 d7a858 __dosmaperr 14 API calls 11833->11836 11834->11833 11839 d7ff13 11834->11839 11838 d7ff81 11836->11838 11837 d7a86b _free 14 API calls 11853 d7fed6 11837->11853 11840 d7a86b _free 14 API calls 11838->11840 11857 d7bf62 EnterCriticalSection 11839->11857 11842 d7ff89 11840->11842 11844 d7a7ae ___std_exception_copy 25 API calls 11842->11844 11843 d7ff19 11845 d7ff35 11843->11845 11846 d7ff4a 11843->11846 11844->11853 11848 d7a86b _free 14 API calls 11845->11848 11858 d7ffa7 11846->11858 11849 d7ff3a 11848->11849 11851 d7a858 __dosmaperr 14 API calls 11849->11851 11850 d7ff45 11900 d7ff74 11850->11900 11851->11850 11853->11806 11855 d7a507 __dosmaperr 14 API calls 11854->11855 11856 d7a85d 11855->11856 11856->11837 11857->11843 11859 d7ffc9 11858->11859 11871 d7ffe5 11858->11871 11860 d7ffcd 11859->11860 11862 d8001d 11859->11862 11861 d7a858 __dosmaperr 14 API calls 11860->11861 11863 d7ffd2 11861->11863 11864 d80030 11862->11864 11866 d81f03 ___scrt_uninitialize_crt 27 API calls 11862->11866 11865 d7a86b _free 14 API calls 11863->11865 11867 d7fb4e ___scrt_uninitialize_crt 38 API calls 11864->11867 11868 d7ffda 11865->11868 11866->11864 11870 d80041 11867->11870 11869 d7a7ae ___std_exception_copy 25 API calls 11868->11869 11869->11871 11872 d80085 11870->11872 11873 d80046 11870->11873 11871->11850 11874 d80099 11872->11874 11875 d800de WriteFile 11872->11875 11876 d8004a 11873->11876 11877 d8006f 11873->11877 11880 d800ce 11874->11880 11881 d800a4 11874->11881 11878 d80102 GetLastError 11875->11878 11886 d80065 11875->11886 11885 d7fae6 ___scrt_uninitialize_crt 6 API calls 11876->11885 11876->11886 11879 d7f73c ___scrt_uninitialize_crt 43 API calls 11877->11879 11878->11886 11879->11886 11882 d7fbbf ___scrt_uninitialize_crt 7 API calls 11880->11882 11883 d800a9 11881->11883 11884 d800be 11881->11884 11882->11886 11883->11886 11890 d7fc9a ___scrt_uninitialize_crt 7 API calls 11883->11890 11887 d7fd83 ___scrt_uninitialize_crt 8 API calls 11884->11887 11885->11886 11886->11871 11888 d80128 11886->11888 11889 d80152 11886->11889 11887->11886 11891 d8012f 11888->11891 11892 d80146 11888->11892 11889->11871 11894 d7a86b _free 14 API calls 11889->11894 11890->11886 11895 d7a86b _free 14 API calls 11891->11895 11893 d7a835 __dosmaperr 14 API calls 11892->11893 11893->11871 11896 d8016a 11894->11896 11897 d80134 11895->11897 11898 d7a858 __dosmaperr 14 API calls 11896->11898 11899 d7a858 __dosmaperr 14 API calls 11897->11899 11898->11871 11899->11871 11901 d7bf85 ___scrt_uninitialize_crt LeaveCriticalSection 11900->11901 11902 d7ff7a 11901->11902 11902->11853 11904 d7f629 ___scrt_is_nonwritable_in_current_image 11903->11904 11917 d7bf62 EnterCriticalSection 11904->11917 11906 d7f638 11907 d7f67f 11906->11907 11918 d7c039 11906->11918 11909 d7a86b _free 14 API calls 11907->11909 11911 d7f684 11909->11911 11910 d7f664 FlushFileBuffers 11910->11911 11912 d7f670 11910->11912 11931 d7f6b3 11911->11931 11913 d7a858 __dosmaperr 14 API calls 11912->11913 11915 d7f675 GetLastError 11913->11915 11915->11907 11917->11906 11919 d7c046 11918->11919 11920 d7c05b 11918->11920 11921 d7a858 __dosmaperr 14 API calls 11919->11921 11922 d7a858 __dosmaperr 14 API calls 11920->11922 11924 d7c080 11920->11924 11923 d7c04b 11921->11923 11925 d7c08b 11922->11925 11926 d7a86b _free 14 API calls 11923->11926 11924->11910 11927 d7a86b _free 14 API calls 11925->11927 11928 d7c053 11926->11928 11929 d7c093 11927->11929 11928->11910 11930 d7a7ae ___std_exception_copy 25 API calls 11929->11930 11930->11928 11932 d7bf85 ___scrt_uninitialize_crt LeaveCriticalSection 11931->11932 11933 d7f69c 11932->11933 11933->11824 11934->11804 11935->11790

                                                                                        Executed Functions

                                                                                        Function 00D71E65 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetTempFileNameW.KERNELBASE(?,GUT,00000000,?), ref: 00D71EA7
                                                                                        • FindResourceW.KERNEL32(00000000,00000066,00D8CB2C,?,?), ref: 00D71EE9
                                                                                        • LoadResource.KERNEL32(00000000,00000000), ref: 00D71EF8
                                                                                        • LockResource.KERNEL32(00000000), ref: 00D71F03
                                                                                        • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000004,00000000,00000000), ref: 00D71F23
                                                                                        • SizeofResource.KERNEL32(00000000,00000000,00000000), ref: 00D71F35
                                                                                        • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 00D71F4E
                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00D71F59
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: Resource$File$CloseCreateFindHandleLoadLockNamePointerSizeofTemp
                                                                                        • String ID: GUT
                                                                                        • API String ID: 3559219628-559840939
                                                                                        • Opcode ID: 5c9252c7650ed11d0a64b5b102dbd2fc35a57d77a6eea13c807b92e177a0bae6
                                                                                        • Instruction ID: f9f88ae04c3e9c0d063cf78d949156a07dd0df2a137ad633090f72c4ff58926a
                                                                                        • Opcode Fuzzy Hash: 5c9252c7650ed11d0a64b5b102dbd2fc35a57d77a6eea13c807b92e177a0bae6
                                                                                        • Instruction Fuzzy Hash: 0A216D72614319ABE710AB789C8DEBBB7ACEB14764F144264F919D22D0FB70CD448B71
                                                                                        Function 00D72445 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00D72455
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 00D7245C
                                                                                        • CoInitializeEx.OLE32(00000000,00000006), ref: 00D72473
                                                                                          • Part of subcall function 00D71814: DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,00D724E2,?), ref: 00D71836
                                                                                          • Part of subcall function 00D71814: RemoveDirectoryW.KERNELBASE(?,?,00000000,?,00D724E2,?), ref: 00D7184E
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressDeleteDirectoryFileHandleInitializeModuleProcRemove
                                                                                        • String ID: SetDefaultDllDirectories$kernel32.dll
                                                                                        • API String ID: 2684526300-2102062458
                                                                                        • Opcode ID: da6512b4cd104fc6356fb8df11818078f4728dc33e83baa593ba0e15301c106d
                                                                                        • Instruction ID: ad54a4ee39b40418cbf4024479c956d92646d3742a4b628f3957dc9fde72a30a
                                                                                        • Opcode Fuzzy Hash: da6512b4cd104fc6356fb8df11818078f4728dc33e83baa593ba0e15301c106d
                                                                                        • Instruction Fuzzy Hash: DA118C31E14219ABCB04FFA4D8969EE7B78EF14754F108419F809A7281FB709A09CBB0
                                                                                        Function 00D77A26 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 323 d77a26-d77a33 call d7bde3 326 d77a55-d77a61 call d77a68 ExitProcess 323->326 327 d77a35-d77a43 GetPEB 323->327 327->326 328 d77a45-d77a4f GetCurrentProcess TerminateProcess 327->328 328->326
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(?,?,00D77A25,00007FFD,00000000,?,00007FFD,?,00D7832E), ref: 00D77A48
                                                                                        • TerminateProcess.KERNEL32(00000000,?,00D77A25,00007FFD,00000000,?,00007FFD,?,00D7832E), ref: 00D77A4F
                                                                                        • ExitProcess.KERNEL32 ref: 00D77A61
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                        • String ID:
                                                                                        • API String ID: 1703294689-0
                                                                                        • Opcode ID: 52f7523ec59eb987006c7ec24a9b10a5b5138d7ebeb4758c57081126f9444951
                                                                                        • Instruction ID: cf49202ff49b746155a588871fc9d1f0fe4e0733d9316c90a59d8748a2d4e7d1
                                                                                        • Opcode Fuzzy Hash: 52f7523ec59eb987006c7ec24a9b10a5b5138d7ebeb4758c57081126f9444951
                                                                                        • Instruction Fuzzy Hash: 87E09231528208EBDF226B64DD09A593B7EEB44791B248815F91DC6221EB36DA42CBB1
                                                                                        Function 00D71889 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 169COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                          • Part of subcall function 00D71D1E: IsUserAnAdmin.SHELL32 ref: 00D71D27
                                                                                        • PathQuoteSpacesW.SHLWAPI(00000000,00000104,?), ref: 00D7197A
                                                                                        • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00D719A5
                                                                                        • CloseHandle.KERNEL32(00000000,?), ref: 00D71A95
                                                                                          • Part of subcall function 00D71DEE: GetTempPathW.KERNEL32(00000104,00000000,00000104,?,?,?,00D718B8), ref: 00D71E1D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: Path$AdminCloseFileHandleModuleNameQuoteSpacesTempUser
                                                                                        • String ID: "%s"$ %s$ /%s %s /%s$install$installsource$taggedmi
                                                                                        • API String ID: 2276683166-1343157288
                                                                                        • Opcode ID: fc7dffa51b2bda58f1af513835e50c74d87c8305a0a6d166ba9f480df2fe7bf0
                                                                                        • Instruction ID: 599cdafe32215e48a2f4812413c8a6ad0bb019883fa1a232523f09181477102b
                                                                                        • Opcode Fuzzy Hash: fc7dffa51b2bda58f1af513835e50c74d87c8305a0a6d166ba9f480df2fe7bf0
                                                                                        • Instruction Fuzzy Hash: 0651E7755043009BC710EF68D885AAEB7E4EF94314F148A2EF49D97292FB30D90ACB72
                                                                                        Function 00D72FFF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 159fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 96 d72fff-d73049 call d84930 ReadFile 99 d73212 96->99 100 d7304f-d73059 96->100 102 d73214-d73222 call d75814 99->102 100->99 101 d7305f-d73077 call d84ef2 100->101 107 d73081-d73099 call d84ef2 101->107 108 d73079-d7307c 101->108 107->99 111 d7309f-d730f8 call d72b77 call d73225 * 2 CreateFileW 107->111 108->102 118 d73203-d73210 call d72b5c 111->118 119 d730fe-d73139 call d7df3c SetFilePointer 111->119 118->102 124 d731b0-d731c2 FindCloseChangeNotification 119->124 125 d7313b-d73148 119->125 128 d731c4-d731c7 124->128 129 d731ec-d731ef 124->129 126 d73152-d7316d ReadFile 125->126 127 d7314a-d7314c 125->127 132 d7316f-d73192 WriteFile 126->132 133 d731aa 126->133 127->126 134 d731c9-d731d3 call d725ce 128->134 135 d731d8-d731dd 128->135 130 d731f1-d731f7 SetFilePointer 129->130 131 d731fd 129->131 130->131 131->118 132->133 136 d73194-d731a6 132->136 133->124 134->135 135->129 138 d731df-d731eb 135->138 136->125 139 d731a8 136->139 138->129 139->124
                                                                                        APIs
                                                                                        • ReadFile.KERNELBASE(?,?,00000200,?,00000000,?,00000000,?,?,00D7191F,?), ref: 00D73041
                                                                                        • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000100,00000000,?,00D8CCE8), ref: 00D730E9
                                                                                        • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00D7311D
                                                                                        • ReadFile.KERNELBASE(?,?,00040000,?,00000000), ref: 00D73165
                                                                                        • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00D7318A
                                                                                        • FindCloseChangeNotification.KERNELBASE(?), ref: 00D731B6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$Read$ChangeCloseCreateFindNotificationPointerWrite
                                                                                        • String ID: ustar
                                                                                        • API String ID: 3368226178-529472938
                                                                                        • Opcode ID: cb3c06e193c694007663eda50bc72956f7843bf57ebafa174687eb155de970d8
                                                                                        • Instruction ID: 4e40cfbc62e21668fac5a3a8c076d0818b09e6cbd2aadde11112946b9426f66b
                                                                                        • Opcode Fuzzy Hash: cb3c06e193c694007663eda50bc72956f7843bf57ebafa174687eb155de970d8
                                                                                        • Instruction Fuzzy Hash: D25182F195021D9FDB209B64DD89EAAB778EF04300F1440E9A61DB6191F7B09B84DF78
                                                                                        Function 00D7328C Relevance: 10.6, APIs: 7, Instructions: 84processsynchronizationCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetStartupInfoW.KERNEL32(?,?,?,00000000), ref: 00D732C6
                                                                                        • CreateProcessW.KERNELBASE(00000000,00000010,00000000,00000000,00000000,00000400,00000000,00000000,?,?), ref: 00D73301
                                                                                        • GetLastError.KERNEL32 ref: 00D7330B
                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D7331D
                                                                                        • GetExitCodeProcess.KERNELBASE(?,?), ref: 00D7332E
                                                                                        • CloseHandle.KERNEL32(?), ref: 00D73347
                                                                                        • CloseHandle.KERNEL32(?), ref: 00D7334C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseHandleProcess$CodeCreateErrorExitInfoLastObjectSingleStartupWait
                                                                                        • String ID:
                                                                                        • API String ID: 2373000011-0
                                                                                        • Opcode ID: b8137ade952f90d94efa87316eba5ff7ad00201e2c8d4f73ba9dab5fa6ba1563
                                                                                        • Instruction ID: ef1354880b34b03da3824ddcf352b8be2ce0329be5d545cdba1fec8109e9f403
                                                                                        • Opcode Fuzzy Hash: b8137ade952f90d94efa87316eba5ff7ad00201e2c8d4f73ba9dab5fa6ba1563
                                                                                        • Instruction Fuzzy Hash: 25212A71910209BFEB119FB4CC86DAEBB7CEF04354F108565A515E72A0EA309E45EBB0
                                                                                        Function 00D71D1E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • IsUserAnAdmin.SHELL32 ref: 00D71D27
                                                                                        • SHGetFolderPathW.SHELL32(00000000,00008026,00000000,00000000,00000000,00000104,?,?,?,?,00D718AD), ref: 00D71D66
                                                                                        • CreateDirectoryW.KERNELBASE(?,00000000,Wavesor,?,?,?,?,?,00D718AD), ref: 00D71D96
                                                                                        • GetLastError.KERNEL32(?,?,?,?,00D718AD), ref: 00D71DA0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: AdminCreateDirectoryErrorFolderLastPathUser
                                                                                        • String ID: Temp$Wavesor
                                                                                        • API String ID: 943171645-2579764534
                                                                                        • Opcode ID: 1df6d8ff325a45db6e35be028a7c5f855eb747e7d305f014ff3b06b5d4c50640
                                                                                        • Instruction ID: 67db4386465f764a999b3782948464083d0aa064c8e7a5765f91846a332dbb5a
                                                                                        • Opcode Fuzzy Hash: 1df6d8ff325a45db6e35be028a7c5f855eb747e7d305f014ff3b06b5d4c50640
                                                                                        • Instruction Fuzzy Hash: AA218170900208EBCB14EBA5CD968FEB77CEF10314B1042A9A409A3191FB709F05DB70
                                                                                        Function 00D71C75 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 187 d71c75-d71c90 CreateDirectoryW 188 d71ca3-d71cdf call d727fc call d72823 GetTempFileNameW call d7254a 187->188 189 d71c92-d71c9d GetLastError 187->189 198 d71ce1-d71ce4 188->198 199 d71d0e-d71d16 call d72b5c 188->199 189->188 190 d71c9f-d71ca1 189->190 193 d71d18-d71d1b 190->193 198->199 200 d71ce6-d71cfb DeleteFileW CreateDirectoryW 198->200 199->193 200->199 202 d71cfd-d71d0c call d726ec 200->202 202->199
                                                                                        APIs
                                                                                        • CreateDirectoryW.KERNELBASE(?,00000000,?,00000000,Temp,?,?,?,?,00D718AD), ref: 00D71C88
                                                                                        • GetLastError.KERNEL32(?,00000000,Temp,?,?,?,?,00D718AD), ref: 00D71C92
                                                                                        • GetTempFileNameW.KERNELBASE(?,GUM,00000000,00000000,00000104,?,00000000,Temp), ref: 00D71CCD
                                                                                        • DeleteFileW.KERNELBASE(000000FF,?,00000000,Temp), ref: 00D71CE9
                                                                                        • CreateDirectoryW.KERNELBASE(000000FF,00000000,?,00000000,Temp), ref: 00D71CF3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateDirectoryFile$DeleteErrorLastNameTemp
                                                                                        • String ID: GUM
                                                                                        • API String ID: 55127950-1161156203
                                                                                        • Opcode ID: 407d5c6c0eb9bce5c01bea36ee51969126d2af1100e0f9b7a1b20a6ca77c0b64
                                                                                        • Instruction ID: 1a3a79e5464a683668aa71a42c85292764e48fadc300ceff1d1d8325ffc47e5b
                                                                                        • Opcode Fuzzy Hash: 407d5c6c0eb9bce5c01bea36ee51969126d2af1100e0f9b7a1b20a6ca77c0b64
                                                                                        • Instruction Fuzzy Hash: E6118F74600209AFDB14EFA8CC999AD7B79EF54350B149529F419D72A0EB30CA46DBB0
                                                                                        Function 00D72EF4 Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 231 d72ef4-d72f24 call d72f8c CreateFileW 234 d72f26-d72f38 CreateFileMappingW 231->234 235 d72f84 231->235 237 d72f7d-d72f7f call d72f8c 234->237 238 d72f3a-d72f4d MapViewOfFile 234->238 236 d72f86-d72f89 235->236 237->235 239 d72f74-d72f77 CloseHandle 238->239 240 d72f4f-d72f68 VirtualQuery 238->240 239->237 240->239 242 d72f6a-d72f72 240->242 242->236
                                                                                        APIs
                                                                                          • Part of subcall function 00D72F8C: UnmapViewOfFile.KERNEL32(00000000,?,00D72EDD,?,?,?,00D71457), ref: 00D72F98
                                                                                          • Part of subcall function 00D72F8C: CloseHandle.KERNEL32(00000000,?,00D72EDD,?,?,?,00D71457), ref: 00D72FAB
                                                                                          • Part of subcall function 00D72F8C: CloseHandle.KERNEL32(000000FF,?,00D72EDD,?,?,?,00D71457), ref: 00D72FBE
                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,?,?,00D71500), ref: 00D72F18
                                                                                        • CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000,?,?,?,?,?,?,00D71500), ref: 00D72F2D
                                                                                        • MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000,?,?,?,?,?,?,00D71500), ref: 00D72F40
                                                                                        • VirtualQuery.KERNEL32(00000000,?,0000001C,?,?,?,?,?,?,00D71500), ref: 00D72F60
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00D71500), ref: 00D72F77
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$CloseHandle$CreateView$MappingQueryUnmapVirtual
                                                                                        • String ID:
                                                                                        • API String ID: 1729669285-0
                                                                                        • Opcode ID: 5f5abb07533b07fff8e0b813a80852ab49f8c422d1937a9e21f66f6af3fea1a5
                                                                                        • Instruction ID: 55292a108d426470a2b0634f638db279f54f106346856cf46f691b382c8209f4
                                                                                        • Opcode Fuzzy Hash: 5f5abb07533b07fff8e0b813a80852ab49f8c422d1937a9e21f66f6af3fea1a5
                                                                                        • Instruction Fuzzy Hash: 92112E716443926ADB346B269C0DF6BBAB9EBC1B10F10851DF519A62D0EB74D405C670
                                                                                        Function 00D71AB2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 243 d71ab2-d71aef call d727fc call d71447 247 d71af4-d71b02 243->247 248 d71b06-d71b0c 247->248 249 d71b04 247->249 250 d71b21-d71b39 call d729a2 call d72a19 248->250 251 d71b0e-d71b1f call d72b77 248->251 249->248 256 d71b3f-d71b57 call d86117 call d72b5c 250->256 251->256 263 d71ba5-d71bbe call d72b5c call d75814 256->263 264 d71b59-d71b85 call d75c40 GetModuleFileNameW 256->264 264->263 269 d71b87-d71b89 264->269 269->263 271 d71b8b-d71ba2 call d71447 269->271 271->263
                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000000,00000000,00000000,00000000), ref: 00D71B7D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileModuleName
                                                                                        • String ID: "%s"$/%s$recover
                                                                                        • API String ID: 514040917-4067204065
                                                                                        • Opcode ID: cde9203cc515495d344267d1ad17a904d797b2c982ff31e621f1070c17ba5e8d
                                                                                        • Instruction ID: 86997d81cf7ee7c6cd29865d00ae46783aea1b4de18b9947bda3f5f6a5c72ec5
                                                                                        • Opcode Fuzzy Hash: cde9203cc515495d344267d1ad17a904d797b2c982ff31e621f1070c17ba5e8d
                                                                                        • Instruction Fuzzy Hash: B7217675D402189BDB10EB64DC8AEEEB778EF25310F1485A9E41DE7281FA709E44CBB1
                                                                                        Function 00D71F73 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104,?,00000000), ref: 00D71FA5
                                                                                          • Part of subcall function 00D724F1: PathAppendW.SHLWAPI(00000000,?,00000104,?,00000000,?,00D71D92,Wavesor,?,?,?,?,?,00D718AD), ref: 00D72506
                                                                                        • CopyFileW.KERNELBASE(?,?,00000000,SWUpdaterSetup.exe,?,?,00000000), ref: 00D71FE0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$AppendCopyModuleNamePath
                                                                                        • String ID: SWUpdaterSetup.exe
                                                                                        • API String ID: 1240757089-3356249072
                                                                                        • Opcode ID: 7e60aec25c7c539c51dcbdf4a5e304e23efe19454e3930e7f07075d906b40676
                                                                                        • Instruction ID: 2705709fee1a0f9cad8dc657142a9fcb36d507dd39ef1b434207b52fd63e8ff3
                                                                                        • Opcode Fuzzy Hash: 7e60aec25c7c539c51dcbdf4a5e304e23efe19454e3930e7f07075d906b40676
                                                                                        • Instruction Fuzzy Hash: 14113971900249ABDB14EBA4CDD2CFEB7B9EF14310B504569E41AA3291FB709F4ADB70
                                                                                        Function 00D71BC1 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 70stringCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 296 d71bc1-d71bee call d727fc call d71447 301 d71bf2-d71bff 296->301 302 d71bf0 296->302 303 d71c11-d71c2d call d729a2 call d72a19 301->303 304 d71c01-d71c0f call d72b77 301->304 302->301 309 d71c30-d71c44 lstrcmpiW call d72b5c 303->309 304->309 314 d71c46-d71c60 call d72823 call d72a7a 309->314 315 d71c62 309->315 317 d71c64-d71c72 call d72b5c 314->317 315->317
                                                                                        APIs
                                                                                        • lstrcmpiW.KERNELBASE(?,?,00000000,00000000,00000000,00D71A35,?,?,?,?,00000104), ref: 00D71C32
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrcmpi
                                                                                        • String ID: /%s$nomitag
                                                                                        • API String ID: 1586166983-2458505853
                                                                                        • Opcode ID: 2f857d4168b84803633735ed776d658c7db73b56383e5b8974972104e3a50982
                                                                                        • Instruction ID: 1a109066999c152e2e9a7e421364595b623ad47c88e6c31929e4bd71df1ae937
                                                                                        • Opcode Fuzzy Hash: 2f857d4168b84803633735ed776d658c7db73b56383e5b8974972104e3a50982
                                                                                        • Instruction Fuzzy Hash: 67117276600144AFCB04EFA9C896DAEB7A9EF953507108569F40E9B351FA30EA05C7B0
                                                                                        Function 00D71814 Relevance: 3.0, APIs: 2, Instructions: 40fileCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 331 d71814-d71823 332 d71825-d7182a 331->332 333 d7185d 331->333 334 d71842-d71856 call d72595 RemoveDirectoryW call d7285f 332->334 335 d7182c-d71840 call d72570 DeleteFileW 332->335 336 d71860-d71883 call d72b5c * 2 call d72595 call d72b5c 333->336 345 d7185b 334->345 335->334 345->336
                                                                                        APIs
                                                                                        • DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,00D724E2,?), ref: 00D71836
                                                                                        • RemoveDirectoryW.KERNELBASE(?,?,00000000,?,00D724E2,?), ref: 00D7184E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: DeleteDirectoryFileRemove
                                                                                        • String ID:
                                                                                        • API String ID: 3325800564-0
                                                                                        • Opcode ID: acb844f3ae70d7ae48768efd01523801c865270c629d234ef6db1e4274f62510
                                                                                        • Instruction ID: eb44eca8222c926840a05eab4f641f4dd6d92238fbee237d84447bb8c2273208
                                                                                        • Opcode Fuzzy Hash: acb844f3ae70d7ae48768efd01523801c865270c629d234ef6db1e4274f62510
                                                                                        • Instruction Fuzzy Hash: 8FF06935200B009B8725AF25D8A247AB3B6EF95300300CA2DE09B0B566FF30B80BDB75
                                                                                        Function 00D729C1 Relevance: 2.5, APIs: 2, Instructions: 39COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 351 d729c1-d729cc 352 d729ce-d729e5 MultiByteToWideChar 351->352 353 d72a0a-d72a0c call d7285f 351->353 352->353 355 d729e7-d72a08 call d72823 MultiByteToWideChar call d72a7a 352->355 356 d72a11-d72a16 353->356 355->356
                                                                                        APIs
                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,?,?,?,00D73267,00D730C2,?,?), ref: 00D729DA
                                                                                        • MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,-00000001,-00000001,?,00D73267,00D730C2,?,?), ref: 00D729FA
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ByteCharMultiWide
                                                                                        • String ID:
                                                                                        • API String ID: 626452242-0
                                                                                        • Opcode ID: bd1a94a6a5ac972182119d4241d38924154c019bfb2e2e22c117a66f48f88ad1
                                                                                        • Instruction ID: 29ce94703ace8708e40de51395c7aa290b40eb97e76ef2fcdddaac9cc543531c
                                                                                        • Opcode Fuzzy Hash: bd1a94a6a5ac972182119d4241d38924154c019bfb2e2e22c117a66f48f88ad1
                                                                                        • Instruction Fuzzy Hash: 68F0E9313041907EDA2116598C05F7FB66DCF91B20F104219BA1CDA2E1E9A04A0142B5
                                                                                        Function 00D721AA Relevance: 1.7, APIs: 1, Instructions: 164COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 361 d721aa-d721d0 362 d721d2-d721d5 361->362 363 d721da-d72284 call d74ac5 call d84e08 call d74967 361->363 364 d72380-d7238e call d75814 362->364 373 d72286-d7228b call d84c1e 363->373 374 d7228d-d72296 363->374 378 d72297-d722a9 373->378 374->378 379 d722b2-d722bb 378->379 380 d722ab call d84c1e 378->380 384 d722bc-d722c2 379->384 382 d722b0 380->382 382->384 385 d722c4-d722c7 384->385 386 d722cc-d7233b call d84e08 call d74b3b 384->386 387 d72372-d72378 call d84c1e 385->387 394 d72340-d7235e WriteFile 386->394 395 d7233d-d7233e 386->395 392 d7237d-d7237e 387->392 392->364 397 d72360-d72366 394->397 398 d72368 394->398 396 d7236b-d7236c call d84c1e 395->396 400 d72371 396->400 397->396 397->398 398->396 400->387
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: beeeaca9a035a4254a55f0ce390de5b43a4ee35d454d1067c780f6f4f7d0f514
                                                                                        • Instruction ID: aa7e52400dcbfacba7a6109e698004834f6dd2ed2f015c02b83a74825d23a8fc
                                                                                        • Opcode Fuzzy Hash: beeeaca9a035a4254a55f0ce390de5b43a4ee35d454d1067c780f6f4f7d0f514
                                                                                        • Instruction Fuzzy Hash: 7C51FA71D002699FDB24DF68DC80AAEBBB8FB49314F5481AEE55DE7241EA3099448F60
                                                                                        Function 00D7BE14 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00D7A87E: RtlAllocateHeap.NTDLL(00000008,00D903AC,00000000,?,00D7A552,00000001,00000364,00000006,000000FF,?,00D7D1A7,00D9038C,00000004,00000004,?,00000000), ref: 00D7A8BF
                                                                                        • _free.LIBCMT ref: 00D7BE83
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocateHeap_free
                                                                                        • String ID:
                                                                                        • API String ID: 614378929-0
                                                                                        • Opcode ID: 37e29c66f7d6a1b5f0838b4ace8c95cb6219044116b55bff626f544574675af6
                                                                                        • Instruction ID: c6f4df78780d06c709d9d26d8b13d559bc5dd64f06978df8a697cbad56a42e26
                                                                                        • Opcode Fuzzy Hash: 37e29c66f7d6a1b5f0838b4ace8c95cb6219044116b55bff626f544574675af6
                                                                                        • Instruction Fuzzy Hash: D50126726003566BC3208F98C881ADEFB98EB053B0F14462AF559A76C0E370AD01C7B5
                                                                                        Function 00D7A87E Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RtlAllocateHeap.NTDLL(00000008,00D903AC,00000000,?,00D7A552,00000001,00000364,00000006,000000FF,?,00D7D1A7,00D9038C,00000004,00000004,?,00000000), ref: 00D7A8BF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 1279760036-0
                                                                                        • Opcode ID: 99b170e1e225bb293d83d092ec974b9d275371278d17298c701af959d22967c7
                                                                                        • Instruction ID: d5725c18b75fcd0b3d0062e7b0a30b8cc250a0a42cf64a4eb5c5fc57a5af5030
                                                                                        • Opcode Fuzzy Hash: 99b170e1e225bb293d83d092ec974b9d275371278d17298c701af959d22967c7
                                                                                        • Instruction Fuzzy Hash: 41F0543154462466EB215B2E9C49A5E3B58DFC1760F19C163E81CE7291FA30D8039AF7
                                                                                        Function 00D7C540 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RtlAllocateHeap.NTDLL(00000000,00D9038C,00000004,?,00D7F5C9,00D903AC,00000000,?,00D7D1A7,00D9038C,00000004,00000004,?,00000000,?,00D77E16), ref: 00D7C572
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 1279760036-0
                                                                                        • Opcode ID: c50065324d6609845c2f148bf74d052540e49df10eeb96a1c3de56f698157ed9
                                                                                        • Instruction ID: 58c57cd82a54c0366af1ece738e12b9627bfd1e7db310840b2b6810c5b92d42f
                                                                                        • Opcode Fuzzy Hash: c50065324d6609845c2f148bf74d052540e49df10eeb96a1c3de56f698157ed9
                                                                                        • Instruction Fuzzy Hash: 80E0E5316287206FE6212AB59C04B5A3A59DF42BA0F1D9114FC0CE2181FA72EC4151F5
                                                                                        Function 00D72FCA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • DeleteFileW.KERNELBASE(00000000,00000000,?,00000000,?,00D71A94,?), ref: 00D72FE1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: DeleteFile
                                                                                        • String ID:
                                                                                        • API String ID: 4033686569-0
                                                                                        • Opcode ID: be5fa440e506c077c0a67ec4c9fa67c3b309ce26bdb35cba3a6e8177c3e4acac
                                                                                        • Instruction ID: e53d7549c490afe46ce6591bf4370eb7314d0c0a3818f28ffe8d73bed4849691
                                                                                        • Opcode Fuzzy Hash: be5fa440e506c077c0a67ec4c9fa67c3b309ce26bdb35cba3a6e8177c3e4acac
                                                                                        • Instruction Fuzzy Hash: 77E086311006408F83259E25EC50C76F3F9FF91360314862ED09B82410AB607D46D770
                                                                                        Function 00D78207 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00D7821A
                                                                                          • Part of subcall function 00D7A8DB: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000), ref: 00D7A8F1
                                                                                          • Part of subcall function 00D7A8DB: GetLastError.KERNEL32(00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000,00000000), ref: 00D7A903
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorFreeHeapLast_free
                                                                                        • String ID:
                                                                                        • API String ID: 1353095263-0
                                                                                        • Opcode ID: 5087327d7d5784c8df729c0d2532e340a66c33fb5e685a90e4c25e1b05200b88
                                                                                        • Instruction ID: b4f44278f97b0ea7fc682849908c4fac4145b108c32167753c4998884e07618e
                                                                                        • Opcode Fuzzy Hash: 5087327d7d5784c8df729c0d2532e340a66c33fb5e685a90e4c25e1b05200b88
                                                                                        • Instruction Fuzzy Hash: 2EC08C31000208BBCB009B45C80AA4E7BA8DB80364F204054F40427250DAB1EE01A6A1
                                                                                        Function 00D7114D Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 00D7115E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeHeap
                                                                                        • String ID:
                                                                                        • API String ID: 3298025750-0
                                                                                        • Opcode ID: 50c89e9994bf475e78774302800bceec83d9e571d8d06bdf09f80d4ed0ddfc4c
                                                                                        • Instruction ID: 5f84bca19ee503263967047e6bcda3973319f5c03e72d39a76cbdd5004f4d0f5
                                                                                        • Opcode Fuzzy Hash: 50c89e9994bf475e78774302800bceec83d9e571d8d06bdf09f80d4ed0ddfc4c
                                                                                        • Instruction Fuzzy Hash: 17C01231000308EACB010A44DC09BD6BA68AB00304F64C020BA08484A1877294A0DAA4
                                                                                        Function 00D71138 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00D71143
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 1279760036-0
                                                                                        • Opcode ID: ef0d8a8cfd81017b80677c14f98830e4a39bddb5d9afe59a0d540a97f1ed72cf
                                                                                        • Instruction ID: 564c53456113deec35e204080e747a828830410d91cad2fe5722b2b3fd8f7bc0
                                                                                        • Opcode Fuzzy Hash: ef0d8a8cfd81017b80677c14f98830e4a39bddb5d9afe59a0d540a97f1ed72cf
                                                                                        • Instruction Fuzzy Hash: 19B09232054208BBCA011B82EC06FC5BF29EB15761F208021F608881A18773E461ABA8

                                                                                        Non-executed Functions

                                                                                        Function 00D72D52 Relevance: 9.2, APIs: 6, Instructions: 157windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,00000000,?,00D71457), ref: 00D72DD3
                                                                                        • SetLastError.KERNEL32(00000000,?,00000000,?,00D71457), ref: 00D72DE0
                                                                                        • FormatMessageW.KERNEL32(00000500,00000000,00000000,00000000,00000000,00000000,00D71457,?,00000000,?,00D71457), ref: 00D72DF6
                                                                                        • GetLastError.KERNEL32(?,00000000,?,00D71457), ref: 00D72E00
                                                                                        • SetLastError.KERNEL32(00D71457,?,00000000,?,00D71457), ref: 00D72E0D
                                                                                        • LocalFree.KERNEL32(00000000,?,00000000,?,00D71457), ref: 00D72EB9
                                                                                          • Part of subcall function 00D7266F: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,00000000,?,?,?,00D72D7B,00D71457,?,?,?,8007000E), ref: 00D726A0
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast$FindFormatFreeLocalMessageResource
                                                                                        • String ID:
                                                                                        • API String ID: 1240203180-0
                                                                                        • Opcode ID: 9453e6a07bb50d4ff23cae61ff6c368c0a3d87a57aa5cb245a34337cddeef308
                                                                                        • Instruction ID: 7d9fa590464318fca07588ff15bf02506a1c8059a6bed1f97807c7724a196c76
                                                                                        • Opcode Fuzzy Hash: 9453e6a07bb50d4ff23cae61ff6c368c0a3d87a57aa5cb245a34337cddeef308
                                                                                        • Instruction Fuzzy Hash: 31518071A00248ABDB14EBA5DC85ABEB7B9EF44310F148059F90997241FB719E409BB1
                                                                                        Function 00D844A9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00D71097: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00D7109C
                                                                                          • Part of subcall function 00D71097: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00D710A6
                                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,00D7100A), ref: 00D844DC
                                                                                        • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00D7100A), ref: 00D844EB
                                                                                        Strings
                                                                                        • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D844E6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                        • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                        • API String ID: 450123788-631824599
                                                                                        • Opcode ID: ae2f0e54b7de8675db8ba4afca957363a87dd916769221cb4aadc7a684d81e08
                                                                                        • Instruction ID: 09ccc6107c620edab0b0c51f1a727b2c237b2ccf6bca7fcb4e1876be6fa4e939
                                                                                        • Opcode Fuzzy Hash: ae2f0e54b7de8675db8ba4afca957363a87dd916769221cb4aadc7a684d81e08
                                                                                        • Instruction Fuzzy Hash: CFE065702003528FE320AF2CE8087427AE4EF44750F10895EE88ACA751EBB4E4888BB1
                                                                                        Function 00D7A602 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000004), ref: 00D7A6FA
                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000004), ref: 00D7A704
                                                                                        • UnhandledExceptionFilter.KERNEL32(00D7112F,?,?,?,?,?,00000004), ref: 00D7A711
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                        • String ID:
                                                                                        • API String ID: 3906539128-0
                                                                                        • Opcode ID: d469b5bb7d44c8f005fa1f3172252d1a9a1fdc4a6187d79db4a5b498de26af99
                                                                                        • Instruction ID: 27dbfd4c1fa35f858d87c5b33571c33bbe3477dcbca4423070c1db365be86d0a
                                                                                        • Opcode Fuzzy Hash: d469b5bb7d44c8f005fa1f3172252d1a9a1fdc4a6187d79db4a5b498de26af99
                                                                                        • Instruction Fuzzy Hash: 0931C6749513289BCB21DF28D989B8DBBB4EF08310F5081DAE41CA62A0E7709F858F65
                                                                                        Function 00D711D5 Relevance: 4.6, APIs: 3, Instructions: 53memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetProcessHeap.KERNEL32(?,?,00D72804,?,00D71457), ref: 00D71218
                                                                                        • __Init_thread_footer.LIBCMT ref: 00D7123F
                                                                                          • Part of subcall function 00D84D32: EnterCriticalSection.KERNEL32(00D90368,00D90398,?,?,00D7120E,00D90398,?,?,00D72804,?,00D71457), ref: 00D84D3D
                                                                                          • Part of subcall function 00D84D32: LeaveCriticalSection.KERNEL32(00D90368,?,00D7120E,00D90398,?,?,00D72804,?,00D71457), ref: 00D84D7A
                                                                                        • __Init_thread_footer.LIBCMT ref: 00D712A1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalInit_thread_footerSection$EnterHeapLeaveProcess
                                                                                        • String ID:
                                                                                        • API String ID: 3363689876-0
                                                                                        • Opcode ID: ed0e0b9febcb4224e8c6ee0b57ec3f6ecb5bb3cb0ccd3a0d931ac37dd1faf0b4
                                                                                        • Instruction ID: aa4d6d6811956b836d33e3b7a33a999407c2d8534ac49b0e85c51d5a337b6ceb
                                                                                        • Opcode Fuzzy Hash: ed0e0b9febcb4224e8c6ee0b57ec3f6ecb5bb3cb0ccd3a0d931ac37dd1faf0b4
                                                                                        • Instruction Fuzzy Hash: D0118C76929700CFC310AB68FC067193FA4FB41725F15821FE658CB3A2E77454448B38
                                                                                        Function 00D75638 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00D7564E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: FeaturePresentProcessor
                                                                                        • String ID:
                                                                                        • API String ID: 2325560087-0
                                                                                        • Opcode ID: 3b6f53e729f654c2bafd097c860372a814efeb6e086dd80acfc6cbddf4a85d44
                                                                                        • Instruction ID: 4a29d553f6b47bf06630761dc71812354602988d9433887c1cdd49976b1512d5
                                                                                        • Opcode Fuzzy Hash: 3b6f53e729f654c2bafd097c860372a814efeb6e086dd80acfc6cbddf4a85d44
                                                                                        • Instruction Fuzzy Hash: 47515CB19117059FDB28CF58E885BAEB7F0FB54320F28852AD409EB355E3B59940CF61
                                                                                        Function 00D7551E Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_0000552A,00D74E97), ref: 00D75523
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                        • String ID:
                                                                                        • API String ID: 3192549508-0
                                                                                        • Opcode ID: 2dabc51358c77f317981b10262c07074a18067f321c9ed3c24954192833cc927
                                                                                        • Instruction ID: 673a57101b9e2811153bb8522e7bdd7853e83a5d30cbde24f0d172020c5bd9f3
                                                                                        • Opcode Fuzzy Hash: 2dabc51358c77f317981b10262c07074a18067f321c9ed3c24954192833cc927
                                                                                        • Instruction Fuzzy Hash:
                                                                                        Function 00D7BDE3 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID:
                                                                                        • API String ID:
                                                                                        • Opcode ID: 3556515d0abfdd8d5b2c639671a518f35a8b338c1170c44d59ed3ffd25cf2065
                                                                                        • Instruction ID: 4ae79df9639475c25b2444de0b369a45ffda34868fa929705a1fd200b8678833
                                                                                        • Opcode Fuzzy Hash: 3556515d0abfdd8d5b2c639671a518f35a8b338c1170c44d59ed3ffd25cf2065
                                                                                        • Instruction Fuzzy Hash: D4E04672911238EBCB24DB888944A8AB3ACEB44B10B65809ABA45D3200D270DE00C7E4
                                                                                        Function 00D84C4A Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(00D90368,00000FA0,?,?,00D84C28), ref: 00D84C56
                                                                                        • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00D84C28), ref: 00D84C61
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00D84C28), ref: 00D84C72
                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00D84C84
                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00D84C92
                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00D84C28), ref: 00D84CB5
                                                                                        • ___scrt_fastfail.LIBCMT ref: 00D84CC6
                                                                                        • DeleteCriticalSection.KERNEL32(00D90368,00000007,?,?,00D84C28), ref: 00D84CD1
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00D84C28), ref: 00D84CE1
                                                                                        Strings
                                                                                        • kernel32.dll, xrefs: 00D84C6D
                                                                                        • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00D84C5C
                                                                                        • SleepConditionVariableCS, xrefs: 00D84C7E
                                                                                        • WakeAllConditionVariable, xrefs: 00D84C8A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
                                                                                        • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                        • API String ID: 3578986977-3242537097
                                                                                        • Opcode ID: d56b9b09c93f1da6083f0206bfcfd6c5c4ede1874d8b82bfcf0f4e268a3bd4b4
                                                                                        • Instruction ID: 9031acdf9dd4b206dbb9ee8a287f04a7eec23e8bfd5fc087c33ef71a4fe865dc
                                                                                        • Opcode Fuzzy Hash: d56b9b09c93f1da6083f0206bfcfd6c5c4ede1874d8b82bfcf0f4e268a3bd4b4
                                                                                        • Instruction Fuzzy Hash: 57018475B66712AFDB216F75BD0EE2A3ABCEF44B61B140155F904D23A0EB74C8048771
                                                                                        Function 00D7CA06 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ___free_lconv_mon.LIBCMT ref: 00D7CA4A
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C2B6
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C2C8
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C2DA
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C2EC
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C2FE
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C310
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C322
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C334
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C346
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C358
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C36A
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C37C
                                                                                          • Part of subcall function 00D7C299: _free.LIBCMT ref: 00D7C38E
                                                                                        • _free.LIBCMT ref: 00D7CA3F
                                                                                          • Part of subcall function 00D7A8DB: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000), ref: 00D7A8F1
                                                                                          • Part of subcall function 00D7A8DB: GetLastError.KERNEL32(00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000,00000000), ref: 00D7A903
                                                                                        • _free.LIBCMT ref: 00D7CA61
                                                                                        • _free.LIBCMT ref: 00D7CA76
                                                                                        • _free.LIBCMT ref: 00D7CA81
                                                                                        • _free.LIBCMT ref: 00D7CAA3
                                                                                        • _free.LIBCMT ref: 00D7CAB6
                                                                                        • _free.LIBCMT ref: 00D7CAC4
                                                                                        • _free.LIBCMT ref: 00D7CACF
                                                                                        • _free.LIBCMT ref: 00D7CB07
                                                                                        • _free.LIBCMT ref: 00D7CB0E
                                                                                        • _free.LIBCMT ref: 00D7CB2B
                                                                                        • _free.LIBCMT ref: 00D7CB43
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                        • String ID:
                                                                                        • API String ID: 161543041-0
                                                                                        • Opcode ID: 1af4301dc12f0f26ab5ff69efe33d25c72eb9703d4ac67caf6ea5aa07551c753
                                                                                        • Instruction ID: 2e61d6913c774a0f657bae3e88deb2bd5ea943d638c154ff5a03db5c0164e7f4
                                                                                        • Opcode Fuzzy Hash: 1af4301dc12f0f26ab5ff69efe33d25c72eb9703d4ac67caf6ea5aa07551c753
                                                                                        • Instruction Fuzzy Hash: 44311931610605AFEB21AA78D84AB5A77E8EB44351F18D92DF05DE6261FF30EC419B32
                                                                                        Function 00D7A298 Relevance: 15.1, APIs: 10, Instructions: 69COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00D7A2AE
                                                                                          • Part of subcall function 00D7A8DB: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000), ref: 00D7A8F1
                                                                                          • Part of subcall function 00D7A8DB: GetLastError.KERNEL32(00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000,00000000), ref: 00D7A903
                                                                                        • _free.LIBCMT ref: 00D7A2BA
                                                                                        • _free.LIBCMT ref: 00D7A2C5
                                                                                        • _free.LIBCMT ref: 00D7A2D0
                                                                                        • _free.LIBCMT ref: 00D7A2DB
                                                                                        • _free.LIBCMT ref: 00D7A2E6
                                                                                        • _free.LIBCMT ref: 00D7A2F1
                                                                                        • _free.LIBCMT ref: 00D7A2FC
                                                                                        • _free.LIBCMT ref: 00D7A307
                                                                                        • _free.LIBCMT ref: 00D7A315
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 07be49c6e5b7185172311da276d5ac309708b34437448074096e3e0893de8e77
                                                                                        • Instruction ID: ff0d3b61e81c2680846e8a01a0beb1618102c568d9c7ab010284c00999da3359
                                                                                        • Opcode Fuzzy Hash: 07be49c6e5b7185172311da276d5ac309708b34437448074096e3e0893de8e77
                                                                                        • Instruction Fuzzy Hash: 8321897690010CFFCB41EF98C885DDD7BB5EF48340F018166F519AB261EB31DA559BA2
                                                                                        Function 00D75990 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00D759C7
                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 00D759CF
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00D75A58
                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00D75A83
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00D75AD8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                        • String ID: csm
                                                                                        • API String ID: 1170836740-1018135373
                                                                                        • Opcode ID: 8da64d5af792efe24f689b17582a413539fddbf3e7214fac2e14b9c0eb3967e6
                                                                                        • Instruction ID: 77b9aeae51324331fb8b2c7d951eaf1ebc962779aeda64182fe894c5d1896c23
                                                                                        • Opcode Fuzzy Hash: 8da64d5af792efe24f689b17582a413539fddbf3e7214fac2e14b9c0eb3967e6
                                                                                        • Instruction Fuzzy Hash: B341B734A006089FCF10DF18D8C5A9E7BA5EF44324F18C165E81D5B356E7B1EA55CBB2
                                                                                        Function 00D7CD71 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: api-ms-$ext-ms-
                                                                                        • API String ID: 0-537541572
                                                                                        • Opcode ID: 5d97b8f5411bdc746b748865bb70621d661f8034dc9c41861fad25aa7c2baeb9
                                                                                        • Instruction ID: 651da8a238ad5b13909dafe2089244cf352e327ef380ae1652b2deb4d62e2abc
                                                                                        • Opcode Fuzzy Hash: 5d97b8f5411bdc746b748865bb70621d661f8034dc9c41861fad25aa7c2baeb9
                                                                                        • Instruction Fuzzy Hash: 4D219671A25721AFCB314B249C85B5E3B68AB017A0F299528FD5DA7390F630DD0496F0
                                                                                        Function 00D7C438 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00D7C400: _free.LIBCMT ref: 00D7C425
                                                                                        • _free.LIBCMT ref: 00D7C486
                                                                                          • Part of subcall function 00D7A8DB: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000), ref: 00D7A8F1
                                                                                          • Part of subcall function 00D7A8DB: GetLastError.KERNEL32(00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000,00000000), ref: 00D7A903
                                                                                        • _free.LIBCMT ref: 00D7C491
                                                                                        • _free.LIBCMT ref: 00D7C49C
                                                                                        • _free.LIBCMT ref: 00D7C4F0
                                                                                        • _free.LIBCMT ref: 00D7C4FB
                                                                                        • _free.LIBCMT ref: 00D7C506
                                                                                        • _free.LIBCMT ref: 00D7C511
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 14d1313e0a5866ef498f2876da777e54ebb6706a0f7bd26736af99a44b319bdb
                                                                                        • Instruction ID: ce4d285004261e5fbe49fc851751027ba6c9d72540baf02e93920fa1824bea3f
                                                                                        • Opcode Fuzzy Hash: 14d1313e0a5866ef498f2876da777e54ebb6706a0f7bd26736af99a44b319bdb
                                                                                        • Instruction Fuzzy Hash: ED117272590B04BAD520B770CC1BFDB779CDF44708F808828B29DA6152EA25B54697B1
                                                                                        Function 00D7F73C Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetConsoleCP.KERNEL32(00D7A46C,00007FFD,00000000), ref: 00D7F784
                                                                                        • __fassign.LIBCMT ref: 00D7F963
                                                                                        • __fassign.LIBCMT ref: 00D7F980
                                                                                        • WriteFile.KERNEL32(?,00000028,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D7F9C8
                                                                                        • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D7FA08
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D7FAB4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileWrite__fassign$ConsoleErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 4031098158-0
                                                                                        • Opcode ID: ffb8aa7b787db89ade3d074d8ff598be59c63b91d2da9b105a198fcaf1b251c0
                                                                                        • Instruction ID: a568839634a0a80d7f596b5f23016f9aceb88f2fe53c44f4c8c020d39b91332c
                                                                                        • Opcode Fuzzy Hash: ffb8aa7b787db89ade3d074d8ff598be59c63b91d2da9b105a198fcaf1b251c0
                                                                                        • Instruction Fuzzy Hash: 30D15D75D002589FCF25CFA8C8809EDBBB5EF49314F28816AE959FB341E7319946CB60
                                                                                        Function 00D75F8A Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,00D75F81,00D75C2F,00D7556E), ref: 00D75F98
                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D75FA6
                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D75FBF
                                                                                        • SetLastError.KERNEL32(00000000,00D75F81,00D75C2F,00D7556E), ref: 00D76011
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                        • String ID:
                                                                                        • API String ID: 3852720340-0
                                                                                        • Opcode ID: 3a6b8919faf039740868fbd46bc650567291a862d2460e295f4d395e5181bf1f
                                                                                        • Instruction ID: 05eaa6eda6ba78d349b0cac727f0c57c78fd424de0a84f7bc0b9558e53b6e807
                                                                                        • Opcode Fuzzy Hash: 3a6b8919faf039740868fbd46bc650567291a862d2460e295f4d395e5181bf1f
                                                                                        • Instruction Fuzzy Hash: FB01D432529F115EE62527747C85B2A6AA8EB05776334C33AF51CC12F2FF62CC00A274
                                                                                        Function 00D7B147 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        • C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe, xrefs: 00D7B14C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                        • API String ID: 0-3415609609
                                                                                        • Opcode ID: edba37965b8ac1fc00f46563fa8cb28b20cdb142facc439d27ad98317535e8ca
                                                                                        • Instruction ID: 9f1cea79a13d270a6849cd4824b423f72ea6c2c278844e2849a2d0139dde55f7
                                                                                        • Opcode Fuzzy Hash: edba37965b8ac1fc00f46563fa8cb28b20cdb142facc439d27ad98317535e8ca
                                                                                        • Instruction Fuzzy Hash: 5421AF71604205BE9B20AF658C81B6F77A8EB40378754C626F86D96252F730EC4187B1
                                                                                        Function 00D7621E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,00D762DF,?,?,00D8FC98,00000000,?,00D7640A,00000004,InitializeCriticalSectionEx,00D87CB4,InitializeCriticalSectionEx,00000000), ref: 00D762AE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary
                                                                                        • String ID: api-ms-
                                                                                        • API String ID: 3664257935-2084034818
                                                                                        • Opcode ID: 3c2403d90258fe942ffd16e657a3d5cafc229e0d456a3144d57dcad6f96fb81e
                                                                                        • Instruction ID: 156cf1aa70a798229d00ef90c5689cf2be09078c95753efdc4879e8a388e0cd0
                                                                                        • Opcode Fuzzy Hash: 3c2403d90258fe942ffd16e657a3d5cafc229e0d456a3144d57dcad6f96fb81e
                                                                                        • Instruction Fuzzy Hash: 7711A031A44B20ABDF628B689C85B5A37A4AF42770F294120FD18F7385F660ED0487F9
                                                                                        Function 00D77A68 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00D77A5D,?,?,00D77A25,00007FFD,00000000,?), ref: 00D77A7D
                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D77A90
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,00D77A5D,?,?,00D77A25,00007FFD,00000000,?), ref: 00D77AB3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                        • API String ID: 4061214504-1276376045
                                                                                        • Opcode ID: d51fcd7a1629a9a921cf25ae701ef920432d630510e4253cd4e7128a1d2c7c16
                                                                                        • Instruction ID: fa197a529a253ad0383c71540ba25b5fefdaf5180d3b31452ce2a29928be8ced
                                                                                        • Opcode Fuzzy Hash: d51fcd7a1629a9a921cf25ae701ef920432d630510e4253cd4e7128a1d2c7c16
                                                                                        • Instruction Fuzzy Hash: B4F0FE31A19319FFEB119B91DD0ABADBAB4EB00755F244050A509E2260DB74CF00DBB0
                                                                                        Function 00D7C397 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00D7C3AF
                                                                                          • Part of subcall function 00D7A8DB: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000), ref: 00D7A8F1
                                                                                          • Part of subcall function 00D7A8DB: GetLastError.KERNEL32(00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000,00000000), ref: 00D7A903
                                                                                        • _free.LIBCMT ref: 00D7C3C1
                                                                                        • _free.LIBCMT ref: 00D7C3D3
                                                                                        • _free.LIBCMT ref: 00D7C3E5
                                                                                        • _free.LIBCMT ref: 00D7C3F7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 30959444ca35d5d194496397e08d25d96e14bfc9b303e929db0f12a84d1e9b30
                                                                                        • Instruction ID: 2d544af365bdccf5992cabefb44793b7e32ecd3473e60828bbb8dc3653079ec8
                                                                                        • Opcode Fuzzy Hash: 30959444ca35d5d194496397e08d25d96e14bfc9b303e929db0f12a84d1e9b30
                                                                                        • Instruction Fuzzy Hash: 7DF0FF72524200BBC624EB68E48AC1E73D9EB48710768DA19F44CE7B60FB30FC824775
                                                                                        Function 00D7E1A8 Relevance: 6.3, APIs: 4, Instructions: 320COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: _strrchr
                                                                                        • String ID:
                                                                                        • API String ID: 3213747228-0
                                                                                        • Opcode ID: 2e78852298b71bb59d16febdcf3e60b191b3b2da08cc3ddfac315e26b7c302f1
                                                                                        • Instruction ID: eafb94d9f36ce5919ce3a0144888b4f69aa911b20195ff36f2252bd09e01273c
                                                                                        • Opcode Fuzzy Hash: 2e78852298b71bb59d16febdcf3e60b191b3b2da08cc3ddfac315e26b7c302f1
                                                                                        • Instruction Fuzzy Hash: C0B114329002559FDB15DF68C8817AEBBE5EF59314F18C1EAE849DB242E234DD41CBB4
                                                                                        Function 00D7A9DF Relevance: 6.1, APIs: 4, Instructions: 86COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00D7B001: _free.LIBCMT ref: 00D7B00F
                                                                                          • Part of subcall function 00D7BBDB: WideCharToMultiByte.KERNEL32(00007FFD,00000000,00007FFD,00000000,00007FFD,00000028,00D800CC,?,00007FFD,?,00000000,?,00D7FE3B,0000FDE9,00000000,?), ref: 00D7BC7D
                                                                                        • GetLastError.KERNEL32 ref: 00D7AA47
                                                                                        • __dosmaperr.LIBCMT ref: 00D7AA4E
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00D7AA8D
                                                                                        • __dosmaperr.LIBCMT ref: 00D7AA94
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
                                                                                        • String ID:
                                                                                        • API String ID: 167067550-0
                                                                                        • Opcode ID: 4ad378c82f8af271d51fe476178720d57b250d1b29663d0cf6236cea7e3057ae
                                                                                        • Instruction ID: c4cfab3479df566f7122262e09e15c47d362db3f2c6d4827da74971bda9e3c29
                                                                                        • Opcode Fuzzy Hash: 4ad378c82f8af271d51fe476178720d57b250d1b29663d0cf6236cea7e3057ae
                                                                                        • Instruction Fuzzy Hash: FF219071600605AFAB20AF698D8196FB7A8EF80364714C525F82D97241F730EC41D7B2
                                                                                        Function 00D7A3B0 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,00007FFD,?,00D78815,00007FFD,00000000,00000000,?,00D7832E,00007FFD,00000000,00007FFD), ref: 00D7A3B5
                                                                                        • _free.LIBCMT ref: 00D7A412
                                                                                        • _free.LIBCMT ref: 00D7A448
                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,00D7832E,00007FFD,00000000,00007FFD), ref: 00D7A453
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast_free
                                                                                        • String ID:
                                                                                        • API String ID: 2283115069-0
                                                                                        • Opcode ID: f8599a4f3ba2806865a90fdffac73c017f818c66994f674a33eb00d998385370
                                                                                        • Instruction ID: 00baa0a6042b8c56ef530ae0e3cad8d82d7c88a5d284b02e91e8ca0cc400c42d
                                                                                        • Opcode Fuzzy Hash: f8599a4f3ba2806865a90fdffac73c017f818c66994f674a33eb00d998385370
                                                                                        • Instruction Fuzzy Hash: A3118A32255301AED61127BC9C89A2F265ADBC5775B388239F51CE66D2FEA28C056332
                                                                                        Function 00D7A507 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(00D9038C,00D903AC,00D9038C,00D7A870,00D7F5E7,?,00D7D1A7,00D9038C,00000004,00000004,?,00000000,?,00D77E16,?,00000004), ref: 00D7A50C
                                                                                        • _free.LIBCMT ref: 00D7A569
                                                                                        • _free.LIBCMT ref: 00D7A59F
                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,00D7D1A7,00D9038C,00000004,00000004,?,00000000,?,00D77E16,?,00000004,00000004,00D903AC), ref: 00D7A5AA
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast_free
                                                                                        • String ID:
                                                                                        • API String ID: 2283115069-0
                                                                                        • Opcode ID: 73f4d4349c0ccce31ea22d15fedf513c362741651b28c19e73b93518d1477fab
                                                                                        • Instruction ID: f5eb45a76848474acdcc6f2128c44255b5662f8c14c2954f093163d298f87757
                                                                                        • Opcode Fuzzy Hash: 73f4d4349c0ccce31ea22d15fedf513c362741651b28c19e73b93518d1477fab
                                                                                        • Instruction Fuzzy Hash: 3411A932255301AED711277CAC85E2F266AEBC5774B348239F51CE62E1FE61CC055332
                                                                                        Function 00D713A0 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 00D713FF
                                                                                        • VerSetConditionMask.KERNEL32(00000000), ref: 00D71403
                                                                                        • VerSetConditionMask.KERNEL32(00000000), ref: 00D71407
                                                                                        • VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 00D7142B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConditionMask$InfoVerifyVersion
                                                                                        • String ID:
                                                                                        • API String ID: 2793162063-0
                                                                                        • Opcode ID: 2e3a69f3a26ed67f55486a8f837c39dfcdb6d85ae54d04bb83386620e0716564
                                                                                        • Instruction ID: 365da9a384fd6315731b63720a91637f3699b969e15ac4ae66c27cb365296bb7
                                                                                        • Opcode Fuzzy Hash: 2e3a69f3a26ed67f55486a8f837c39dfcdb6d85ae54d04bb83386620e0716564
                                                                                        • Instruction Fuzzy Hash: 45111670E503187AEB219F559C4AFEFBBBCDF85B10F00409AA508E6281D6B45B448FA5
                                                                                        Function 00D82596 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteConsoleW.KERNEL32(00007FFD,00000008,00007FFD,00000000,00007FFD,?,00D81F3C,00007FFD,00000001,00007FFD,00007FFD,?,00D7FB11,00000000,00D7A46C,00007FFD), ref: 00D825AD
                                                                                        • GetLastError.KERNEL32(?,00D81F3C,00007FFD,00000001,00007FFD,00007FFD,?,00D7FB11,00000000,00D7A46C,00007FFD,00000000,00007FFD,?,00D80065,00000028), ref: 00D825B9
                                                                                          • Part of subcall function 00D8257F: CloseHandle.KERNEL32(FFFFFFFE,00D825C9,?,00D81F3C,00007FFD,00000001,00007FFD,00007FFD,?,00D7FB11,00000000,00D7A46C,00007FFD,00000000,00007FFD), ref: 00D8258F
                                                                                        • ___initconout.LIBCMT ref: 00D825C9
                                                                                          • Part of subcall function 00D82541: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00D82570,00D81F29,00007FFD,?,00D7FB11,00000000,00D7A46C,00007FFD,00000000), ref: 00D82554
                                                                                        • WriteConsoleW.KERNEL32(00007FFD,00000008,00007FFD,00000000,?,00D81F3C,00007FFD,00000001,00007FFD,00007FFD,?,00D7FB11,00000000,00D7A46C,00007FFD,00000000), ref: 00D825DE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                        • String ID:
                                                                                        • API String ID: 2744216297-0
                                                                                        • Opcode ID: 60ce5478731106b4d091b0c1c646299a1ce46d2cba12c56bd89ea80b1dc738cb
                                                                                        • Instruction ID: e885b1bfd509913747c9922f174514b9cd80c7bc18667a39f1f1d20399d6752d
                                                                                        • Opcode Fuzzy Hash: 60ce5478731106b4d091b0c1c646299a1ce46d2cba12c56bd89ea80b1dc738cb
                                                                                        • Instruction Fuzzy Hash: 19F01C76454219BBCF226F92DC099AA7F76FB083B0B144050FE18C5270D632C820DBB1
                                                                                        Function 00D84DBA Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SleepConditionVariableCS.KERNELBASE(?,00D84D57,00000064), ref: 00D84DDD
                                                                                        • LeaveCriticalSection.KERNEL32(00D90368,?,?,00D84D57,00000064,?,00D7120E,00D90398,?,?,00D72804,?,00D71457), ref: 00D84DE7
                                                                                        • WaitForSingleObjectEx.KERNEL32(?,00000000,?,00D84D57,00000064,?,00D7120E,00D90398,?,?,00D72804,?,00D71457), ref: 00D84DF8
                                                                                        • EnterCriticalSection.KERNEL32(00D90368,?,00D84D57,00000064,?,00D7120E,00D90398,?,?,00D72804,?,00D71457), ref: 00D84DFF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                        • String ID:
                                                                                        • API String ID: 3269011525-0
                                                                                        • Opcode ID: 7febface423155d71be5fbd8d46973a6b1b4ba47b747984c6965d9437bf09c34
                                                                                        • Instruction ID: 1f853c18c45f92998b533405042bd3d150ea2000db51d45617e1c775e2d04011
                                                                                        • Opcode Fuzzy Hash: 7febface423155d71be5fbd8d46973a6b1b4ba47b747984c6965d9437bf09c34
                                                                                        • Instruction Fuzzy Hash: 09E01A36A55728BFCB122F90FC0AA8E7E28BB09B55B241151F905A6360CB6598008BF0
                                                                                        Function 00D780AC Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00D780B5
                                                                                          • Part of subcall function 00D7A8DB: RtlFreeHeap.NTDLL(00000000,00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000), ref: 00D7A8F1
                                                                                          • Part of subcall function 00D7A8DB: GetLastError.KERNEL32(00000000,?,00D7C42A,00000000,00000000,00000000,00D9038C,?,00D7C451,00000000,00000007,00000000,?,00D7CB9D,00000000,00000000), ref: 00D7A903
                                                                                        • _free.LIBCMT ref: 00D780C8
                                                                                        • _free.LIBCMT ref: 00D780D9
                                                                                        • _free.LIBCMT ref: 00D780EA
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: af3850771b7593914d9a0f6069a8794eee9651423b5eca5dc65ebceed830e6fe
                                                                                        • Instruction ID: bb26a27b11a4b552596941c2af5482506fcca30752a4bca5fe038dde3b00e30b
                                                                                        • Opcode Fuzzy Hash: af3850771b7593914d9a0f6069a8794eee9651423b5eca5dc65ebceed830e6fe
                                                                                        • Instruction Fuzzy Hash: C1E092B1821320AB86026F29FC054593E32EB88710741862AF418E2333E7720512ABB2
                                                                                        Function 00D772CE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000001.00000002.3110396745.0000000000D71000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00D70000, based on PE: true
                                                                                        • Associated: 00000001.00000002.3110368006.0000000000D70000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110429850.0000000000D87000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110460830.0000000000D8F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                        • Associated: 00000001.00000002.3110492721.0000000000D91000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_1_2_d70000_SWUpdaterSetup.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nstDC9E.tmp\SWUpdaterSetup.exe
                                                                                        • API String ID: 0-3415609609
                                                                                        • Opcode ID: bd1dd2a6387472c27b1f6d7fd16c86e05b67c26bac8cccbf7ea08c89f624eeb0
                                                                                        • Instruction ID: 0994de208d484f5edab769696a92a4240767546eb1fe126607c14ab4306bb38c
                                                                                        • Opcode Fuzzy Hash: bd1dd2a6387472c27b1f6d7fd16c86e05b67c26bac8cccbf7ea08c89f624eeb0
                                                                                        • Instruction Fuzzy Hash: 8B419671A14214EBCB129B9DCC85DAEBBB8EB85310F148866F818D7311F7B08E41D771

                                                                                        Execution Graph

                                                                                        Execution Coverage:3.5%
                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                        Signature Coverage:0%
                                                                                        Total number of Nodes:1775
                                                                                        Total number of Limit Nodes:23
                                                                                        execution_graph 7980 64b264 7989 64d439 GetEnvironmentStringsW 7980->7989 7984 64c3b2 _free 14 API calls 7986 64b2ab 7984->7986 7987 64c3b2 _free 14 API calls 7988 64b27c 7987->7988 7988->7984 7990 64d44d 7989->7990 7991 64b276 7989->7991 8013 64e8b4 7990->8013 7991->7988 7996 64b2b1 7991->7996 7993 64d461 ___scrt_uninitialize_crt 7994 64c3b2 _free 14 API calls 7993->7994 7995 64d47b FreeEnvironmentStringsW 7994->7995 7995->7991 7998 64b2d0 7996->7998 7997 64c559 __dosmaperr 14 API calls 8008 64b30e 7997->8008 7998->7997 7998->7998 7999 64b38f 8000 64c3b2 _free 14 API calls 7999->8000 8001 64b287 8000->8001 8001->7987 8002 64c559 __dosmaperr 14 API calls 8002->8008 8003 64b391 8020 64b3be 8003->8020 8004 64a7b4 25 API calls 8004->8008 8007 64b3b1 8010 64a9d4 __fassign 11 API calls 8007->8010 8008->7999 8008->8002 8008->8003 8008->8004 8008->8007 8011 64c3b2 _free 14 API calls 8008->8011 8009 64c3b2 _free 14 API calls 8009->7999 8012 64b3bd 8010->8012 8011->8008 8014 64e8f2 8013->8014 8018 64e8c2 __dosmaperr 8013->8018 8016 64aa81 _free 14 API calls 8014->8016 8015 64e8dd HeapAlloc 8017 64e8f0 8015->8017 8015->8018 8016->8017 8017->7993 8018->8014 8018->8015 8019 64db39 __dosmaperr 2 API calls 8018->8019 8019->8018 8021 64b3cb 8020->8021 8025 64b397 8020->8025 8022 64b3e2 8021->8022 8023 64c3b2 _free 14 API calls 8021->8023 8024 64c3b2 _free 14 API calls 8022->8024 8023->8021 8024->8025 8025->8009 8026 64da65 8027 64da6a 8026->8027 8029 64da8d 8027->8029 8030 64e3f9 8027->8030 8031 64e406 8030->8031 8032 64e428 8030->8032 8033 64e414 DeleteCriticalSection 8031->8033 8034 64e422 8031->8034 8032->8027 8033->8033 8033->8034 8035 64c3b2 _free 14 API calls 8034->8035 8035->8032 6768 6477e7 6777 647aaf GetModuleHandleW 6768->6777 6771 647825 6782 64aef3 6771->6782 6772 6477f3 6773 6477fe 6772->6773 6779 64aed5 6772->6779 6778 6477ef 6777->6778 6778->6771 6778->6772 6785 64adcd 6779->6785 6783 64adcd __fassign 23 API calls 6782->6783 6784 64782d 6783->6784 6786 64aded 6785->6786 6787 64addb 6785->6787 6803 64ac74 6786->6803 6788 647aaf __fassign GetModuleHandleW 6787->6788 6790 64ade0 6788->6790 6790->6786 6797 64ae73 GetModuleHandleExW 6790->6797 6792 64ae26 6792->6773 6798 64aeb5 6797->6798 6799 64ae92 GetProcAddress 6797->6799 6800 64adec 6798->6800 6801 64aebb FreeLibrary 6798->6801 6802 64aea7 6799->6802 6800->6786 6801->6800 6802->6798 6804 64ac80 ___scrt_is_nonwritable_in_current_image 6803->6804 6819 64c4c9 EnterCriticalSection 6804->6819 6806 64ac8a 6820 64ace0 6806->6820 6808 64ac97 6824 64acb5 6808->6824 6811 64ae31 6880 64c528 GetPEB 6811->6880 6814 64ae60 6817 64ae73 __fassign 3 API calls 6814->6817 6815 64ae40 GetPEB 6815->6814 6816 64ae50 GetCurrentProcess TerminateProcess 6815->6816 6816->6814 6818 64ae68 ExitProcess 6817->6818 6819->6806 6821 64acec ___scrt_is_nonwritable_in_current_image 6820->6821 6822 64ad4d __fassign 6821->6822 6827 64b757 6821->6827 6822->6808 6879 64c511 LeaveCriticalSection 6824->6879 6826 64aca3 6826->6792 6826->6811 6830 64b488 6827->6830 6831 64b494 ___scrt_is_nonwritable_in_current_image 6830->6831 6838 64c4c9 EnterCriticalSection 6831->6838 6833 64b4a2 6839 64b667 6833->6839 6838->6833 6840 64b4af 6839->6840 6842 64b686 6839->6842 6843 64b4d7 6840->6843 6842->6840 6846 64c3b2 6842->6846 6878 64c511 LeaveCriticalSection 6843->6878 6845 64b4c0 6845->6822 6847 64c3bd HeapFree 6846->6847 6848 64c3e6 _free 6846->6848 6847->6848 6849 64c3d2 6847->6849 6848->6840 6852 64aa81 6849->6852 6855 64c2b7 GetLastError 6852->6855 6854 64aa86 GetLastError 6854->6848 6856 64c2ce 6855->6856 6857 64c2d4 6855->6857 6859 64d6c5 __dosmaperr 6 API calls 6856->6859 6858 64d704 __dosmaperr 6 API calls 6857->6858 6876 64c2da SetLastError 6857->6876 6860 64c2f2 6858->6860 6859->6857 6861 64c559 __dosmaperr 12 API calls 6860->6861 6860->6876 6862 64c302 6861->6862 6864 64c321 6862->6864 6865 64c30a 6862->6865 6867 64d704 __dosmaperr 6 API calls 6864->6867 6866 64d704 __dosmaperr 6 API calls 6865->6866 6874 64c318 6866->6874 6868 64c32d 6867->6868 6869 64c331 6868->6869 6870 64c342 6868->6870 6871 64d704 __dosmaperr 6 API calls 6869->6871 6872 64bf8e __dosmaperr 12 API calls 6870->6872 6871->6874 6875 64c34d 6872->6875 6873 64c3b2 _free 12 API calls 6873->6876 6874->6873 6877 64c3b2 _free 12 API calls 6875->6877 6876->6854 6877->6876 6878->6845 6879->6826 6881 64ae3b 6880->6881 6882 64c542 6880->6882 6881->6814 6881->6815 6884 64d607 6882->6884 6887 64d584 6884->6887 6886 64d623 6886->6881 6888 64d5b2 6887->6888 6892 64d5ae __dosmaperr 6887->6892 6888->6892 6893 64d4bd 6888->6893 6891 64d5cc GetProcAddress 6891->6892 6892->6886 6897 64d4ce ___vcrt_FlsSetValue 6893->6897 6894 64d579 6894->6891 6894->6892 6895 64d4ec LoadLibraryExW 6896 64d507 GetLastError 6895->6896 6895->6897 6896->6897 6897->6894 6897->6895 6898 64d562 FreeLibrary 6897->6898 6899 64d53a LoadLibraryExW 6897->6899 6898->6897 6899->6897 8036 646362 HeapAlloc 8037 64c86c 8044 64ca40 8037->8044 8040 64c3b2 _free 14 API calls 8042 64c882 8040->8042 8041 64c3b2 _free 14 API calls 8043 64c827 8041->8043 8042->8041 8045 64ca52 8044->8045 8054 64c876 8044->8054 8046 64ca57 8045->8046 8047 64ca7d 8045->8047 8048 64c559 __dosmaperr 14 API calls 8046->8048 8050 64aaaf 28 API calls 8047->8050 8047->8054 8049 64ca60 8048->8049 8052 64c3b2 _free 14 API calls 8049->8052 8051 64ca9d 8050->8051 8053 64c3b2 _free 14 API calls 8051->8053 8052->8054 8053->8054 8054->8040 8054->8042 8055 64e16c 8056 64e179 8055->8056 8057 64c559 __dosmaperr 14 API calls 8056->8057 8058 64e193 8057->8058 8059 64c3b2 _free 14 API calls 8058->8059 8060 64e19f 8059->8060 8061 64c559 __dosmaperr 14 API calls 8060->8061 8065 64e1c5 8060->8065 8063 64e1b9 8061->8063 8062 64d746 6 API calls 8062->8065 8064 64c3b2 _free 14 API calls 8063->8064 8064->8065 8065->8062 8066 64e1d1 8065->8066 8067 64c36c 8075 64d647 8067->8075 8070 64c2b7 __dosmaperr 14 API calls 8071 64c388 8070->8071 8072 64c395 8071->8072 8080 64c398 8071->8080 8074 64c380 8076 64d584 __dosmaperr 5 API calls 8075->8076 8077 64d663 8076->8077 8078 64d67b TlsAlloc 8077->8078 8079 64c376 8077->8079 8078->8079 8079->8070 8079->8074 8081 64c3a2 8080->8081 8082 64c3a8 8080->8082 8084 64d686 8081->8084 8082->8074 8085 64d584 __dosmaperr 5 API calls 8084->8085 8086 64d6a2 8085->8086 8087 64d6bd TlsFree 8086->8087 8088 64d6ab 8086->8088 8088->8082 8710 6475ed 8711 6475f5 8710->8711 8727 64ba5d 8711->8727 8713 647600 8734 64743d 8713->8734 8715 647672 8716 64795c ___scrt_fastfail 4 API calls 8715->8716 8726 64768f 8715->8726 8717 647697 8716->8717 8718 647615 __RTC_Initialize 8718->8715 8719 6475ca 28 API calls 8718->8719 8720 64762e 8719->8720 8720->8715 8740 647e36 InitializeSListHead 8720->8740 8722 647644 8741 647e45 8722->8741 8724 647667 8747 64bb5c 8724->8747 8728 64ba6c 8727->8728 8729 64ba8f 8727->8729 8728->8729 8730 64aa81 _free 14 API calls 8728->8730 8729->8713 8731 64ba7f 8730->8731 8732 64a9c4 __fassign 25 API calls 8731->8732 8733 64ba8a 8732->8733 8733->8713 8735 64744d 8734->8735 8736 647449 8734->8736 8737 64795c ___scrt_fastfail 4 API calls 8735->8737 8739 64745a ___scrt_release_startup_lock 8735->8739 8736->8718 8738 6474c3 8737->8738 8739->8718 8740->8722 8754 64bc36 8741->8754 8743 647e56 8744 647e5d 8743->8744 8745 64795c ___scrt_fastfail 4 API calls 8743->8745 8744->8724 8746 647e65 8745->8746 8748 64c160 __fassign 66 API calls 8747->8748 8750 64bb67 8748->8750 8749 64bb9f 8749->8715 8750->8749 8751 64aa81 _free 14 API calls 8750->8751 8752 64bb94 8751->8752 8753 64a9c4 __fassign 25 API calls 8752->8753 8753->8749 8755 64bc74 8754->8755 8757 64bc54 8754->8757 8755->8743 8756 64aa81 _free 14 API calls 8758 64bc6a 8756->8758 8757->8756 8759 64a9c4 __fassign 25 API calls 8758->8759 8759->8755 8760 6470f6 DeleteCriticalSection 8761 647176 8760->8761 8762 647185 8761->8762 8763 64aa94 ___vcrt_freefls@4 14 API calls 8761->8763 8763->8762 8089 646377 8090 646380 HeapFree 8089->8090 8091 64638e 8089->8091 8090->8091 8764 646df7 8765 646e08 8764->8765 8767 646e19 8765->8767 8768 646f69 8765->8768 8770 646f88 8768->8770 8769 646fdd 8770->8769 8771 646e4e 14 API calls 8770->8771 8772 646fb4 8771->8772 8772->8767 8092 651470 8095 65148e 8092->8095 8094 651486 8096 651493 8095->8096 8097 651528 8096->8097 8100 651d53 8096->8100 8097->8094 8101 651d66 DecodePointer 8100->8101 8102 651d76 8100->8102 8101->8102 8103 651dba 8102->8103 8104 651da5 8102->8104 8107 6516bf 8102->8107 8105 64aa81 _free 14 API calls 8103->8105 8103->8107 8106 64aa81 _free 14 API calls 8104->8106 8104->8107 8105->8107 8106->8107 8107->8094 8108 64e373 8110 64e2a8 8108->8110 8109 64e2c0 8111 64e2d4 8109->8111 8112 64aa81 _free 14 API calls 8109->8112 8110->8109 8110->8111 8115 64e2fd 8110->8115 8113 64e2ca 8112->8113 8114 64a9c4 __fassign 25 API calls 8113->8114 8114->8111 8115->8111 8116 64aa81 _free 14 API calls 8115->8116 8116->8113 8117 650f7f 8118 650f88 8117->8118 8119 65102e 8118->8119 8120 650faf 8118->8120 8126 651d17 8119->8126 8121 651c40 8120->8121 8124 651d17 20 API calls 8120->8124 8125 651c3e 8124->8125 8127 651d20 8126->8127 8130 65218f 8127->8130 8131 6521ce __startOneArgErrorHandling 8130->8131 8133 652250 __startOneArgErrorHandling 8131->8133 8138 65259a 8131->8138 8135 652285 8133->8135 8141 6528b3 8133->8141 8136 647198 _ValidateLocalCookies 5 API calls 8135->8136 8137 65103e 8136->8137 8148 6525bd 8138->8148 8142 6528d5 8141->8142 8143 6528c0 8141->8143 8145 64aa81 _free 14 API calls 8142->8145 8144 6528da 8143->8144 8146 64aa81 _free 14 API calls 8143->8146 8144->8135 8145->8144 8147 6528cd 8146->8147 8147->8135 8149 6525e8 __raise_exc 8148->8149 8150 6527e1 RaiseException 8149->8150 8151 6525b8 8150->8151 8151->8133 8773 64c8fe 8774 64c90f 8773->8774 8775 647198 _ValidateLocalCookies 5 API calls 8774->8775 8776 64ca1a 8775->8776 8777 647afe 8778 647b35 8777->8778 8779 647b10 8777->8779 8779->8778 8786 649d34 8779->8786 8798 649d62 8786->8798 8788 647b42 8789 649d3d 8788->8789 8790 649d62 76 API calls 8789->8790 8791 647b4c 8790->8791 8792 64bbfa 8791->8792 8793 64bc06 ___scrt_is_nonwritable_in_current_image 8792->8793 8794 64c160 __fassign 66 API calls 8793->8794 8797 64bc0b 8794->8797 8795 64bc95 __fassign 66 API calls 8796 64bc35 8795->8796 8797->8795 8811 649d70 8798->8811 8800 649d67 8800->8788 8801 64dc90 __fassign 2 API calls 8800->8801 8802 64bc9a 8801->8802 8803 64dcde __fassign 66 API calls 8802->8803 8806 64bca5 8802->8806 8803->8806 8804 64bcaf IsProcessorFeaturePresent 8807 64bcbb 8804->8807 8805 64aef3 __fassign 23 API calls 8809 64bcd8 8805->8809 8806->8804 8810 64bcce 8806->8810 8808 64a818 __fassign 8 API calls 8807->8808 8808->8810 8810->8805 8812 649d7c GetLastError 8811->8812 8813 649d79 8811->8813 8825 64a1d9 8812->8825 8813->8800 8816 649db0 8817 649df6 SetLastError 8816->8817 8817->8800 8818 64a214 ___vcrt_FlsSetValue 6 API calls 8819 649daa 8818->8819 8819->8816 8820 649dd2 8819->8820 8822 64a214 ___vcrt_FlsSetValue 6 API calls 8819->8822 8821 64a214 ___vcrt_FlsSetValue 6 API calls 8820->8821 8823 649de6 8820->8823 8821->8823 8822->8820 8824 64aa94 ___vcrt_freefls@4 14 API calls 8823->8824 8824->8816 8826 64a11a ___vcrt_FlsSetValue 5 API calls 8825->8826 8827 64a1f3 8826->8827 8828 649d91 8827->8828 8829 64a20b TlsGetValue 8827->8829 8828->8816 8828->8817 8828->8818 8829->8828 8152 651c45 8156 651c6d 8152->8156 8153 651ca5 8154 651c97 8157 651d17 20 API calls 8154->8157 8155 651c9e 8161 651d00 8155->8161 8156->8153 8156->8154 8156->8155 8159 651c9c 8157->8159 8162 651d20 8161->8162 8163 65218f __startOneArgErrorHandling 20 API calls 8162->8163 8164 651ca3 8163->8164 8165 64af45 8166 64af55 8165->8166 8167 64af5c 8165->8167 8168 64af7d GetModuleFileNameW 8167->8168 8169 64af67 8167->8169 8172 64afa4 8168->8172 8170 64aa81 _free 14 API calls 8169->8170 8171 64af6c 8170->8171 8173 64a9c4 __fassign 25 API calls 8171->8173 8182 64b209 8172->8182 8173->8166 8176 64afda 8177 64aa81 _free 14 API calls 8176->8177 8181 64afdf 8177->8181 8178 64c3b2 _free 14 API calls 8178->8166 8179 64afe6 8180 64c3b2 _free 14 API calls 8179->8180 8179->8181 8180->8181 8181->8178 8183 64afd1 8182->8183 8184 64b21a 8182->8184 8183->8176 8183->8179 8184->8183 8185 64c559 __dosmaperr 14 API calls 8184->8185 8186 64b243 8185->8186 8187 64c3b2 _free 14 API calls 8186->8187 8187->8183 8188 64b846 8191 64b8ad 8188->8191 8192 64b859 8191->8192 8193 64b8c1 8191->8193 8193->8192 8194 64c3b2 _free 14 API calls 8193->8194 8194->8192 8195 649d46 8196 649d50 8195->8196 8197 649d5d 8195->8197 8196->8197 8199 64aa94 8196->8199 8200 64c3b2 _free 14 API calls 8199->8200 8201 64aaac 8200->8201 8201->8197 8202 651f47 8203 651f60 __startOneArgErrorHandling 8202->8203 8205 651f89 __startOneArgErrorHandling 8203->8205 8206 6522e1 8203->8206 8207 65231a __startOneArgErrorHandling 8206->8207 8208 652341 __startOneArgErrorHandling 8207->8208 8209 6525bd __raise_exc RaiseException 8207->8209 8210 652384 8208->8210 8212 65235f 8208->8212 8209->8208 8211 6528b3 __startOneArgErrorHandling 14 API calls 8210->8211 8214 65237f __startOneArgErrorHandling 8211->8214 8217 6528e2 8212->8217 8215 647198 _ValidateLocalCookies 5 API calls 8214->8215 8216 6523a8 8215->8216 8216->8205 8218 6528f1 8217->8218 8219 652965 __startOneArgErrorHandling 8218->8219 8223 652910 __startOneArgErrorHandling 8218->8223 8220 6528b3 __startOneArgErrorHandling 14 API calls 8219->8220 8221 65297a 8220->8221 8221->8214 8222 65295e 8222->8214 8223->8222 8224 6528b3 __startOneArgErrorHandling 14 API calls 8223->8224 8224->8222 8225 651041 8226 651065 8225->8226 8227 65107e 8226->8227 8229 651f47 __startOneArgErrorHandling 8226->8229 8228 6510c8 8227->8228 8230 651d53 15 API calls 8227->8230 8231 6522e1 20 API calls 8229->8231 8232 651f89 __startOneArgErrorHandling 8229->8232 8230->8228 8231->8232 8830 64d2c0 GetCommandLineA GetCommandLineW 8233 649f4d 8234 649f5f 8233->8234 8236 649f6d 8233->8236 8235 647198 _ValidateLocalCookies 5 API calls 8234->8235 8235->8236 8835 64c9ce 8836 64ca04 FindClose 8835->8836 8837 64c9ea 8835->8837 8839 64ca0b 8836->8839 8843 64f470 8837->8843 8841 647198 _ValidateLocalCookies 5 API calls 8839->8841 8842 64ca1a 8841->8842 8844 64f4aa 8843->8844 8845 64aa81 _free 14 API calls 8844->8845 8850 64f4be 8844->8850 8846 64f4b3 8845->8846 8847 64a9c4 __fassign 25 API calls 8846->8847 8847->8850 8848 647198 _ValidateLocalCookies 5 API calls 8849 64c9fd 8848->8849 8849->8836 8850->8848 8851 6463c8 HeapSize 8241 64d84a 8242 64d87b 8241->8242 8244 64d855 8241->8244 8243 64d865 FreeLibrary 8243->8244 8244->8242 8244->8243 8852 649ad0 8853 649aee 8852->8853 8864 649a90 8853->8864 8865 649aa2 8864->8865 8866 649aaf 8864->8866 8867 647198 _ValidateLocalCookies 5 API calls 8865->8867 8867->8866 8868 6477d3 8871 64ab1c 8868->8871 8872 64c2b7 __dosmaperr 14 API calls 8871->8872 8873 6477e4 8872->8873 8245 64b85d 8246 64c3b2 _free 14 API calls 8245->8246 8247 64b86b 8246->8247 8248 64c3b2 _free 14 API calls 8247->8248 8249 64b87e 8248->8249 8250 64c3b2 _free 14 API calls 8249->8250 8251 64b88f 8250->8251 8252 64c3b2 _free 14 API calls 8251->8252 8253 64b8a0 8252->8253 8874 6463dd 8877 646346 8874->8877 8876 6463e8 _AnonymousOriginator 8878 646361 8877->8878 8879 646352 8877->8879 8878->8876 8879->8878 8880 646358 HeapDestroy 8879->8880 8880->8878 8254 65145b IsProcessorFeaturePresent 8255 64bc26 8256 64bc29 8255->8256 8257 64bc95 __fassign 66 API calls 8256->8257 8258 64bc35 8257->8258 8259 64c027 8260 64c042 8259->8260 8261 64c032 8259->8261 8265 64c048 8261->8265 8264 64c3b2 _free 14 API calls 8264->8260 8266 64c063 8265->8266 8267 64c05d 8265->8267 8269 64c3b2 _free 14 API calls 8266->8269 8268 64c3b2 _free 14 API calls 8267->8268 8268->8266 8270 64c06f 8269->8270 8271 64c3b2 _free 14 API calls 8270->8271 8272 64c07a 8271->8272 8273 64c3b2 _free 14 API calls 8272->8273 8274 64c085 8273->8274 8275 64c3b2 _free 14 API calls 8274->8275 8276 64c090 8275->8276 8277 64c3b2 _free 14 API calls 8276->8277 8278 64c09b 8277->8278 8279 64c3b2 _free 14 API calls 8278->8279 8280 64c0a6 8279->8280 8281 64c3b2 _free 14 API calls 8280->8281 8282 64c0b1 8281->8282 8283 64c3b2 _free 14 API calls 8282->8283 8284 64c0bc 8283->8284 8285 64c3b2 _free 14 API calls 8284->8285 8286 64c0ca 8285->8286 8291 64be74 8286->8291 8292 64be80 ___scrt_is_nonwritable_in_current_image 8291->8292 8307 64c4c9 EnterCriticalSection 8292->8307 8294 64beb4 8308 64bed3 8294->8308 8296 64be8a 8296->8294 8298 64c3b2 _free 14 API calls 8296->8298 8298->8294 8299 64bedf 8300 64beeb ___scrt_is_nonwritable_in_current_image 8299->8300 8312 64c4c9 EnterCriticalSection 8300->8312 8302 64bef5 8303 64c115 __dosmaperr 14 API calls 8302->8303 8304 64bf08 8303->8304 8313 64bf28 8304->8313 8307->8296 8311 64c511 LeaveCriticalSection 8308->8311 8310 64bec1 8310->8299 8311->8310 8312->8302 8316 64c511 LeaveCriticalSection 8313->8316 8315 64bf16 8315->8264 8316->8315 8881 64a2a0 RtlUnwind 8882 6476a0 8887 647af2 SetUnhandledExceptionFilter 8882->8887 8884 6476a5 8888 64bbc5 8884->8888 8886 6476b0 8887->8884 8889 64bbeb 8888->8889 8890 64bbd1 8888->8890 8889->8886 8890->8889 8891 64aa81 _free 14 API calls 8890->8891 8892 64bbdb 8891->8892 8893 64a9c4 __fassign 25 API calls 8892->8893 8894 64bbe6 8893->8894 8894->8886 8317 64782e 8320 647de5 8317->8320 8319 647833 8319->8319 8321 647dfb 8320->8321 8323 647e04 8321->8323 8324 647d98 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 8321->8324 8323->8319 8324->8323 8895 6471a9 8906 6471d0 InitializeCriticalSectionAndSpinCount GetModuleHandleW 8895->8906 8897 6471ae 8898 64743d 4 API calls 8897->8898 8899 6471b5 8898->8899 8900 6471c8 8899->8900 8901 6471ba 8899->8901 8903 64795c ___scrt_fastfail 4 API calls 8900->8903 8902 6475ca 28 API calls 8901->8902 8904 6471c4 8902->8904 8905 6471cf 8903->8905 8907 647204 GetProcAddress GetProcAddress 8906->8907 8908 6471f3 GetModuleHandleW 8906->8908 8910 647234 CreateEventW 8907->8910 8911 647222 8907->8911 8908->8907 8909 64724a 8908->8909 8913 64795c ___scrt_fastfail 4 API calls 8909->8913 8910->8909 8912 647226 8910->8912 8911->8910 8911->8912 8912->8897 8914 647251 DeleteCriticalSection 8913->8914 8915 647266 CloseHandle 8914->8915 8916 64726d 8914->8916 8915->8916 8916->8897 8325 64e234 8326 64e163 ___scrt_uninitialize_crt 66 API calls 8325->8326 8327 64e23c 8326->8327 8335 65072a 8327->8335 8329 64e241 8345 6507d5 8329->8345 8332 64e26b 8333 64c3b2 _free 14 API calls 8332->8333 8334 64e276 8333->8334 8336 650736 ___scrt_is_nonwritable_in_current_image 8335->8336 8349 64c4c9 EnterCriticalSection 8336->8349 8338 6507ad 8363 6507cc 8338->8363 8340 650741 8340->8338 8342 650781 DeleteCriticalSection 8340->8342 8350 650cfa 8340->8350 8344 64c3b2 _free 14 API calls 8342->8344 8344->8340 8346 6507ec 8345->8346 8348 64e250 DeleteCriticalSection 8345->8348 8347 64c3b2 _free 14 API calls 8346->8347 8346->8348 8347->8348 8348->8329 8348->8332 8349->8340 8351 650d06 ___scrt_is_nonwritable_in_current_image 8350->8351 8352 650d25 8351->8352 8353 650d10 8351->8353 8359 650d20 8352->8359 8366 64e280 EnterCriticalSection 8352->8366 8354 64aa81 _free 14 API calls 8353->8354 8356 650d15 8354->8356 8358 64a9c4 __fassign 25 API calls 8356->8358 8357 650d42 8367 650c83 8357->8367 8358->8359 8359->8340 8361 650d4d 8383 650d74 8361->8383 8442 64c511 LeaveCriticalSection 8363->8442 8365 6507b9 8365->8329 8366->8357 8368 650c90 8367->8368 8370 650ca5 8367->8370 8369 64aa81 _free 14 API calls 8368->8369 8371 650c95 8369->8371 8372 64e0b6 ___scrt_uninitialize_crt 66 API calls 8370->8372 8375 650ca0 8370->8375 8373 64a9c4 __fassign 25 API calls 8371->8373 8374 650cba 8372->8374 8373->8375 8376 6507d5 14 API calls 8374->8376 8375->8361 8377 650cc2 8376->8377 8378 64f409 ___scrt_uninitialize_crt 25 API calls 8377->8378 8379 650cc8 8378->8379 8386 6512f7 8379->8386 8382 64c3b2 _free 14 API calls 8382->8375 8441 64e294 LeaveCriticalSection 8383->8441 8385 650d7c 8385->8359 8387 651308 8386->8387 8390 65131d 8386->8390 8388 64aa6e __dosmaperr 14 API calls 8387->8388 8392 65130d 8388->8392 8389 651366 8391 64aa6e __dosmaperr 14 API calls 8389->8391 8390->8389 8395 651344 8390->8395 8393 65136b 8391->8393 8394 64aa81 _free 14 API calls 8392->8394 8396 64aa81 _free 14 API calls 8393->8396 8398 650cce 8394->8398 8401 65126b 8395->8401 8399 651373 8396->8399 8398->8375 8398->8382 8400 64a9c4 __fassign 25 API calls 8399->8400 8400->8398 8402 651277 ___scrt_is_nonwritable_in_current_image 8401->8402 8412 64e4cc EnterCriticalSection 8402->8412 8404 651285 8405 6512b7 8404->8405 8406 6512ac 8404->8406 8408 64aa81 _free 14 API calls 8405->8408 8413 651384 8406->8413 8409 6512b2 8408->8409 8428 6512eb 8409->8428 8412->8404 8414 64e5a3 ___scrt_uninitialize_crt 25 API calls 8413->8414 8417 651394 8414->8417 8415 65139a 8431 64e512 8415->8431 8417->8415 8420 64e5a3 ___scrt_uninitialize_crt 25 API calls 8417->8420 8427 6513cc 8417->8427 8418 64e5a3 ___scrt_uninitialize_crt 25 API calls 8421 6513d8 CloseHandle 8418->8421 8422 6513c3 8420->8422 8421->8415 8423 6513e4 GetLastError 8421->8423 8425 64e5a3 ___scrt_uninitialize_crt 25 API calls 8422->8425 8423->8415 8424 64aa4b __dosmaperr 14 API calls 8426 651414 8424->8426 8425->8427 8426->8409 8427->8415 8427->8418 8440 64e4ef LeaveCriticalSection 8428->8440 8430 6512d4 8430->8398 8432 64e521 8431->8432 8433 64e588 8431->8433 8432->8433 8439 64e54b 8432->8439 8434 64aa81 _free 14 API calls 8433->8434 8435 64e58d 8434->8435 8436 64aa6e __dosmaperr 14 API calls 8435->8436 8437 64e578 8436->8437 8437->8424 8437->8426 8438 64e572 SetStdHandle 8438->8437 8439->8437 8439->8438 8440->8430 8441->8385 8442->8365 8443 64bb35 8446 64ba9a 8443->8446 8447 64baa6 ___scrt_is_nonwritable_in_current_image 8446->8447 8454 64c4c9 EnterCriticalSection 8447->8454 8449 64bab0 8450 64bade 8449->8450 8455 64edbd 8449->8455 8459 64bafc 8450->8459 8454->8449 8456 64edd8 8455->8456 8457 64edcb __dosmaperr 8455->8457 8456->8449 8457->8456 8458 64eaf0 __dosmaperr 14 API calls 8457->8458 8458->8456 8462 64c511 LeaveCriticalSection 8459->8462 8461 64baea 8462->8461 8917 64adb1 8918 64bbfa 66 API calls 8917->8918 8919 64adb9 8918->8919 6900 6476b2 6901 6476be ___scrt_is_nonwritable_in_current_image 6900->6901 6926 647404 6901->6926 6903 6476c5 6904 647818 6903->6904 6914 6476ef ___scrt_is_nonwritable_in_current_image __fassign ___scrt_release_startup_lock 6903->6914 6976 64795c IsProcessorFeaturePresent 6904->6976 6906 64781f 6957 64af2f 6906->6957 6909 64aef3 __fassign 23 API calls 6910 64782d 6909->6910 6911 64770e 6912 64778f 6937 647a76 6912->6937 6914->6911 6914->6912 6960 64af09 6914->6960 6915 647795 6941 6469c8 GetModuleHandleW GetProcAddress 6915->6941 6918 6477aa 6919 647aaf __fassign GetModuleHandleW 6918->6919 6920 6477b1 6919->6920 6920->6906 6921 6477b5 6920->6921 6922 6477be 6921->6922 6967 64aee4 6921->6967 6970 647575 6922->6970 6927 64740d 6926->6927 6980 647b5c IsProcessorFeaturePresent 6927->6980 6931 64741e 6932 647422 6931->6932 6990 64b8db 6931->6990 6932->6903 6935 647439 6935->6903 7165 649900 6937->7165 6940 647a9c 6940->6915 6942 6469e7 6941->6942 7167 646631 6942->7167 6944 6469f6 7194 646b81 6944->7194 6946 646a00 7197 646836 6946->7197 6949 646a15 LoadLibraryExW 6950 646a31 GetProcAddress 6949->6950 6951 646a28 6949->6951 6954 646a4f FreeLibrary 6950->6954 6955 646a43 GetCommandLineW 6950->6955 7228 6465ca GetLastError 6951->7228 6952 646a2d 6952->6918 6954->6952 6955->6954 6958 64adcd __fassign 23 API calls 6957->6958 6959 647825 6958->6959 6959->6909 6961 64af1f __dosmaperr 6960->6961 6962 64bbfa ___scrt_is_nonwritable_in_current_image 6960->6962 6961->6912 7436 64c160 GetLastError 6962->7436 6968 64adcd __fassign 23 API calls 6967->6968 6969 64aeef 6968->6969 6969->6922 6971 647581 6970->6971 6972 647597 6971->6972 7972 64b8ed 6971->7972 6972->6911 6974 64758f 6975 649a79 ___scrt_uninitialize_crt 7 API calls 6974->6975 6975->6972 6977 647971 ___scrt_fastfail 6976->6977 6978 647a1c IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 6977->6978 6979 647a67 ___scrt_fastfail 6978->6979 6979->6906 6981 647419 6980->6981 6982 649a5a 6981->6982 6999 649e50 6982->6999 6985 649a63 6985->6931 6987 649a6b 6988 649a76 6987->6988 7013 649e8c 6987->7013 6988->6931 7055 64da91 6990->7055 6993 649a79 6994 649a82 6993->6994 6995 649a8c 6993->6995 6996 649e35 ___vcrt_uninitialize_ptd 6 API calls 6994->6996 6995->6932 6997 649a87 6996->6997 6998 649e8c ___vcrt_uninitialize_locks DeleteCriticalSection 6997->6998 6998->6995 7000 649e59 6999->7000 7002 649e82 7000->7002 7004 649a5f 7000->7004 7017 64a252 7000->7017 7003 649e8c ___vcrt_uninitialize_locks DeleteCriticalSection 7002->7003 7003->7004 7004->6985 7005 649e02 7004->7005 7036 64a163 7005->7036 7010 649e32 7010->6987 7012 649e17 7012->6987 7014 649eb6 7013->7014 7015 649e97 7013->7015 7014->6985 7016 649ea1 DeleteCriticalSection 7015->7016 7016->7014 7016->7016 7022 64a11a 7017->7022 7020 64a28a InitializeCriticalSectionAndSpinCount 7021 64a275 7020->7021 7021->7000 7023 64a155 7022->7023 7024 64a132 7022->7024 7023->7020 7023->7021 7024->7023 7028 64a080 7024->7028 7027 64a147 GetProcAddress 7027->7023 7034 64a08c ___vcrt_FlsSetValue 7028->7034 7029 64a100 7029->7023 7029->7027 7030 64a0a2 LoadLibraryExW 7031 64a107 7030->7031 7032 64a0c0 GetLastError 7030->7032 7031->7029 7033 64a10f FreeLibrary 7031->7033 7032->7034 7033->7029 7034->7029 7034->7030 7035 64a0e2 LoadLibraryExW 7034->7035 7035->7031 7035->7034 7037 64a11a ___vcrt_FlsSetValue 5 API calls 7036->7037 7038 64a17d 7037->7038 7039 64a196 TlsAlloc 7038->7039 7040 649e0c 7038->7040 7040->7012 7041 64a214 7040->7041 7042 64a11a ___vcrt_FlsSetValue 5 API calls 7041->7042 7043 64a22e 7042->7043 7044 64a249 TlsSetValue 7043->7044 7045 649e25 7043->7045 7044->7045 7045->7010 7046 649e35 7045->7046 7047 649e45 7046->7047 7048 649e3f 7046->7048 7047->7012 7050 64a19e 7048->7050 7051 64a11a ___vcrt_FlsSetValue 5 API calls 7050->7051 7052 64a1b8 7051->7052 7053 64a1d0 TlsFree 7052->7053 7054 64a1c4 7052->7054 7053->7054 7054->7047 7056 64daa1 7055->7056 7057 64742b 7055->7057 7056->7057 7059 64da05 7056->7059 7057->6935 7057->6993 7060 64da11 ___scrt_is_nonwritable_in_current_image 7059->7060 7071 64c4c9 EnterCriticalSection 7060->7071 7062 64da18 7072 64e42e 7062->7072 7065 64da36 7096 64da5c 7065->7096 7071->7062 7073 64e43a ___scrt_is_nonwritable_in_current_image 7072->7073 7074 64e464 7073->7074 7075 64e443 7073->7075 7099 64c4c9 EnterCriticalSection 7074->7099 7077 64aa81 _free 14 API calls 7075->7077 7078 64e448 7077->7078 7107 64a9c4 7078->7107 7080 64da27 7080->7065 7085 64d89b GetStartupInfoW 7080->7085 7081 64e49c 7110 64e4c3 7081->7110 7082 64e470 7082->7081 7100 64e37e 7082->7100 7086 64d94c 7085->7086 7087 64d8b8 7085->7087 7091 64d951 7086->7091 7087->7086 7088 64e42e 26 API calls 7087->7088 7089 64d8e0 7088->7089 7089->7086 7090 64d910 GetFileType 7089->7090 7090->7089 7095 64d958 7091->7095 7092 64d99b GetStdHandle 7092->7095 7093 64da01 7093->7065 7094 64d9ae GetFileType 7094->7095 7095->7092 7095->7093 7095->7094 7164 64c511 LeaveCriticalSection 7096->7164 7098 64da47 7098->7056 7099->7082 7113 64c559 7100->7113 7102 64e39d 7104 64c3b2 _free 14 API calls 7102->7104 7103 64e390 7103->7102 7120 64d746 7103->7120 7106 64e3f2 7104->7106 7106->7082 7138 64a960 7107->7138 7109 64a9d0 7109->7080 7163 64c511 LeaveCriticalSection 7110->7163 7112 64e4ca 7112->7080 7114 64c566 __dosmaperr 7113->7114 7115 64c5a6 7114->7115 7116 64c591 RtlAllocateHeap 7114->7116 7125 64db39 7114->7125 7118 64aa81 _free 13 API calls 7115->7118 7116->7114 7117 64c5a4 7116->7117 7117->7103 7118->7117 7121 64d584 __dosmaperr 5 API calls 7120->7121 7122 64d762 7121->7122 7123 64d780 InitializeCriticalSectionAndSpinCount 7122->7123 7124 64d76b 7122->7124 7123->7124 7124->7103 7128 64db66 7125->7128 7129 64db72 ___scrt_is_nonwritable_in_current_image 7128->7129 7134 64c4c9 EnterCriticalSection 7129->7134 7131 64db7d 7135 64dbb9 7131->7135 7134->7131 7136 64c511 __dosmaperr LeaveCriticalSection 7135->7136 7137 64db44 7136->7137 7137->7114 7139 64c2b7 __dosmaperr 14 API calls 7138->7139 7140 64a96b 7139->7140 7141 64a979 7140->7141 7146 64a9d4 IsProcessorFeaturePresent 7140->7146 7141->7109 7143 64a9c3 7144 64a960 __fassign 25 API calls 7143->7144 7145 64a9d0 7144->7145 7145->7109 7147 64a9e0 7146->7147 7150 64a818 7147->7150 7151 64a834 ___scrt_fastfail 7150->7151 7152 64a860 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7151->7152 7153 64a931 ___scrt_fastfail 7152->7153 7156 647198 7153->7156 7155 64a94f GetCurrentProcess TerminateProcess 7155->7143 7157 6471a1 7156->7157 7158 6471a3 IsProcessorFeaturePresent 7156->7158 7157->7155 7160 647877 7158->7160 7161 64783b ___raise_securityfailure SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 7160->7161 7162 64795a 7161->7162 7162->7155 7163->7112 7164->7098 7166 647a89 GetStartupInfoW 7165->7166 7166->6940 7168 646b81 40 API calls 7167->7168 7169 646642 7168->7169 7170 64665b GetModuleFileNameW 7169->7170 7171 646673 7170->7171 7172 64674a 7171->7172 7230 6463ff 7171->7230 7172->6944 7174 64678d 7176 6466b0 7260 646d27 7176->7260 7178 6466be 7269 646c55 7178->7269 7180 6466bc 7245 646a70 7180->7245 7182 6466db 7249 646da4 7182->7249 7184 6466e6 7253 646b20 7184->7253 7186 6466f8 7187 646b81 40 API calls 7186->7187 7188 646708 7187->7188 7189 64671d SHGetFolderPathW 7188->7189 7190 646736 7189->7190 7190->7172 7282 646ae6 7190->7282 7192 646742 7193 646ae6 CharLowerBuffW 7192->7193 7193->7172 7195 6463ff 40 API calls 7194->7195 7196 646b89 7195->7196 7196->6946 7198 64686b ___scrt_fastfail 7197->7198 7199 64687a GetModuleFileNameW 7198->7199 7200 646895 7199->7200 7201 64689f PathRemoveFileSpecW 7199->7201 7203 6465ca GetLastError 7200->7203 7417 64a7b4 7201->7417 7205 64689a 7203->7205 7208 647198 _ValidateLocalCookies 5 API calls 7205->7208 7206 6468db 7426 6465e5 7206->7426 7210 6469c6 7208->7210 7210->6949 7210->6952 7211 64690d 7213 64a7b4 25 API calls 7211->7213 7212 6468ea 7215 646c55 25 API calls 7212->7215 7214 646925 7213->7214 7216 646b81 40 API calls 7214->7216 7215->7205 7217 646933 7216->7217 7432 646798 RegOpenKeyExW 7217->7432 7219 646944 7219->7205 7220 64694a PathAppendW 7219->7220 7221 64695d PathAppendW 7220->7221 7222 64696f 7220->7222 7221->7222 7223 646978 7221->7223 7224 6465ca GetLastError 7222->7224 7225 6465e5 6 API calls 7223->7225 7224->7205 7226 646983 7225->7226 7226->7205 7227 646c55 25 API calls 7226->7227 7227->7205 7229 6465d4 7228->7229 7229->6952 7231 64642d 7230->7231 7242 646416 7230->7242 7287 6472b8 EnterCriticalSection 7231->7287 7233 6472b8 6 API calls 7235 64647d 7233->7235 7234 646438 7236 646442 GetProcessHeap 7234->7236 7234->7242 7238 6475ca 28 API calls 7235->7238 7244 646428 7235->7244 7292 6475ca 7236->7292 7241 6464ca 7238->7241 7243 64726e __Init_thread_footer 5 API calls 7241->7243 7242->7233 7242->7244 7243->7244 7244->7174 7244->7176 7244->7178 7368 646ba8 7245->7368 7247 646a7e PathRemoveFileSpecW 7248 646a8d 7247->7248 7248->7182 7250 646daf 7249->7250 7252 646dbd 7250->7252 7370 646e4e 7250->7370 7252->7184 7254 646b38 7253->7254 7259 646b4c 7253->7259 7255 646b6d 7254->7255 7256 646b47 7254->7256 7257 646c55 25 API calls 7255->7257 7258 646da4 14 API calls 7256->7258 7257->7259 7258->7259 7259->7186 7376 647131 EnterCriticalSection 7260->7376 7262 646d99 7262->7180 7263 646d52 FindResourceExW 7266 646d3c 7263->7266 7264 647131 5 API calls 7264->7266 7266->7262 7266->7263 7266->7264 7267 646d8a 7266->7267 7381 6462e9 LoadResource 7266->7381 7267->7262 7385 646ec2 FindResourceW 7267->7385 7270 646c63 7269->7270 7272 646c6d 7269->7272 7270->7180 7271 646d01 7272->7271 7273 646ce7 7272->7273 7275 646c9d 7272->7275 7274 646e4e 14 API calls 7273->7274 7274->7270 7275->7270 7276 646cae 7275->7276 7277 646cc4 7275->7277 7278 64aa81 _free 14 API calls 7276->7278 7277->7270 7280 64aa81 _free 14 API calls 7277->7280 7279 646cb3 7278->7279 7281 64a9c4 __fassign 25 API calls 7279->7281 7280->7279 7281->7270 7283 646af5 7282->7283 7284 646b15 7283->7284 7285 646b00 CharLowerBuffW 7283->7285 7286 646b10 7285->7286 7286->7192 7288 6472cc 7287->7288 7289 6472d1 LeaveCriticalSection 7288->7289 7300 647340 7288->7300 7289->7234 7305 64759d 7292->7305 7295 64726e EnterCriticalSection LeaveCriticalSection 7296 64730a 7295->7296 7297 647315 RtlWakeAllConditionVariable 7296->7297 7298 647326 SetEvent ResetEvent 7296->7298 7297->7242 7298->7242 7301 647367 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 7300->7301 7302 64734e SleepConditionVariableCS 7300->7302 7303 64738b 7301->7303 7302->7303 7303->7288 7306 6475b3 7305->7306 7307 6475ac 7305->7307 7314 64b7ad 7306->7314 7311 64b741 7307->7311 7310 646468 7310->7295 7312 64b7ad 28 API calls 7311->7312 7313 64b753 7312->7313 7313->7310 7317 64b4e3 7314->7317 7318 64b4ef ___scrt_is_nonwritable_in_current_image 7317->7318 7325 64c4c9 EnterCriticalSection 7318->7325 7320 64b4fd 7326 64b53e 7320->7326 7322 64b50a 7336 64b532 7322->7336 7325->7320 7327 64b55a 7326->7327 7329 64b5d1 __dosmaperr 7326->7329 7328 64b5b1 7327->7328 7327->7329 7339 64aaaf 7327->7339 7328->7329 7331 64aaaf 28 API calls 7328->7331 7329->7322 7333 64b5c7 7331->7333 7332 64b5a7 7334 64c3b2 _free 14 API calls 7332->7334 7335 64c3b2 _free 14 API calls 7333->7335 7334->7328 7335->7329 7367 64c511 LeaveCriticalSection 7336->7367 7338 64b51b 7338->7310 7340 64aad7 7339->7340 7341 64aabc 7339->7341 7343 64aae6 7340->7343 7348 64c3ec 7340->7348 7341->7340 7342 64aac8 7341->7342 7345 64aa81 _free 14 API calls 7342->7345 7355 64c41f 7343->7355 7347 64aacd ___scrt_fastfail 7345->7347 7347->7332 7349 64c3f7 7348->7349 7350 64c40c HeapSize 7348->7350 7351 64aa81 _free 14 API calls 7349->7351 7350->7343 7352 64c3fc 7351->7352 7353 64a9c4 __fassign 25 API calls 7352->7353 7354 64c407 7353->7354 7354->7343 7356 64c437 7355->7356 7357 64c42c 7355->7357 7358 64c43f 7356->7358 7365 64c448 __dosmaperr 7356->7365 7359 64e8b4 15 API calls 7357->7359 7360 64c3b2 _free 14 API calls 7358->7360 7363 64c434 7359->7363 7360->7363 7361 64c472 HeapReAlloc 7361->7363 7361->7365 7362 64c44d 7364 64aa81 _free 14 API calls 7362->7364 7363->7347 7364->7363 7365->7361 7365->7362 7366 64db39 __dosmaperr EnterCriticalSection LeaveCriticalSection 7365->7366 7366->7365 7367->7338 7369 646bd9 7368->7369 7371 646e60 7370->7371 7374 646e83 ___scrt_uninitialize_crt 7370->7374 7372 646e69 ___scrt_fastfail 7371->7372 7373 64aa81 _free 14 API calls 7371->7373 7372->7374 7375 64aa81 14 API calls _free 7372->7375 7373->7372 7374->7252 7375->7372 7377 647153 LeaveCriticalSection 7376->7377 7378 64714a 7376->7378 7377->7266 7378->7377 7391 64710c 7378->7391 7382 6462ff LockResource 7381->7382 7384 64631f 7381->7384 7383 64630c SizeofResource 7382->7383 7382->7384 7383->7384 7384->7266 7386 646ee3 7385->7386 7390 646f12 7385->7390 7387 6462e9 3 API calls 7386->7387 7388 646ef0 7387->7388 7388->7390 7403 64a704 7388->7403 7390->7262 7392 647116 7391->7392 7393 64711b 7392->7393 7401 646250 RaiseException 7392->7401 7393->7377 7397 647153 LeaveCriticalSection 7397->7377 7398 64714a 7398->7397 7400 64710c RaiseException 7398->7400 7400->7397 7402 646264 EnterCriticalSection 7401->7402 7402->7397 7402->7398 7404 64a715 7403->7404 7413 64a711 ___scrt_uninitialize_crt 7403->7413 7405 64a71c 7404->7405 7408 64a72f _wmemset 7404->7408 7406 64aa81 _free 14 API calls 7405->7406 7407 64a721 7406->7407 7409 64a9c4 __fassign 25 API calls 7407->7409 7410 64a760 7408->7410 7411 64a769 7408->7411 7408->7413 7409->7413 7412 64aa81 _free 14 API calls 7410->7412 7411->7413 7415 64aa81 _free 14 API calls 7411->7415 7414 64a765 7412->7414 7413->7390 7416 64a9c4 __fassign 25 API calls 7414->7416 7415->7414 7416->7413 7418 64a7cf 7417->7418 7419 64a7c1 7417->7419 7420 64aa81 _free 14 API calls 7418->7420 7419->7418 7422 64a7e8 7419->7422 7421 64a7d9 7420->7421 7423 64a9c4 __fassign 25 API calls 7421->7423 7424 6468c0 PathAppendW 7422->7424 7425 64aa81 _free 14 API calls 7422->7425 7423->7424 7424->7200 7424->7206 7425->7421 7427 646622 7426->7427 7428 6465fc 7426->7428 7430 647198 _ValidateLocalCookies 5 API calls 7427->7430 7428->7427 7429 646603 GetFileAttributesExW 7428->7429 7429->7427 7431 64662f 7430->7431 7431->7211 7431->7212 7433 6467d5 7432->7433 7435 6467c9 7432->7435 7434 6467ed SHQueryValueExW 7433->7434 7434->7435 7435->7219 7437 64c177 7436->7437 7438 64c17d 7436->7438 7474 64d6c5 7437->7474 7460 64c183 SetLastError 7438->7460 7479 64d704 7438->7479 7442 64c559 __dosmaperr 14 API calls 7444 64c1ab 7442->7444 7447 64c1b3 7444->7447 7448 64c1ca 7444->7448 7445 64c217 7449 64bc95 __fassign 64 API calls 7445->7449 7446 64bc0b 7463 64bc95 7446->7463 7451 64d704 __dosmaperr 6 API calls 7447->7451 7450 64d704 __dosmaperr 6 API calls 7448->7450 7453 64c21c 7449->7453 7454 64c1d6 7450->7454 7452 64c1c1 7451->7452 7457 64c3b2 _free 14 API calls 7452->7457 7455 64c1da 7454->7455 7456 64c1eb 7454->7456 7458 64d704 __dosmaperr 6 API calls 7455->7458 7484 64bf8e 7456->7484 7457->7460 7458->7452 7460->7445 7460->7446 7462 64c3b2 _free 14 API calls 7462->7460 7631 64dc90 7463->7631 7466 64bca5 7468 64bcce 7466->7468 7469 64bcaf IsProcessorFeaturePresent 7466->7469 7470 64aef3 __fassign 23 API calls 7468->7470 7471 64bcbb 7469->7471 7473 64bcd8 7470->7473 7472 64a818 __fassign 8 API calls 7471->7472 7472->7468 7475 64d584 __dosmaperr 5 API calls 7474->7475 7476 64d6e1 7475->7476 7477 64d6fc TlsGetValue 7476->7477 7478 64d6ea 7476->7478 7478->7438 7480 64d584 __dosmaperr 5 API calls 7479->7480 7481 64d720 7480->7481 7482 64d73e TlsSetValue 7481->7482 7483 64c19b 7481->7483 7483->7442 7483->7460 7489 64be22 7484->7489 7490 64be2e ___scrt_is_nonwritable_in_current_image 7489->7490 7503 64c4c9 EnterCriticalSection 7490->7503 7492 64be38 7504 64be68 7492->7504 7495 64bf34 7496 64bf40 ___scrt_is_nonwritable_in_current_image 7495->7496 7508 64c4c9 EnterCriticalSection 7496->7508 7498 64bf4a 7509 64c115 7498->7509 7500 64bf62 7513 64bf82 7500->7513 7503->7492 7507 64c511 LeaveCriticalSection 7504->7507 7506 64be56 7506->7495 7507->7506 7508->7498 7510 64c14b __dosmaperr 7509->7510 7511 64c124 __dosmaperr 7509->7511 7510->7500 7511->7510 7516 64eaf0 7511->7516 7630 64c511 LeaveCriticalSection 7513->7630 7515 64bf70 7515->7462 7517 64eb70 7516->7517 7520 64eb06 7516->7520 7519 64c3b2 _free 14 API calls 7517->7519 7542 64ebbe 7517->7542 7521 64eb92 7519->7521 7520->7517 7524 64c3b2 _free 14 API calls 7520->7524 7526 64eb39 7520->7526 7522 64c3b2 _free 14 API calls 7521->7522 7525 64eba5 7522->7525 7523 64ebcc 7532 64ec2c 7523->7532 7541 64c3b2 14 API calls _free 7523->7541 7528 64eb2e 7524->7528 7529 64c3b2 _free 14 API calls 7525->7529 7530 64c3b2 _free 14 API calls 7526->7530 7543 64eb5b 7526->7543 7527 64c3b2 _free 14 API calls 7531 64eb65 7527->7531 7544 64e60d 7528->7544 7535 64ebb3 7529->7535 7536 64eb50 7530->7536 7537 64c3b2 _free 14 API calls 7531->7537 7533 64c3b2 _free 14 API calls 7532->7533 7538 64ec32 7533->7538 7539 64c3b2 _free 14 API calls 7535->7539 7572 64e70b 7536->7572 7537->7517 7538->7510 7539->7542 7541->7523 7584 64ec61 7542->7584 7543->7527 7545 64e61e 7544->7545 7546 64e707 7544->7546 7547 64e62f 7545->7547 7548 64c3b2 _free 14 API calls 7545->7548 7546->7526 7549 64e641 7547->7549 7550 64c3b2 _free 14 API calls 7547->7550 7548->7547 7551 64e653 7549->7551 7552 64c3b2 _free 14 API calls 7549->7552 7550->7549 7553 64e665 7551->7553 7555 64c3b2 _free 14 API calls 7551->7555 7552->7551 7554 64e677 7553->7554 7556 64c3b2 _free 14 API calls 7553->7556 7557 64e689 7554->7557 7558 64c3b2 _free 14 API calls 7554->7558 7555->7553 7556->7554 7559 64e69b 7557->7559 7560 64c3b2 _free 14 API calls 7557->7560 7558->7557 7561 64e6ad 7559->7561 7563 64c3b2 _free 14 API calls 7559->7563 7560->7559 7562 64e6bf 7561->7562 7564 64c3b2 _free 14 API calls 7561->7564 7565 64e6d1 7562->7565 7566 64c3b2 _free 14 API calls 7562->7566 7563->7561 7564->7562 7567 64e6e3 7565->7567 7568 64c3b2 _free 14 API calls 7565->7568 7566->7565 7569 64e6f5 7567->7569 7570 64c3b2 _free 14 API calls 7567->7570 7568->7567 7569->7546 7571 64c3b2 _free 14 API calls 7569->7571 7570->7569 7571->7546 7573 64e718 7572->7573 7583 64e770 7572->7583 7574 64e728 7573->7574 7575 64c3b2 _free 14 API calls 7573->7575 7576 64c3b2 _free 14 API calls 7574->7576 7577 64e73a 7574->7577 7575->7574 7576->7577 7578 64e74c 7577->7578 7579 64c3b2 _free 14 API calls 7577->7579 7580 64e75e 7578->7580 7581 64c3b2 _free 14 API calls 7578->7581 7579->7578 7582 64c3b2 _free 14 API calls 7580->7582 7580->7583 7581->7580 7582->7583 7583->7543 7585 64ec6e 7584->7585 7586 64ec8d 7584->7586 7585->7586 7590 64e7ac 7585->7590 7586->7523 7589 64c3b2 _free 14 API calls 7589->7586 7591 64e88a 7590->7591 7592 64e7bd 7590->7592 7591->7589 7626 64e774 7592->7626 7595 64e774 __dosmaperr 14 API calls 7596 64e7d0 7595->7596 7597 64e774 __dosmaperr 14 API calls 7596->7597 7598 64e7db 7597->7598 7599 64e774 __dosmaperr 14 API calls 7598->7599 7600 64e7e6 7599->7600 7601 64e774 __dosmaperr 14 API calls 7600->7601 7602 64e7f4 7601->7602 7603 64c3b2 _free 14 API calls 7602->7603 7604 64e7ff 7603->7604 7605 64c3b2 _free 14 API calls 7604->7605 7606 64e80a 7605->7606 7607 64c3b2 _free 14 API calls 7606->7607 7608 64e815 7607->7608 7609 64e774 __dosmaperr 14 API calls 7608->7609 7610 64e823 7609->7610 7611 64e774 __dosmaperr 14 API calls 7610->7611 7612 64e831 7611->7612 7613 64e774 __dosmaperr 14 API calls 7612->7613 7614 64e842 7613->7614 7615 64e774 __dosmaperr 14 API calls 7614->7615 7616 64e850 7615->7616 7617 64e774 __dosmaperr 14 API calls 7616->7617 7618 64e85e 7617->7618 7619 64c3b2 _free 14 API calls 7618->7619 7620 64e869 7619->7620 7621 64c3b2 _free 14 API calls 7620->7621 7622 64e874 7621->7622 7623 64c3b2 _free 14 API calls 7622->7623 7624 64e87f 7623->7624 7625 64c3b2 _free 14 API calls 7624->7625 7625->7591 7627 64e7a7 7626->7627 7628 64e797 7626->7628 7627->7595 7628->7627 7629 64c3b2 _free 14 API calls 7628->7629 7629->7628 7630->7515 7667 64dbc2 7631->7667 7634 64dcde 7635 64dcea ___scrt_is_nonwritable_in_current_image 7634->7635 7636 64dd11 __fassign 7635->7636 7637 64c2b7 __dosmaperr 14 API calls 7635->7637 7638 64dd17 __fassign 7635->7638 7636->7638 7639 64dd5c 7636->7639 7652 64dd46 7636->7652 7637->7636 7644 64dd88 7638->7644 7678 64c4c9 EnterCriticalSection 7638->7678 7640 64aa81 _free 14 API calls 7639->7640 7641 64dd61 7640->7641 7642 64a9c4 __fassign 25 API calls 7641->7642 7642->7652 7646 64dec5 7644->7646 7647 64ddd0 7644->7647 7657 64ddfb 7644->7657 7648 64ded0 7646->7648 7686 64c511 LeaveCriticalSection 7646->7686 7647->7657 7679 64dcd5 7647->7679 7651 64aef3 __fassign 23 API calls 7648->7651 7658 64ded8 ___scrt_is_nonwritable_in_current_image 7651->7658 7652->7466 7654 64c160 __fassign 66 API calls 7660 64de4f 7654->7660 7656 64dcd5 __fassign 66 API calls 7656->7657 7682 64de71 7657->7682 7687 64e280 EnterCriticalSection 7658->7687 7660->7652 7661 64c160 __fassign 66 API calls 7660->7661 7661->7652 7662 64deef ___scrt_uninitialize_crt 7663 64df28 7662->7663 7688 64e11b 7662->7688 7698 64df59 7663->7698 7668 64dbce ___scrt_is_nonwritable_in_current_image 7667->7668 7673 64c4c9 EnterCriticalSection 7668->7673 7670 64dbdc 7674 64dc1a 7670->7674 7673->7670 7677 64c511 LeaveCriticalSection 7674->7677 7676 64bc9a 7676->7466 7676->7634 7677->7676 7678->7644 7680 64c160 __fassign 66 API calls 7679->7680 7681 64dcda 7680->7681 7681->7656 7683 64de77 7682->7683 7685 64de40 7682->7685 7701 64c511 LeaveCriticalSection 7683->7701 7685->7652 7685->7654 7685->7660 7686->7648 7687->7662 7689 64e131 7688->7689 7690 64e128 7688->7690 7705 64e0b6 7689->7705 7702 64e011 7690->7702 7693 64e12e 7693->7663 7696 64e14d 7718 64fc60 7696->7718 7971 64e294 LeaveCriticalSection 7698->7971 7700 64df47 7700->7466 7701->7685 7729 64df65 7702->7729 7706 64e0f3 7705->7706 7707 64e0ce 7705->7707 7706->7693 7711 64f409 7706->7711 7707->7706 7708 64f409 ___scrt_uninitialize_crt 25 API calls 7707->7708 7709 64e0ec 7708->7709 7751 650456 7709->7751 7712 64f415 7711->7712 7713 64f42a 7711->7713 7714 64aa81 _free 14 API calls 7712->7714 7713->7696 7715 64f41a 7714->7715 7716 64a9c4 __fassign 25 API calls 7715->7716 7717 64f425 7716->7717 7717->7696 7719 64fc71 7718->7719 7720 64fc7e 7718->7720 7721 64aa81 _free 14 API calls 7719->7721 7722 64fcc7 7720->7722 7724 64fca5 7720->7724 7728 64fc76 7721->7728 7723 64aa81 _free 14 API calls 7722->7723 7725 64fccc 7723->7725 7952 64fbbe 7724->7952 7727 64a9c4 __fassign 25 API calls 7725->7727 7727->7728 7728->7693 7730 64df71 ___scrt_is_nonwritable_in_current_image 7729->7730 7737 64c4c9 EnterCriticalSection 7730->7737 7732 64dfe7 7746 64e005 7732->7746 7736 64df7b ___scrt_uninitialize_crt 7736->7732 7738 64ded9 7736->7738 7737->7736 7739 64dee5 ___scrt_is_nonwritable_in_current_image 7738->7739 7749 64e280 EnterCriticalSection 7739->7749 7741 64deef ___scrt_uninitialize_crt 7742 64df28 7741->7742 7744 64e11b ___scrt_uninitialize_crt 66 API calls 7741->7744 7743 64df59 ___scrt_uninitialize_crt LeaveCriticalSection 7742->7743 7745 64df47 7743->7745 7744->7742 7745->7736 7750 64c511 LeaveCriticalSection 7746->7750 7748 64dff3 7748->7693 7749->7741 7750->7748 7752 650462 ___scrt_is_nonwritable_in_current_image 7751->7752 7753 650482 7752->7753 7754 65046a 7752->7754 7756 65051d 7753->7756 7761 6504b4 7753->7761 7776 64aa6e 7754->7776 7758 64aa6e __dosmaperr 14 API calls 7756->7758 7760 650522 7758->7760 7759 64aa81 _free 14 API calls 7762 650477 7759->7762 7763 64aa81 _free 14 API calls 7760->7763 7779 64e4cc EnterCriticalSection 7761->7779 7762->7706 7765 65052a 7763->7765 7767 64a9c4 __fassign 25 API calls 7765->7767 7766 6504ba 7768 6504d6 7766->7768 7769 6504eb 7766->7769 7767->7762 7770 64aa81 _free 14 API calls 7768->7770 7780 650548 7769->7780 7772 6504db 7770->7772 7773 64aa6e __dosmaperr 14 API calls 7772->7773 7774 6504e6 7773->7774 7822 650515 7774->7822 7777 64c2b7 __dosmaperr 14 API calls 7776->7777 7778 64aa73 7777->7778 7778->7759 7779->7766 7781 65056a 7780->7781 7819 650586 7780->7819 7782 65056e 7781->7782 7784 6505be 7781->7784 7783 64aa6e __dosmaperr 14 API calls 7782->7783 7785 650573 7783->7785 7786 6505d1 7784->7786 7825 650c36 7784->7825 7787 64aa81 _free 14 API calls 7785->7787 7828 6500ef 7786->7828 7790 65057b 7787->7790 7792 64a9c4 __fassign 25 API calls 7790->7792 7792->7819 7793 6505e7 7797 650610 7793->7797 7798 6505eb 7793->7798 7794 650626 7795 65067f WriteFile 7794->7795 7796 65063a 7794->7796 7801 6506a3 GetLastError 7795->7801 7803 650606 7795->7803 7799 650645 7796->7799 7800 65066f 7796->7800 7840 64fcdd GetConsoleCP 7797->7840 7798->7803 7835 650087 7798->7835 7804 65065f 7799->7804 7805 65064a 7799->7805 7868 650160 7800->7868 7801->7803 7809 6506f3 7803->7809 7810 6506c9 7803->7810 7803->7819 7860 650324 7804->7860 7805->7803 7853 65023b 7805->7853 7814 64aa81 _free 14 API calls 7809->7814 7809->7819 7812 6506e7 7810->7812 7813 6506d0 7810->7813 7875 64aa4b 7812->7875 7815 64aa81 _free 14 API calls 7813->7815 7817 65070b 7814->7817 7818 6506d5 7815->7818 7820 64aa6e __dosmaperr 14 API calls 7817->7820 7821 64aa6e __dosmaperr 14 API calls 7818->7821 7819->7774 7820->7819 7821->7819 7951 64e4ef LeaveCriticalSection 7822->7951 7824 65051b 7824->7762 7880 650bba 7825->7880 7902 650815 7828->7902 7830 650100 7831 650156 7830->7831 7832 64c160 __fassign 65 API calls 7830->7832 7831->7793 7831->7794 7833 650123 7832->7833 7833->7831 7834 65013d GetConsoleMode 7833->7834 7834->7831 7836 6500de 7835->7836 7839 6500a9 7835->7839 7836->7803 7837 650c51 5 API calls ___scrt_uninitialize_crt 7837->7839 7838 6500e0 GetLastError 7838->7836 7839->7836 7839->7837 7839->7838 7911 64bce4 7840->7911 7842 647198 _ValidateLocalCookies 5 API calls 7843 650085 7842->7843 7843->7803 7845 64f395 62 API calls __fassign 7849 64fd39 ___scrt_uninitialize_crt 7845->7849 7846 64ffd9 7846->7842 7849->7845 7849->7846 7850 64ff5c WriteFile 7849->7850 7852 64ff94 WriteFile 7849->7852 7919 650a84 7849->7919 7929 64e890 7849->7929 7934 64d355 7849->7934 7850->7849 7851 650055 GetLastError 7850->7851 7851->7846 7852->7849 7852->7851 7857 65024a ___scrt_uninitialize_crt 7853->7857 7854 650309 7855 647198 _ValidateLocalCookies 5 API calls 7854->7855 7859 650322 7855->7859 7856 6502bf WriteFile 7856->7857 7858 65030b GetLastError 7856->7858 7857->7854 7857->7856 7858->7854 7859->7803 7867 650333 ___scrt_uninitialize_crt 7860->7867 7861 65043b 7862 647198 _ValidateLocalCookies 5 API calls 7861->7862 7863 650454 7862->7863 7863->7803 7864 64d355 ___scrt_uninitialize_crt WideCharToMultiByte 7864->7867 7865 65043d GetLastError 7865->7861 7866 6503f2 WriteFile 7866->7865 7866->7867 7867->7861 7867->7864 7867->7865 7867->7866 7869 65016f ___scrt_uninitialize_crt 7868->7869 7872 6501df WriteFile 7869->7872 7874 650220 7869->7874 7870 647198 _ValidateLocalCookies 5 API calls 7871 650239 7870->7871 7871->7803 7872->7869 7873 650222 GetLastError 7872->7873 7873->7874 7874->7870 7876 64aa6e __dosmaperr 14 API calls 7875->7876 7877 64aa56 _free 7876->7877 7878 64aa81 _free 14 API calls 7877->7878 7879 64aa69 7878->7879 7879->7819 7889 64e5a3 7880->7889 7882 650bcc 7883 650be5 SetFilePointerEx 7882->7883 7884 650bd4 7882->7884 7886 650bfd GetLastError 7883->7886 7888 650bd9 7883->7888 7885 64aa81 _free 14 API calls 7884->7885 7885->7888 7887 64aa4b __dosmaperr 14 API calls 7886->7887 7887->7888 7888->7786 7890 64e5c5 7889->7890 7891 64e5b0 7889->7891 7894 64aa6e __dosmaperr 14 API calls 7890->7894 7896 64e5ea 7890->7896 7892 64aa6e __dosmaperr 14 API calls 7891->7892 7893 64e5b5 7892->7893 7895 64aa81 _free 14 API calls 7893->7895 7897 64e5f5 7894->7897 7898 64e5bd 7895->7898 7896->7882 7899 64aa81 _free 14 API calls 7897->7899 7898->7882 7900 64e5fd 7899->7900 7901 64a9c4 __fassign 25 API calls 7900->7901 7901->7898 7903 650822 7902->7903 7904 65082f 7902->7904 7905 64aa81 _free 14 API calls 7903->7905 7907 65083b 7904->7907 7908 64aa81 _free 14 API calls 7904->7908 7906 650827 7905->7906 7906->7830 7907->7830 7909 65085c 7908->7909 7910 64a9c4 __fassign 25 API calls 7909->7910 7910->7906 7912 64bd04 7911->7912 7913 64bcfb 7911->7913 7912->7913 7914 64c160 __fassign 66 API calls 7912->7914 7913->7849 7915 64bd24 7914->7915 7937 64f3af 7915->7937 7924 650b39 ___scrt_uninitialize_crt 7919->7924 7928 650a9d ___scrt_uninitialize_crt 7919->7928 7920 650b0f 7920->7849 7922 650d7e __fassign 19 API calls 7922->7924 7923 650b24 7927 64aa81 _free 14 API calls 7923->7927 7924->7920 7924->7922 7925 650b69 7924->7925 7926 64aa81 _free 14 API calls 7925->7926 7926->7920 7927->7920 7928->7920 7928->7923 7945 650d7e 7928->7945 7930 64c160 __fassign 66 API calls 7929->7930 7931 64e89b 7930->7931 7932 64f3af __fassign 66 API calls 7931->7932 7933 64e8ab 7932->7933 7933->7849 7936 64d36e WideCharToMultiByte 7934->7936 7936->7849 7938 64bd3a 7937->7938 7939 64f3c2 7937->7939 7941 64f3dc 7938->7941 7939->7938 7940 64ed3c __fassign 66 API calls 7939->7940 7940->7938 7942 64f404 7941->7942 7943 64f3ef 7941->7943 7942->7913 7943->7942 7944 64d039 __fassign 66 API calls 7943->7944 7944->7942 7950 650da5 7945->7950 7946 647198 _ValidateLocalCookies 5 API calls 7948 650f23 7946->7948 7947 650b7f __fassign 14 API calls 7949 650dca 7947->7949 7948->7928 7949->7946 7950->7947 7950->7949 7951->7824 7953 64fbca ___scrt_is_nonwritable_in_current_image 7952->7953 7966 64e4cc EnterCriticalSection 7953->7966 7955 64fbd9 7956 64fc20 7955->7956 7957 64e5a3 ___scrt_uninitialize_crt 25 API calls 7955->7957 7958 64aa81 _free 14 API calls 7956->7958 7959 64fc05 FlushFileBuffers 7957->7959 7960 64fc25 7958->7960 7959->7960 7961 64fc11 7959->7961 7967 64fc54 7960->7967 7962 64aa6e __dosmaperr 14 API calls 7961->7962 7964 64fc16 GetLastError 7962->7964 7964->7956 7966->7955 7970 64e4ef LeaveCriticalSection 7967->7970 7969 64fc3d 7969->7728 7970->7969 7971->7700 7973 64b8f8 7972->7973 7975 64b90a ___scrt_uninitialize_crt 7972->7975 7974 64b906 7973->7974 7977 64e163 7973->7977 7974->6974 7975->6974 7978 64e011 ___scrt_uninitialize_crt 66 API calls 7977->7978 7979 64e16a 7978->7979 7979->7974 8467 64fb33 8470 64cff1 8467->8470 8471 64d02c 8470->8471 8472 64cffa 8470->8472 8476 64c21d 8472->8476 8477 64c228 8476->8477 8481 64c22e 8476->8481 8478 64d6c5 __dosmaperr 6 API calls 8477->8478 8478->8481 8479 64d704 __dosmaperr 6 API calls 8480 64c248 8479->8480 8482 64c234 8480->8482 8483 64c559 __dosmaperr 14 API calls 8480->8483 8481->8479 8481->8482 8484 64bc95 __fassign 66 API calls 8482->8484 8489 64c2ad 8482->8489 8485 64c258 8483->8485 8486 64c2b6 8484->8486 8487 64c275 8485->8487 8488 64c260 8485->8488 8491 64d704 __dosmaperr 6 API calls 8487->8491 8490 64d704 __dosmaperr 6 API calls 8488->8490 8501 64ce37 8489->8501 8492 64c26c 8490->8492 8493 64c281 8491->8493 8497 64c3b2 _free 14 API calls 8492->8497 8494 64c294 8493->8494 8495 64c285 8493->8495 8496 64bf8e __dosmaperr 14 API calls 8494->8496 8498 64d704 __dosmaperr 6 API calls 8495->8498 8499 64c29f 8496->8499 8497->8482 8498->8492 8500 64c3b2 _free 14 API calls 8499->8500 8500->8482 8520 64cf50 8501->8520 8506 64ce63 8506->8471 8507 64e8b4 15 API calls 8508 64ce74 8507->8508 8519 64cea6 8508->8519 8538 64d04c 8508->8538 8511 64c3b2 _free 14 API calls 8513 64ceb4 8511->8513 8512 64cea1 8514 64aa81 _free 14 API calls 8512->8514 8513->8471 8514->8519 8515 64cebc 8516 64cee8 8515->8516 8517 64c3b2 _free 14 API calls 8515->8517 8516->8519 8549 64cad2 8516->8549 8517->8516 8519->8511 8521 64cf5c ___scrt_is_nonwritable_in_current_image 8520->8521 8522 64cf76 8521->8522 8557 64c4c9 EnterCriticalSection 8521->8557 8524 64ce4a 8522->8524 8527 64bc95 __fassign 66 API calls 8522->8527 8531 64cbe0 8524->8531 8525 64cfb2 8558 64cfcf 8525->8558 8529 64cfef 8527->8529 8528 64cf86 8528->8525 8530 64c3b2 _free 14 API calls 8528->8530 8530->8525 8532 64bce4 __fassign 66 API calls 8531->8532 8533 64cbf2 8532->8533 8534 64cc01 GetOEMCP 8533->8534 8535 64cc13 8533->8535 8537 64cc2a 8534->8537 8536 64cc18 GetACP 8535->8536 8535->8537 8536->8537 8537->8506 8537->8507 8539 64cbe0 68 API calls 8538->8539 8540 64d06c 8539->8540 8542 64d0a6 IsValidCodePage 8540->8542 8547 64d0e2 ___scrt_fastfail 8540->8547 8541 647198 _ValidateLocalCookies 5 API calls 8543 64ce99 8541->8543 8544 64d0b8 8542->8544 8542->8547 8543->8512 8543->8515 8545 64d0e7 GetCPInfo 8544->8545 8546 64d0c1 ___scrt_fastfail 8544->8546 8545->8546 8545->8547 8562 64ccb6 8546->8562 8547->8541 8550 64cade ___scrt_is_nonwritable_in_current_image 8549->8550 8643 64c4c9 EnterCriticalSection 8550->8643 8552 64cae8 8644 64cb1f 8552->8644 8557->8528 8561 64c511 LeaveCriticalSection 8558->8561 8560 64cfd6 8560->8522 8561->8560 8563 64ccde GetCPInfo 8562->8563 8564 64cda7 8562->8564 8563->8564 8566 64ccf6 8563->8566 8565 647198 _ValidateLocalCookies 5 API calls 8564->8565 8567 64ce35 8565->8567 8573 64e950 8566->8573 8567->8547 8572 64faea 68 API calls 8572->8564 8574 64bce4 __fassign 66 API calls 8573->8574 8575 64e970 8574->8575 8593 64d2d9 8575->8593 8577 64ea2e 8578 647198 _ValidateLocalCookies 5 API calls 8577->8578 8580 64cd5e 8578->8580 8579 64e99d 8579->8577 8582 64e8b4 15 API calls 8579->8582 8584 64e9c3 ___scrt_fastfail 8579->8584 8588 64faea 8580->8588 8581 64ea28 8596 64ea53 8581->8596 8582->8584 8584->8581 8585 64d2d9 __fassign MultiByteToWideChar 8584->8585 8586 64ea11 8585->8586 8586->8581 8587 64ea18 GetStringTypeW 8586->8587 8587->8581 8589 64bce4 __fassign 66 API calls 8588->8589 8590 64fafd 8589->8590 8600 64f900 8590->8600 8594 64d2ea MultiByteToWideChar 8593->8594 8594->8579 8597 64ea70 8596->8597 8598 64ea5f 8596->8598 8597->8577 8598->8597 8599 64c3b2 _free 14 API calls 8598->8599 8599->8597 8601 64f91b 8600->8601 8602 64d2d9 __fassign MultiByteToWideChar 8601->8602 8605 64f95f 8602->8605 8603 64fac4 8604 647198 _ValidateLocalCookies 5 API calls 8603->8604 8606 64cd7f 8604->8606 8605->8603 8607 64e8b4 15 API calls 8605->8607 8611 64f984 8605->8611 8606->8572 8607->8611 8608 64fa29 8610 64ea53 __freea 14 API calls 8608->8610 8609 64d2d9 __fassign MultiByteToWideChar 8612 64f9ca 8609->8612 8610->8603 8611->8608 8611->8609 8612->8608 8628 64d791 8612->8628 8615 64fa00 8615->8608 8618 64d791 6 API calls 8615->8618 8616 64fa38 8617 64e8b4 15 API calls 8616->8617 8621 64fa4a 8616->8621 8617->8621 8618->8608 8619 64fab5 8620 64ea53 __freea 14 API calls 8619->8620 8620->8608 8621->8619 8622 64d791 6 API calls 8621->8622 8623 64fa92 8622->8623 8623->8619 8624 64d355 ___scrt_uninitialize_crt WideCharToMultiByte 8623->8624 8625 64faac 8624->8625 8625->8619 8626 64fae1 8625->8626 8627 64ea53 __freea 14 API calls 8626->8627 8627->8608 8634 64d489 8628->8634 8632 64d7e2 LCMapStringW 8633 64d7a2 8632->8633 8633->8608 8633->8615 8633->8616 8635 64d584 __dosmaperr 5 API calls 8634->8635 8636 64d49f 8635->8636 8636->8633 8637 64d7ee 8636->8637 8640 64d4a3 8637->8640 8639 64d7f9 8639->8632 8641 64d584 __dosmaperr 5 API calls 8640->8641 8642 64d4b9 8641->8642 8642->8639 8643->8552 8654 64d23f 8644->8654 8646 64cb41 8647 64d23f 25 API calls 8646->8647 8649 64cb60 8647->8649 8648 64caf5 8651 64cb13 8648->8651 8649->8648 8650 64c3b2 _free 14 API calls 8649->8650 8650->8648 8668 64c511 LeaveCriticalSection 8651->8668 8653 64cb01 8653->8519 8655 64d250 8654->8655 8661 64d24c ___scrt_uninitialize_crt 8654->8661 8656 64d257 8655->8656 8660 64d26a ___scrt_fastfail 8655->8660 8657 64aa81 _free 14 API calls 8656->8657 8658 64d25c 8657->8658 8659 64a9c4 __fassign 25 API calls 8658->8659 8659->8661 8660->8661 8662 64d2a1 8660->8662 8663 64d298 8660->8663 8661->8646 8662->8661 8665 64aa81 _free 14 API calls 8662->8665 8664 64aa81 _free 14 API calls 8663->8664 8666 64d29d 8664->8666 8665->8666 8667 64a9c4 __fassign 25 API calls 8666->8667 8667->8661 8668->8653 8669 64b83d 8670 649a79 ___scrt_uninitialize_crt 7 API calls 8669->8670 8671 64b844 8670->8671 8672 646105 8674 64610b 8672->8674 8673 646272 8677 646250 RaiseException 8673->8677 8674->8673 8675 646264 8674->8675 8676 646215 8674->8676 8682 647080 8676->8682 8677->8675 8680 6475ca 28 API calls 8681 646240 8680->8681 8683 647088 8682->8683 8689 6462c1 InitializeCriticalSectionAndSpinCount 8683->8689 8686 6470b3 IsDebuggerPresent 8687 646236 8686->8687 8688 6470bd OutputDebugStringW 8686->8688 8687->8680 8688->8687 8690 6462dc 8689->8690 8691 6462d0 GetLastError 8689->8691 8690->8686 8690->8687 8691->8690 8692 64b807 8695 64b44c 8692->8695 8696 64b45b 8695->8696 8697 64b3be 14 API calls 8696->8697 8698 64b475 8697->8698 8699 64b3be 14 API calls 8698->8699 8700 64b480 8699->8700 8920 64d880 GetProcessHeap 8701 64ca02 8702 64ca04 FindClose 8701->8702 8703 64ca0b 8702->8703 8704 647198 _ValidateLocalCookies 5 API calls 8703->8704 8705 64ca1a 8704->8705 8921 649c8e 8924 649cdc 8921->8924 8925 649c99 8924->8925 8926 649ce5 8924->8926 8926->8925 8927 649d62 76 API calls 8926->8927 8928 649d20 8927->8928 8929 649d62 76 API calls 8928->8929 8930 649d2b 8929->8930 8931 64bbfa 66 API calls 8930->8931 8932 649d33 8931->8932 8933 64c488 8934 64c493 8933->8934 8935 64d746 6 API calls 8934->8935 8936 64c4bc 8934->8936 8937 64c4b8 8934->8937 8935->8934 8939 64c4e0 8936->8939 8940 64c4ed 8939->8940 8942 64c50c 8939->8942 8941 64c4f7 DeleteCriticalSection 8940->8941 8941->8941 8941->8942 8942->8937 8943 650f88 8944 650f8f 8943->8944 8945 65102e 8944->8945 8946 650faf 8944->8946 8948 651d17 20 API calls 8945->8948 8947 651c40 8946->8947 8950 651d17 20 API calls 8946->8950 8949 65103e 8948->8949 8951 651c3e 8950->8951 8706 64b416 8707 64b42e 8706->8707 8708 64b428 8706->8708 8709 64b3be 14 API calls 8708->8709 8709->8707 8952 645e91 8953 645e98 8952->8953 8954 646272 8953->8954 8955 646215 8953->8955 8959 646264 8953->8959 8956 646250 RaiseException 8954->8956 8957 647080 4 API calls 8955->8957 8956->8959 8958 646236 8957->8958 8960 6475ca 28 API calls 8958->8960 8961 646240 8960->8961 8962 64d892 GetStartupInfoW 8963 64d94c 8962->8963 8964 64d8b8 8962->8964 8964->8963 8965 64e42e 26 API calls 8964->8965 8966 64d8e0 8965->8966 8966->8963 8967 64d910 GetFileType 8966->8967 8967->8966 8968 646392 8969 6463a5 8968->8969 8971 64639c 8968->8971 8970 6463b5 HeapReAlloc 8969->8970 8969->8971 8970->8971

                                                                                        Executed Functions

                                                                                        Function 006469C8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 006469D6
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 006469DD
                                                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00646A1C
                                                                                        • GetProcAddress.KERNEL32(00000000,DllEntry), ref: 00646A37
                                                                                        • GetCommandLineW.KERNEL32(?), ref: 00646A46
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00646A59
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryProc$CommandFreeHandleLineLoadModule
                                                                                        • String ID: DllEntry$SetDefaultDllDirectories$kernel32.dll
                                                                                        • API String ID: 1042781669-3472957018
                                                                                        • Opcode ID: 86c33e1b55ecc8f495fdf6f76994d3bb9f653ae673eefde211ba5e1a57ac668d
                                                                                        • Instruction ID: 2e7b16a3f9608fc22c536f1a5e27fae3e617a0276e7ecac82d9bab690eaabfd7
                                                                                        • Opcode Fuzzy Hash: 86c33e1b55ecc8f495fdf6f76994d3bb9f653ae673eefde211ba5e1a57ac668d
                                                                                        • Instruction Fuzzy Hash: 79112B32940716BBC710E7A0DD5AA6E77ABDF02762F015018F902F72A1DE708D44D7A2
                                                                                        Function 0064AE31 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(?,?,0064AE30,?,?,?,?,?,006505E2), ref: 0064AE53
                                                                                        • TerminateProcess.KERNEL32(00000000,?,0064AE30,?,?,?,?,?,006505E2), ref: 0064AE5A
                                                                                        • ExitProcess.KERNEL32 ref: 0064AE6C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                        • String ID:
                                                                                        • API String ID: 1703294689-0
                                                                                        • Opcode ID: b705c088d8955b80d6b1bb912526d01a39722e53b082e93eb3d70eacf3e61030
                                                                                        • Instruction ID: e47c5fdec36769c3b9f7bfdcc28e6fd3b4d4767feaa2ebd9ecdab4f3b62a9438
                                                                                        • Opcode Fuzzy Hash: b705c088d8955b80d6b1bb912526d01a39722e53b082e93eb3d70eacf3e61030
                                                                                        • Instruction Fuzzy Hash: 33E08C31040208BFCF51AF94CE08A8E3B6BFB00352F809418F91587231CB36ED41DB86
                                                                                        Function 0064C559 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 29 64c559-64c564 30 64c566-64c570 29->30 31 64c572-64c578 29->31 30->31 32 64c5a6-64c5b1 call 64aa81 30->32 33 64c591-64c5a2 RtlAllocateHeap 31->33 34 64c57a-64c57b 31->34 39 64c5b3-64c5b5 32->39 35 64c5a4 33->35 36 64c57d-64c584 call 64bbbe 33->36 34->33 35->39 36->32 42 64c586-64c58f call 64db39 36->42 42->32 42->33
                                                                                        APIs
                                                                                        • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0064C302,00000001,00000364,00000006,000000FF,?,0064AAF8,HTe,00000004,00000004,?,00000000), ref: 0064C59A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocateHeap
                                                                                        • String ID: HTe
                                                                                        • API String ID: 1279760036-1657211117
                                                                                        • Opcode ID: b7736be6a80a14f5ecad786d18002007b941657d54a31ea3b3bd27a0e68fc44d
                                                                                        • Instruction ID: 435e11638d52074a3cd053adbdfb0ba5005520512469264f181aed305183b50d
                                                                                        • Opcode Fuzzy Hash: b7736be6a80a14f5ecad786d18002007b941657d54a31ea3b3bd27a0e68fc44d
                                                                                        • Instruction Fuzzy Hash: B5F0B431903630ABDBB96F26DC05B9F3B4BAF817B0F158055A805A6390CE21FD2186E5
                                                                                        Function 00646631 Relevance: 3.1, APIs: 2, Instructions: 122COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104), ref: 00646663
                                                                                        • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00000000,00000104,?,?,00000000), ref: 00646726
                                                                                          • Part of subcall function 00646D27: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,00000000,?,?,006466BC,-00000010), ref: 00646D58
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileFindFolderModuleNamePathResource
                                                                                        • String ID:
                                                                                        • API String ID: 2248019921-0
                                                                                        • Opcode ID: 6d3593f4aaf62d271b073f11b61ce5f1facd8822c0cfc7f4b8277812a45d3a69
                                                                                        • Instruction ID: 0259869ffaf766c0e88bc46dbdaa70d2141ece67571d394304990f244ca73544
                                                                                        • Opcode Fuzzy Hash: 6d3593f4aaf62d271b073f11b61ce5f1facd8822c0cfc7f4b8277812a45d3a69
                                                                                        • Instruction Fuzzy Hash: 1F416071D01219ABCB54EFA4C9959FEB77AEF42314F10416DB812A7291EF309E04CB96
                                                                                        Function 0064E37E Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 104 64e37e-64e38b call 64c559 106 64e390-64e39b 104->106 107 64e3a1-64e3a9 106->107 108 64e39d-64e39f 106->108 109 64e3ec-64e3f8 call 64c3b2 107->109 110 64e3ab-64e3af 107->110 108->109 111 64e3b1-64e3e6 call 64d746 110->111 116 64e3e8-64e3eb 111->116 116->109
                                                                                        APIs
                                                                                          • Part of subcall function 0064C559: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0064C302,00000001,00000364,00000006,000000FF,?,0064AAF8,HTe,00000004,00000004,?,00000000), ref: 0064C59A
                                                                                        • _free.LIBCMT ref: 0064E3ED
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocateHeap_free
                                                                                        • String ID:
                                                                                        • API String ID: 614378929-0
                                                                                        • Opcode ID: ef46dcbaafc2560212290a843e2d4cea6cb58e9c831d9ccec6c4311c4cc2110a
                                                                                        • Instruction ID: d8bb9e96011fc9b49fba8add7e8ce5f1dd595b8bcddd55be07214c4dbe2aff7e
                                                                                        • Opcode Fuzzy Hash: ef46dcbaafc2560212290a843e2d4cea6cb58e9c831d9ccec6c4311c4cc2110a
                                                                                        • Instruction Fuzzy Hash: 690104726003566BC3228F59D88199EFB99FB04370F10026DE445A76C0E370AC108BA4

                                                                                        Non-executed Functions

                                                                                        Function 0064EAF0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 264 64eaf0-64eb04 265 64eb06-64eb0b 264->265 266 64eb72-64eb7a 264->266 265->266 269 64eb0d-64eb12 265->269 267 64ebc1-64ebd9 call 64ec61 266->267 268 64eb7c-64eb7f 266->268 277 64ebdc-64ebe3 267->277 268->267 270 64eb81-64ebbe call 64c3b2 * 4 268->270 269->266 272 64eb14-64eb17 269->272 270->267 272->266 275 64eb19-64eb21 272->275 278 64eb23-64eb26 275->278 279 64eb3b-64eb43 275->279 283 64ebe5-64ebe9 277->283 284 64ec02-64ec06 277->284 278->279 285 64eb28-64eb3a call 64c3b2 call 64e60d 278->285 281 64eb45-64eb48 279->281 282 64eb5d-64eb71 call 64c3b2 * 2 279->282 281->282 290 64eb4a-64eb5c call 64c3b2 call 64e70b 281->290 282->266 286 64ebff 283->286 287 64ebeb-64ebee 283->287 291 64ec1e-64ec2a 284->291 292 64ec08-64ec0d 284->292 285->279 286->284 287->286 294 64ebf0-64ebfe call 64c3b2 * 2 287->294 290->282 291->277 301 64ec2c-64ec37 call 64c3b2 291->301 298 64ec0f-64ec12 292->298 299 64ec1b 292->299 294->286 298->299 307 64ec14-64ec1a call 64c3b2 298->307 299->291 307->299
                                                                                        APIs
                                                                                        • ___free_lconv_mon.LIBCMT ref: 0064EB34
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E62A
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E63C
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E64E
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E660
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E672
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E684
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E696
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E6A8
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E6BA
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E6CC
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E6DE
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E6F0
                                                                                          • Part of subcall function 0064E60D: _free.LIBCMT ref: 0064E702
                                                                                        • _free.LIBCMT ref: 0064EB29
                                                                                          • Part of subcall function 0064C3B2: HeapFree.KERNEL32(00000000,00000000,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?), ref: 0064C3C8
                                                                                          • Part of subcall function 0064C3B2: GetLastError.KERNEL32(?,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?,?), ref: 0064C3DA
                                                                                        • _free.LIBCMT ref: 0064EB4B
                                                                                        • _free.LIBCMT ref: 0064EB60
                                                                                        • _free.LIBCMT ref: 0064EB6B
                                                                                        • _free.LIBCMT ref: 0064EB8D
                                                                                        • _free.LIBCMT ref: 0064EBA0
                                                                                        • _free.LIBCMT ref: 0064EBAE
                                                                                        • _free.LIBCMT ref: 0064EBB9
                                                                                        • _free.LIBCMT ref: 0064EBF1
                                                                                        • _free.LIBCMT ref: 0064EBF8
                                                                                        • _free.LIBCMT ref: 0064EC15
                                                                                        • _free.LIBCMT ref: 0064EC2D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                        • String ID: HFe$HTe
                                                                                        • API String ID: 161543041-3498908858
                                                                                        • Opcode ID: a62578b9f0bc447af62ddf2b4c82044770d99cc59fec8101222076a86832c51f
                                                                                        • Instruction ID: 4e714588f25ed284c6279475702cdd3a659f81333215b87eee238977e09e8671
                                                                                        • Opcode Fuzzy Hash: a62578b9f0bc447af62ddf2b4c82044770d99cc59fec8101222076a86832c51f
                                                                                        • Instruction Fuzzy Hash: 2A314C716016009FDB71AE78D985BA677EAFF01360F14852EE495D7352EE32EC80CB14
                                                                                        Function 006471D0 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 321 6471d0-6471f1 InitializeCriticalSectionAndSpinCount GetModuleHandleW 322 647204-647220 GetProcAddress * 2 321->322 323 6471f3-647202 GetModuleHandleW 321->323 325 647234-647248 CreateEventW 322->325 326 647222-647224 322->326 323->322 324 64724a-647264 call 64795c DeleteCriticalSection 323->324 331 647266-647267 CloseHandle 324->331 332 64726d 324->332 325->324 328 647231-647233 325->328 326->325 327 647226-64722c 326->327 327->328 331->332
                                                                                        APIs
                                                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(006548D4,00000FA0,?,?,006471AE), ref: 006471DC
                                                                                        • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,006471AE), ref: 006471E7
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,006471AE), ref: 006471F8
                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0064720A
                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00647218
                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,006471AE), ref: 0064723B
                                                                                        • ___scrt_fastfail.LIBCMT ref: 0064724C
                                                                                        • DeleteCriticalSection.KERNEL32(006548D4,00000007,?,?,006471AE), ref: 00647257
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,006471AE), ref: 00647267
                                                                                        Strings
                                                                                        • kernel32.dll, xrefs: 006471F3
                                                                                        • api-ms-win-core-synch-l1-2-0.dll, xrefs: 006471E2
                                                                                        • SleepConditionVariableCS, xrefs: 00647204
                                                                                        • WakeAllConditionVariable, xrefs: 00647210
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
                                                                                        • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                        • API String ID: 3578986977-3242537097
                                                                                        • Opcode ID: fbb095d0fe48ab950191d0b25099c930e8f03031b6fa87a824eaeca98ceb59d0
                                                                                        • Instruction ID: 254c9dec8b059a7ab4c9f329016c7f66606fc06902eff75ebdbec1503b7ddb2c
                                                                                        • Opcode Fuzzy Hash: fbb095d0fe48ab950191d0b25099c930e8f03031b6fa87a824eaeca98ceb59d0
                                                                                        • Instruction Fuzzy Hash: 8301D4316457926BDB209B71FD0DA6B36ABAB51B17F411051FD05E7390DFB0C884CBA0
                                                                                        Function 0064D4BD Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: HTe$HTe$HTe$api-ms-$ext-ms-
                                                                                        • API String ID: 0-341942298
                                                                                        • Opcode ID: 4dc5634c6b8d047d22d26cc4f47afcbb5017b406e16168eb8d878e83eaff7c3a
                                                                                        • Instruction ID: 05e373d29d07537ad22040d1027326c251a7f0cd7c804543c637a2bba555c223
                                                                                        • Opcode Fuzzy Hash: 4dc5634c6b8d047d22d26cc4f47afcbb5017b406e16168eb8d878e83eaff7c3a
                                                                                        • Instruction Fuzzy Hash: B921A571E41711ABCB268B68DC45BAE376AAF42768F251525FC16A7390DA30ED01C5E0
                                                                                        Function 0064C048 Relevance: 15.1, APIs: 10, Instructions: 69COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 0064C05E
                                                                                          • Part of subcall function 0064C3B2: HeapFree.KERNEL32(00000000,00000000,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?), ref: 0064C3C8
                                                                                          • Part of subcall function 0064C3B2: GetLastError.KERNEL32(?,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?,?), ref: 0064C3DA
                                                                                        • _free.LIBCMT ref: 0064C06A
                                                                                        • _free.LIBCMT ref: 0064C075
                                                                                        • _free.LIBCMT ref: 0064C080
                                                                                        • _free.LIBCMT ref: 0064C08B
                                                                                        • _free.LIBCMT ref: 0064C096
                                                                                        • _free.LIBCMT ref: 0064C0A1
                                                                                        • _free.LIBCMT ref: 0064C0AC
                                                                                        • _free.LIBCMT ref: 0064C0B7
                                                                                        • _free.LIBCMT ref: 0064C0C5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: e3ce792064ddc9a99132e8faed7e201c30c8b3bc52e5f60457b363bb15ad8144
                                                                                        • Instruction ID: ce3828292da89d434088b04d949155b156748ddac346393afe1a1aabbe9c30e0
                                                                                        • Opcode Fuzzy Hash: e3ce792064ddc9a99132e8faed7e201c30c8b3bc52e5f60457b363bb15ad8144
                                                                                        • Instruction Fuzzy Hash: C9217076901508AFCB82EF94C841DDD7BB5BF48350F01816AF5559B222E731DA94CB84
                                                                                        Function 00649AD0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 168COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00649B07
                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 00649B0F
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00649B98
                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00649BC3
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00649C18
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                        • String ID: 8xd$csm$csm
                                                                                        • API String ID: 1170836740-1996977597
                                                                                        • Opcode ID: 78c09de5c4469548d301543f617780cb6ce5e1e3a3894f670b7bbc8f0a9cc2bd
                                                                                        • Instruction ID: b783c6c3add9e1d5febab7b72ac29ddc34e63435f25323774f43b57ae0bb180b
                                                                                        • Opcode Fuzzy Hash: 78c09de5c4469548d301543f617780cb6ce5e1e3a3894f670b7bbc8f0a9cc2bd
                                                                                        • Instruction Fuzzy Hash: 31519D34A80205DBCF14EF68D884AABBBB7EF45324F148099E8159B392D731DA41CBA1
                                                                                        Function 006463FF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetProcessHeap.KERNEL32(?,?,00646B89,?,00646642), ref: 00646442
                                                                                        • __Init_thread_footer.LIBCMT ref: 00646469
                                                                                          • Part of subcall function 006472B8: EnterCriticalSection.KERNEL32(006548D4,00655444,?,?,00646438,00655444,?,?,00646B89,?,00646642), ref: 006472C3
                                                                                          • Part of subcall function 006472B8: LeaveCriticalSection.KERNEL32(006548D4,?,00646438,00655444,?,?,00646B89,?,00646642), ref: 00647300
                                                                                        • __Init_thread_footer.LIBCMT ref: 006464CB
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalInit_thread_footerSection$EnterHeapLeaveProcess
                                                                                        • String ID: ,]d$DTe$HTe$T]d$bcd
                                                                                        • API String ID: 3363689876-308286267
                                                                                        • Opcode ID: 6f8d7c8b635994f0ec26a63af7037a06e4285754df7546b7b63105db6c086ce0
                                                                                        • Instruction ID: 623f9c4bd5177798e9cb3248b173eed367a8c7fc43c010f7bbcae09888673987
                                                                                        • Opcode Fuzzy Hash: 6f8d7c8b635994f0ec26a63af7037a06e4285754df7546b7b63105db6c086ce0
                                                                                        • Instruction Fuzzy Hash: B3119A32508B10CFC750DF24ED5D6993BE3AB02727F616119F4568B2A1D77429C98B2A
                                                                                        Function 00646836 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 0064688B
                                                                                        • PathRemoveFileSpecW.SHLWAPI(?,?,?,00000104), ref: 006468A6
                                                                                        • PathAppendW.SHLWAPI(?,swupdater.dll,?,?,00000104), ref: 006468D5
                                                                                          • Part of subcall function 006465CA: GetLastError.KERNEL32(0064689A,?,?,00000104), ref: 006465CA
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FilePath$AppendErrorLastModuleNameRemoveSpec
                                                                                        • String ID: swupdater.dll
                                                                                        • API String ID: 3739599460-2098814528
                                                                                        • Opcode ID: 3224858dc6ded53ea5eae9529e7130e8ab675c928a2f63418d37e2eda9ff6cd1
                                                                                        • Instruction ID: 0dee0b23d4a2b7f2f952efd4834d0bbf5684c6e0e66230a323a2ca9385fba10e
                                                                                        • Opcode Fuzzy Hash: 3224858dc6ded53ea5eae9529e7130e8ab675c928a2f63418d37e2eda9ff6cd1
                                                                                        • Instruction Fuzzy Hash: 704163F590022DAACF60EB64DC45FDE73BE9F42304F1041F9B505E3142EA709E89CA6A
                                                                                        Function 0064C2B7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(HTe,?,HTe,0064AA86,0064C452,?,0064AAF8,HTe,00000004,00000004,?,00000000,?,0064B5C7,?,00000004), ref: 0064C2BC
                                                                                        • _free.LIBCMT ref: 0064C319
                                                                                        • _free.LIBCMT ref: 0064C34F
                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,0064AAF8,HTe,00000004,00000004,?,00000000,?,0064B5C7,?,00000004,00000004,T]d), ref: 0064C35A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast_free
                                                                                        • String ID: HTe$HTe
                                                                                        • API String ID: 2283115069-2660482858
                                                                                        • Opcode ID: 81ce9f905aa4f6b2a239a1349461543380572119f04e9f34d176820a4132fa72
                                                                                        • Instruction ID: 9fbb918584257b8b29144e563563601fc9cd766af4dd090ccf62ca636d0b5889
                                                                                        • Opcode Fuzzy Hash: 81ce9f905aa4f6b2a239a1349461543380572119f04e9f34d176820a4132fa72
                                                                                        • Instruction Fuzzy Hash: 37112F326417046BC7D2EBB9AC85F6B255BABC57BDF340239F525D23E2DE628C418214
                                                                                        Function 0064E7AC Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0064E774: _free.LIBCMT ref: 0064E799
                                                                                        • _free.LIBCMT ref: 0064E7FA
                                                                                          • Part of subcall function 0064C3B2: HeapFree.KERNEL32(00000000,00000000,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?), ref: 0064C3C8
                                                                                          • Part of subcall function 0064C3B2: GetLastError.KERNEL32(?,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?,?), ref: 0064C3DA
                                                                                        • _free.LIBCMT ref: 0064E805
                                                                                        • _free.LIBCMT ref: 0064E810
                                                                                        • _free.LIBCMT ref: 0064E864
                                                                                        • _free.LIBCMT ref: 0064E86F
                                                                                        • _free.LIBCMT ref: 0064E87A
                                                                                        • _free.LIBCMT ref: 0064E885
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: dcb31790bdfd7afe4745d9090afd41ecfff798791d41c0f986f5dccb79862b39
                                                                                        • Instruction ID: 20719d21e231a7e4595e839a962e2682cbcc419fb7213c931313ab7991bc1a93
                                                                                        • Opcode Fuzzy Hash: dcb31790bdfd7afe4745d9090afd41ecfff798791d41c0f986f5dccb79862b39
                                                                                        • Instruction Fuzzy Hash: 6311AF31581B04AAD7B1FBB0CC07FCB779EAF00720F408A1DB2A9A6152EA26B444C685
                                                                                        Function 0064AE73 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0064AE68,?,?,0064AE30,?,?,?), ref: 0064AE88
                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0064AE9B
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,0064AE68,?,?,0064AE30,?,?,?), ref: 0064AEBE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                        • String ID: 8xd$CorExitProcess$mscoree.dll
                                                                                        • API String ID: 4061214504-1111715373
                                                                                        • Opcode ID: 38e4f1574bc74763b26d5d466102210c5fe62f6690aeaf0a3dbf9a5ab6a84ed4
                                                                                        • Instruction ID: 1ab1a2fb17b6aa42288070899913c198061c4ecc66f7a5891715d8b004596159
                                                                                        • Opcode Fuzzy Hash: 38e4f1574bc74763b26d5d466102210c5fe62f6690aeaf0a3dbf9a5ab6a84ed4
                                                                                        • Instruction Fuzzy Hash: A5F08C30940318FBDB11DB90DD0DBDEBB6AEB00756F000060F801A22A0DB748E00EAA1
                                                                                        Function 0064FCDD Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetConsoleCP.KERNEL32(?,00000001,00000000), ref: 0064FD25
                                                                                        • __fassign.LIBCMT ref: 0064FF04
                                                                                        • __fassign.LIBCMT ref: 0064FF21
                                                                                        • WriteFile.KERNEL32(?,0064DFDF,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0064FF69
                                                                                        • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0064FFA9
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00650055
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileWrite__fassign$ConsoleErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 4031098158-0
                                                                                        • Opcode ID: 20cc82df9176c45aedb6e7fc4d73aad74d7dd468b44abf089ac16e9c4d6ef5d2
                                                                                        • Instruction ID: 72330683da08d015e44a03c31abdf28c16e74bf7adbadc26c95f88ffce4433cc
                                                                                        • Opcode Fuzzy Hash: 20cc82df9176c45aedb6e7fc4d73aad74d7dd468b44abf089ac16e9c4d6ef5d2
                                                                                        • Instruction Fuzzy Hash: 27D19C75D002589FDF25CFE8C890AEDBBB6BF48315F280169E855BB382D731A946CB50
                                                                                        Function 00649D70 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,00649D67,00649D39,00647B42), ref: 00649D7E
                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00649D8C
                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00649DA5
                                                                                        • SetLastError.KERNEL32(00000000,00649D67,00649D39,00647B42), ref: 00649DF7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                        • String ID:
                                                                                        • API String ID: 3852720340-0
                                                                                        • Opcode ID: 2eccebe8216d4bafed928a93bcb71b5852bc8b5e3a1de1e23eef7734c18c63bc
                                                                                        • Instruction ID: 252d4006a89130f669ee6e0c3870939171673277d848accc3d58ed25d4acc19a
                                                                                        • Opcode Fuzzy Hash: 2eccebe8216d4bafed928a93bcb71b5852bc8b5e3a1de1e23eef7734c18c63bc
                                                                                        • Instruction Fuzzy Hash: 94014C32989F126E9B646BB5BC85BA72E67DF017B9B34032DF210412E4EF524C40E124
                                                                                        Function 0064A080 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,0064A141,?,?,00654C8C,00000000,?,0064A26C,00000004,InitializeCriticalSectionEx,00641C14,InitializeCriticalSectionEx,00000000), ref: 0064A110
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary
                                                                                        • String ID: api-ms-
                                                                                        • API String ID: 3664257935-2084034818
                                                                                        • Opcode ID: a13f639d60316412d474676845c56a2c85b0daa8eaebb3055efbb7e3d4333b12
                                                                                        • Instruction ID: 4415091d3d7794aa1e05eeb86f6979adb86bf03bbb57416a79945236196acabb
                                                                                        • Opcode Fuzzy Hash: a13f639d60316412d474676845c56a2c85b0daa8eaebb3055efbb7e3d4333b12
                                                                                        • Instruction Fuzzy Hash: ED11E331A85721BBCB328BA8DC45B9A37A7AF02B74F140164F911FB3C0D7A0ED4086D6
                                                                                        Function 00647340 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SleepConditionVariableCS.KERNELBASE(?,006472DD,00000064), ref: 00647363
                                                                                        • LeaveCriticalSection.KERNEL32(006548D4,?,?,006472DD,00000064,?,00646438,00655444,?,?,00646B89,?,00646642), ref: 0064736D
                                                                                        • WaitForSingleObjectEx.KERNEL32(?,00000000,?,006472DD,00000064,?,00646438,00655444,?,?,00646B89,?,00646642), ref: 0064737E
                                                                                        • EnterCriticalSection.KERNEL32(006548D4,?,006472DD,00000064,?,00646438,00655444,?,?,00646B89,?,00646642), ref: 00647385
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                        • String ID: 8xd
                                                                                        • API String ID: 3269011525-2013281157
                                                                                        • Opcode ID: 3e54e656514ce20287e278d333882c3b9c4c12899f1fe46ffb97e45820cf7f94
                                                                                        • Instruction ID: bb44f3bb3813de973db4838ac7382c3676d297d078ad9f4d958317c917e2501d
                                                                                        • Opcode Fuzzy Hash: 3e54e656514ce20287e278d333882c3b9c4c12899f1fe46ffb97e45820cf7f94
                                                                                        • Instruction Fuzzy Hash: 35E09231501764ABCB126F90EC08A9D7F2BBB04B5BF4110A1FD0697260CF619960EBD0
                                                                                        Function 0064E70B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 0064E723
                                                                                          • Part of subcall function 0064C3B2: HeapFree.KERNEL32(00000000,00000000,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?), ref: 0064C3C8
                                                                                          • Part of subcall function 0064C3B2: GetLastError.KERNEL32(?,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?,?), ref: 0064C3DA
                                                                                        • _free.LIBCMT ref: 0064E735
                                                                                        • _free.LIBCMT ref: 0064E747
                                                                                        • _free.LIBCMT ref: 0064E759
                                                                                        • _free.LIBCMT ref: 0064E76B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 6cdb6710c0ba754e59c2433b43ce7ffb4bc836b2741082c78b28549215024b1f
                                                                                        • Instruction ID: 564d16ff3c1c6533db3e28d5756ca5544fb5ab060a36ccacbc27c0c403ad792c
                                                                                        • Opcode Fuzzy Hash: 6cdb6710c0ba754e59c2433b43ce7ffb4bc836b2741082c78b28549215024b1f
                                                                                        • Instruction Fuzzy Hash: D4F0FF32506600ABC7A1EB68F8C5C6673EBFA05771B65994AF444D7712DB32FCC0CA54
                                                                                        Function 00650548 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177fileCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0064FCDD: GetConsoleCP.KERNEL32(?,00000001,00000000), ref: 0064FD25
                                                                                        • WriteFile.KERNEL32(?,00000000,0064E050,?,00000000,?,?,?,0064DFDF,?,?,?,00653778,0000002C,0064E050,?), ref: 00650699
                                                                                        • GetLastError.KERNEL32 ref: 006506A3
                                                                                        • __dosmaperr.LIBCMT ref: 006506E8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConsoleErrorFileLastWrite__dosmaperr
                                                                                        • String ID: Pd
                                                                                        • API String ID: 251514795-2778440993
                                                                                        • Opcode ID: fc973d7b9a98ffa6b223682c63d4ed6fb1b9612ea98429265567a2683fa369b1
                                                                                        • Instruction ID: acacaba6f2c63b42b8a593692e954fd25f54b4b00ac9a28adb0499f781129555
                                                                                        • Opcode Fuzzy Hash: fc973d7b9a98ffa6b223682c63d4ed6fb1b9612ea98429265567a2683fa369b1
                                                                                        • Instruction Fuzzy Hash: 7A51907190020AABFB11DFA4CD85BEE7BBBEF49356F140055EC00AB291E670D949CB65
                                                                                        Function 0064AF45 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: C:\Program Files (x86)\Wavesor\Temp\GUMF7C6.tmp\SWUpdater.exe
                                                                                        • API String ID: 0-1208709338
                                                                                        • Opcode ID: 74d0c595e6af53bb78c56c3d40d886b6f3c3b1f6458074de29a8871eded3d8fe
                                                                                        • Instruction ID: 71ec004b7e80bdfc3d88e25a54f084f46540d935f8a7034d1f81556ceb7cd5f6
                                                                                        • Opcode Fuzzy Hash: 74d0c595e6af53bb78c56c3d40d886b6f3c3b1f6458074de29a8871eded3d8fe
                                                                                        • Instruction Fuzzy Hash: 1931AEB1A40214EFCB61DF99C8859AFBBBAEB84710F20416AF51597350E7B08A41CB91
                                                                                        Function 0064D584 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: HTe$HTe$HTe
                                                                                        • API String ID: 0-3754207079
                                                                                        • Opcode ID: d878795f7f521637ec6e15bcbb0b86601cd7b9e9c62132eb380437db8d7d3090
                                                                                        • Instruction ID: 59b36a9a618d51ff4cc718deb3cfc55c9cd6cbdb79fb143764a21f5ef6e48f0e
                                                                                        • Opcode Fuzzy Hash: d878795f7f521637ec6e15bcbb0b86601cd7b9e9c62132eb380437db8d7d3090
                                                                                        • Instruction Fuzzy Hash: 6101B537B04611AB9B1ADF69EC4099A37E7AB85375B258124FA05CB294DF30D8418690
                                                                                        Function 0064C160 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,?,00650123,?,00000001,0064E050,?,006505E2,00000001,?,?,?,0064DFDF,?,?), ref: 0064C165
                                                                                        • _free.LIBCMT ref: 0064C1C2
                                                                                        • _free.LIBCMT ref: 0064C1F8
                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,006505E2,00000001,?,?,?,0064DFDF,?,?,?,00653778,0000002C,0064E050), ref: 0064C203
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast_free
                                                                                        • String ID:
                                                                                        • API String ID: 2283115069-0
                                                                                        • Opcode ID: b5835f285e514bb3a661c053cd0b25713625a9020bead6cbba33bf8dbcf23be1
                                                                                        • Instruction ID: 9cc9b7e8f3408272e3c099b01aa1f96ddf4c6a028fe122ef0d310d004f7fb96c
                                                                                        • Opcode Fuzzy Hash: b5835f285e514bb3a661c053cd0b25713625a9020bead6cbba33bf8dbcf23be1
                                                                                        • Instruction Fuzzy Hash: 3A112C322453046BD7D1A7B5ACC6E7B215B9BC17BAB340339F625833E3DE618C418224
                                                                                        Function 00651216 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteConsoleW.KERNEL32(?,?,0064E050,00000000,?,?,00650C6F,?,00000001,?,00000001,?,006500B2,00000000,?,00000001), ref: 0065122D
                                                                                        • GetLastError.KERNEL32(?,00650C6F,?,00000001,?,00000001,?,006500B2,00000000,?,00000001,00000000,00000001,?,00650606,0064DFDF), ref: 00651239
                                                                                          • Part of subcall function 006511FF: CloseHandle.KERNEL32(FFFFFFFE,00651249,?,00650C6F,?,00000001,?,00000001,?,006500B2,00000000,?,00000001,00000000,00000001), ref: 0065120F
                                                                                        • ___initconout.LIBCMT ref: 00651249
                                                                                          • Part of subcall function 006511C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006511F0,00650C5C,00000001,?,006500B2,00000000,?,00000001,00000000), ref: 006511D4
                                                                                        • WriteConsoleW.KERNEL32(?,?,0064E050,00000000,?,00650C6F,?,00000001,?,00000001,?,006500B2,00000000,?,00000001,00000000), ref: 0065125E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                        • String ID:
                                                                                        • API String ID: 2744216297-0
                                                                                        • Opcode ID: 4ec371eb62ba3306d2f90f4fd7a6b9fba51249b15e4020cb499ed3e443d82e11
                                                                                        • Instruction ID: 4ebc3aec5ec89a656c2bf46b8449b7bcca5d4db8165b2a8a2b9c018a5ec11b1d
                                                                                        • Opcode Fuzzy Hash: 4ec371eb62ba3306d2f90f4fd7a6b9fba51249b15e4020cb499ed3e443d82e11
                                                                                        • Instruction Fuzzy Hash: E0F01236500658BBCF226FA5EC04A993F67FB0A363F055050FE1986170CB32C960DB90
                                                                                        Function 0064B85D Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 0064B866
                                                                                          • Part of subcall function 0064C3B2: HeapFree.KERNEL32(00000000,00000000,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?), ref: 0064C3C8
                                                                                          • Part of subcall function 0064C3B2: GetLastError.KERNEL32(?,?,0064E79E,?,00000000,?,HTe,?,0064E7C5,?,00000007,?,?,0064EC87,?,?), ref: 0064C3DA
                                                                                        • _free.LIBCMT ref: 0064B879
                                                                                        • _free.LIBCMT ref: 0064B88A
                                                                                        • _free.LIBCMT ref: 0064B89B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: d3058854657de4727767dd598954adc31651002032dcf94cb9c3e0b6d63f2cee
                                                                                        • Instruction ID: b2bf9cfe8467ea6d8f45390d5f26ea59b1ee68925a16b30990ba6b26843bdeab
                                                                                        • Opcode Fuzzy Hash: d3058854657de4727767dd598954adc31651002032dcf94cb9c3e0b6d63f2cee
                                                                                        • Instruction Fuzzy Hash: BFE04F71401F209AC792EF14BC2981D3A67FB04762B50A10BF80A02332E7760891DFC4
                                                                                        Function 0064B53E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free
                                                                                        • String ID: T]d
                                                                                        • API String ID: 269201875-3510556966
                                                                                        • Opcode ID: 3a7bccc643454bd90aff19b15d0046c04aee51a5a9f77cad51d7332e4db55fe9
                                                                                        • Instruction ID: f9b37d0519a57031093f5bdf8134aff020af521603dc4904453ee08a010253f8
                                                                                        • Opcode Fuzzy Hash: 3a7bccc643454bd90aff19b15d0046c04aee51a5a9f77cad51d7332e4db55fe9
                                                                                        • Instruction Fuzzy Hash: 38417F76A01214ABCB14DFA8C881A9EB7F7EF88714B1645ADE515EB351EB31ED01CB80
                                                                                        Function 0064CE37 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0064CBE0: GetOEMCP.KERNEL32(00000000,0064CE52,0064FD39,00000000,?,?,00000000,?,0064FD39), ref: 0064CC0B
                                                                                        • _free.LIBCMT ref: 0064CEAF
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free
                                                                                        • String ID: h@e
                                                                                        • API String ID: 269201875-1948555608
                                                                                        • Opcode ID: b6d2283f44549129378e7c5c660934acd88847851934f3174a0e7b022c69659f
                                                                                        • Instruction ID: a054ee0a5dd01e03f1ded409085cd328954e793c027d49832a60052d4ba9da60
                                                                                        • Opcode Fuzzy Hash: b6d2283f44549129378e7c5c660934acd88847851934f3174a0e7b022c69659f
                                                                                        • Instruction Fuzzy Hash: DB31B072900249AFDF91DF68D841BEA7BF6EF84324F11415AF9109B391EB329D50CB54
                                                                                        Function 0064E16C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free
                                                                                        • String ID: PFe
                                                                                        • API String ID: 269201875-134646518
                                                                                        • Opcode ID: b9879d0ead3d60831384e4b95ac3b36a8c570b4afc19c8636ad67cbf0130ba59
                                                                                        • Instruction ID: df6d8c737d5bdfe2563f9138a6187602a6969b8238b84bb8576a72183452820f
                                                                                        • Opcode Fuzzy Hash: b9879d0ead3d60831384e4b95ac3b36a8c570b4afc19c8636ad67cbf0130ba59
                                                                                        • Instruction Fuzzy Hash: CD11E631E41B0156D720DF28AC95B9637977714771F14162AF925CB3D0F7B5DD824280
                                                                                        Function 00646798 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegOpenKeyExW.ADVAPI32(?,Software\Wavesor\SWUpdater\Clients\{F6F60ACE-71AD-4610-80D4-9253729FB4B7},00000000,00020019,?,?,?), ref: 006467BF
                                                                                        • SHQueryValueExW.SHLWAPI(?,00645C84,00000000,?,00000000,?,00000032,?,?), ref: 00646802
                                                                                        Strings
                                                                                        • Software\Wavesor\SWUpdater\Clients\{F6F60ACE-71AD-4610-80D4-9253729FB4B7}, xrefs: 006467B1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: OpenQueryValue
                                                                                        • String ID: Software\Wavesor\SWUpdater\Clients\{F6F60ACE-71AD-4610-80D4-9253729FB4B7}
                                                                                        • API String ID: 4153817207-798717047
                                                                                        • Opcode ID: 60844a46c3cf6efeac9ebb526b6ec009b512b796b5648ce92629f51107d3b30e
                                                                                        • Instruction ID: bb524f1f2a863fce35a4f6ba8e2be0663294cf8ae23e204042cb7940a403ff1e
                                                                                        • Opcode Fuzzy Hash: 60844a46c3cf6efeac9ebb526b6ec009b512b796b5648ce92629f51107d3b30e
                                                                                        • Instruction Fuzzy Hash: 25118272D40229AF9B20DBA9CC469FFBFB9EB41721F104259B851E7281D6748E41CAE1
                                                                                        Function 00647198 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0064786E
                                                                                        • ___raise_securityfailure.LIBCMT ref: 00647955
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                        • String ID: /fd
                                                                                        • API String ID: 3761405300-3039343023
                                                                                        • Opcode ID: 10b2c53a62e4cb026cee4b6a308fe46ee760054f8d6783111e3a96213c1f943d
                                                                                        • Instruction ID: 69f828a32167fc12cd76ba4689cf0a3fe39f3ef8cfb5f8f91a4a93768000d96d
                                                                                        • Opcode Fuzzy Hash: 10b2c53a62e4cb026cee4b6a308fe46ee760054f8d6783111e3a96213c1f943d
                                                                                        • Instruction Fuzzy Hash: 2C2137B45993009EE344CF55FC466413BF6BB0831AF10B0AAE6098BBA4EFB055C0CF88
                                                                                        Function 0064FBBE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0064E4CC: EnterCriticalSection.KERNEL32(00000001,?,006504BA,?,006537F8,00000010,0064E0F3,00000000,00000000,?,?,?,?,0064E137,?,00000000), ref: 0064E4E7
                                                                                        • FlushFileBuffers.KERNEL32(00000000,006537D8,0000000C,0064FCC5,Pd,?,00000001,?,0064E050,?), ref: 0064FC07
                                                                                        • GetLastError.KERNEL32 ref: 0064FC18
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: BuffersCriticalEnterErrorFileFlushLastSection
                                                                                        • String ID: Pd
                                                                                        • API String ID: 4109680722-2778440993
                                                                                        • Opcode ID: 0a99635ca4cb7f94986a52d3b85905909c98d70e153f970a566a3e751738ed71
                                                                                        • Instruction ID: 3d3a6fd2d307574bad00e128cad9837c237b1f0b3f6e175410036c417744ced2
                                                                                        • Opcode Fuzzy Hash: 0a99635ca4cb7f94986a52d3b85905909c98d70e153f970a566a3e751738ed71
                                                                                        • Instruction Fuzzy Hash: 2501DE72E003149FCB10EFA8D94569E7BE2EF48720F10526EF8119B3E1DB759901CB44
                                                                                        Function 0064C41F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 0064C440
                                                                                          • Part of subcall function 0064E8B4: HeapAlloc.KERNEL32(00000000,HTe,00000004,?,0064C434,?,00000000,?,0064AAF8,HTe,00000004,00000004,?,00000000,?,0064B5C7), ref: 0064E8E6
                                                                                        • HeapReAlloc.KERNEL32(00000000,HTe,?,00000004,00000000,?,0064AAF8,HTe,00000004,00000004,?,00000000,?,0064B5C7,?,00000004), ref: 0064C47C
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocHeap$_free
                                                                                        • String ID: HTe
                                                                                        • API String ID: 619065292-1657211117
                                                                                        • Opcode ID: 63f088b84d0f72ab3f4593fe9b2a46be4a32fc0dfca93310b269e57488cedddc
                                                                                        • Instruction ID: 70a090844605bd64843af5770c3b7f5e638032868e75767a64fae9a1f20fd7e6
                                                                                        • Opcode Fuzzy Hash: 63f088b84d0f72ab3f4593fe9b2a46be4a32fc0dfca93310b269e57488cedddc
                                                                                        • Instruction Fuzzy Hash: A8F0FC31643211BACBA12E25ED11FBA379B9F81770F208129F90496790DF31CC0091E6
                                                                                        Function 0064D746 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 0064D786
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountCriticalInitializeSectionSpin
                                                                                        • String ID: 8xd$InitializeCriticalSectionEx
                                                                                        • API String ID: 2593887523-750004694
                                                                                        • Opcode ID: 190c6f7ce6c37a6f00b37b5069c766f2549f63d8bfd3b455c9c40b1e0e3430f0
                                                                                        • Instruction ID: f287e2e090d14a30d84d776e7fdc8f1d08f968744f1b07f4e7c1477079646c5c
                                                                                        • Opcode Fuzzy Hash: 190c6f7ce6c37a6f00b37b5069c766f2549f63d8bfd3b455c9c40b1e0e3430f0
                                                                                        • Instruction Fuzzy Hash: ADE01235980318B7CF126F51DC05DDE7F27DB55761F414010FD1856161CA758971EAD4
                                                                                        Function 00647080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 006462C1: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 006462C6
                                                                                          • Part of subcall function 006462C1: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 006462D0
                                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,00646236), ref: 006470B3
                                                                                        • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00646236), ref: 006470C2
                                                                                        Strings
                                                                                        • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 006470BD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                        • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                        • API String ID: 450123788-631824599
                                                                                        • Opcode ID: f7db568732e7f0badf4e6912201d3213272b26f939ae2e4aa343d3dc4c67ab70
                                                                                        • Instruction ID: 211d0ca1e9cf4899a129434777117b1a2e216a8a35d608c262a03d425149e45b
                                                                                        • Opcode Fuzzy Hash: f7db568732e7f0badf4e6912201d3213272b26f939ae2e4aa343d3dc4c67ab70
                                                                                        • Instruction Fuzzy Hash: B7E092B02047508FD3B0EF24E908342BBE6AF01B46F00891DE496C7390DBB4E4C8CBA1
                                                                                        Function 0064D647 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: Alloc
                                                                                        • String ID: 8xd$FlsAlloc
                                                                                        • API String ID: 2773662609-1730321566
                                                                                        • Opcode ID: 3becb176ac466ad8f283fe728066413a41ed7e00920daadd351a0fd094ad903a
                                                                                        • Instruction ID: 94c166c1a4eaacbd1efca132d1798d1028bdc1106f75da8b64455bebf8d1d772
                                                                                        • Opcode Fuzzy Hash: 3becb176ac466ad8f283fe728066413a41ed7e00920daadd351a0fd094ad903a
                                                                                        • Instruction Fuzzy Hash: ECE02B31E80334B7C71237A59C1AEADBF1BCB91B71F434010FD08562819DA54851D9D9
                                                                                        Function 0064D84A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNEL32(006550E8), ref: 0064D867
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000002.00000002.3107656499.0000000000641000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00640000, based on PE: true
                                                                                        • Associated: 00000002.00000002.3107629541.0000000000640000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107688739.0000000000654000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                        • Associated: 00000002.00000002.3107719328.0000000000656000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_2_2_640000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary
                                                                                        • String ID: 8Qe$Pe
                                                                                        • API String ID: 3664257935-179243612
                                                                                        • Opcode ID: 5df5db7df65b06c233fb8815245d6e2014881be588b300a4592c20f14d7cbf3b
                                                                                        • Instruction ID: b49e7255d54a46f9d1b1ab3668461ee8711c33e531929a6a53295fe5515c2a60
                                                                                        • Opcode Fuzzy Hash: 5df5db7df65b06c233fb8815245d6e2014881be588b300a4592c20f14d7cbf3b
                                                                                        • Instruction Fuzzy Hash: FFE08C72C10A15EFDB302E18D808BF07BDA5B60336F25023AE8ED122E092719CD6C680

                                                                                        Execution Graph

                                                                                        Execution Coverage:3.3%
                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                        Signature Coverage:0%
                                                                                        Total number of Nodes:775
                                                                                        Total number of Limit Nodes:10
                                                                                        execution_graph 7034 c376b2 7035 c376be ___scrt_is_nonwritable_in_current_image 7034->7035 7060 c37404 7035->7060 7037 c376c5 7038 c37818 7037->7038 7049 c376ef ___scrt_is_nonwritable_in_current_image __fassign ___scrt_release_startup_lock 7037->7049 7108 c3795c IsProcessorFeaturePresent 7038->7108 7040 c3781f 7088 c3af2f 7040->7088 7045 c3770e 7046 c3778f 7068 c37a76 7046->7068 7048 c37795 7072 c369c8 GetModuleHandleW GetProcAddress 7048->7072 7049->7045 7049->7046 7091 c3af09 7049->7091 7052 c377aa 7097 c37aaf GetModuleHandleW 7052->7097 7055 c377b5 7056 c377be 7055->7056 7099 c3aee4 7055->7099 7102 c37575 7056->7102 7061 c3740d 7060->7061 7115 c37b5c IsProcessorFeaturePresent 7061->7115 7065 c3741e 7067 c37422 7065->7067 7125 c39a79 7065->7125 7067->7037 7187 c39900 7068->7187 7071 c37a9c 7071->7048 7073 c369e7 7072->7073 7189 c36631 7073->7189 7075 c369f6 7216 c36b81 7075->7216 7077 c36a00 7219 c36836 7077->7219 7080 c36a15 LoadLibraryExW 7081 c36a31 GetProcAddress 7080->7081 7082 c36a28 7080->7082 7085 c36a4f FreeLibrary 7081->7085 7086 c36a43 GetCommandLineW 7081->7086 7250 c365ca GetLastError 7082->7250 7083 c36a2d 7083->7052 7085->7083 7086->7085 7563 c3adcd 7088->7563 7092 c3af1f ___scrt_is_nonwritable_in_current_image __dosmaperr 7091->7092 7092->7046 7633 c3c160 GetLastError 7092->7633 7098 c377b1 7097->7098 7098->7040 7098->7055 7100 c3adcd __fassign 23 API calls 7099->7100 7101 c3aeef 7100->7101 7101->7056 7103 c37581 7102->7103 7105 c37597 7103->7105 8012 c3b8ed 7103->8012 7105->7045 7106 c3758f 7107 c39a79 ___scrt_uninitialize_crt 7 API calls 7106->7107 7107->7105 7109 c37971 ___scrt_fastfail 7108->7109 7110 c37a1c IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7109->7110 7111 c37a67 ___scrt_fastfail 7110->7111 7111->7040 7112 c3aef3 7113 c3adcd __fassign 23 API calls 7112->7113 7114 c3782d 7113->7114 7116 c37419 7115->7116 7117 c39a5a 7116->7117 7131 c39e50 7117->7131 7121 c39a6b 7122 c39a76 7121->7122 7145 c39e8c 7121->7145 7122->7065 7124 c39a63 7124->7065 7126 c39a82 7125->7126 7127 c39a8c 7125->7127 7128 c39e35 ___vcrt_uninitialize_ptd 6 API calls 7126->7128 7127->7067 7129 c39a87 7128->7129 7130 c39e8c ___vcrt_uninitialize_locks DeleteCriticalSection 7129->7130 7130->7127 7132 c39e59 7131->7132 7134 c39e82 7132->7134 7135 c39a5f 7132->7135 7149 c3a252 7132->7149 7136 c39e8c ___vcrt_uninitialize_locks DeleteCriticalSection 7134->7136 7135->7124 7137 c39e02 7135->7137 7136->7135 7168 c3a163 7137->7168 7142 c39e32 7142->7121 7144 c39e17 7144->7121 7146 c39eb6 7145->7146 7147 c39e97 7145->7147 7146->7124 7148 c39ea1 DeleteCriticalSection 7147->7148 7148->7146 7148->7148 7154 c3a11a 7149->7154 7152 c3a28a InitializeCriticalSectionAndSpinCount 7153 c3a275 7152->7153 7153->7132 7155 c3a132 7154->7155 7156 c3a155 7154->7156 7155->7156 7160 c3a080 7155->7160 7156->7152 7156->7153 7159 c3a147 GetProcAddress 7159->7156 7166 c3a08c ___vcrt_FlsSetValue 7160->7166 7161 c3a100 7161->7156 7161->7159 7162 c3a0a2 LoadLibraryExW 7163 c3a0c0 GetLastError 7162->7163 7164 c3a107 7162->7164 7163->7166 7164->7161 7165 c3a10f FreeLibrary 7164->7165 7165->7161 7166->7161 7166->7162 7167 c3a0e2 LoadLibraryExW 7166->7167 7167->7164 7167->7166 7169 c3a11a ___vcrt_FlsSetValue 5 API calls 7168->7169 7170 c3a17d 7169->7170 7171 c3a196 TlsAlloc 7170->7171 7172 c39e0c 7170->7172 7172->7144 7173 c3a214 7172->7173 7174 c3a11a ___vcrt_FlsSetValue 5 API calls 7173->7174 7175 c3a22e 7174->7175 7176 c3a249 TlsSetValue 7175->7176 7177 c39e25 7175->7177 7176->7177 7177->7142 7178 c39e35 7177->7178 7179 c39e3f 7178->7179 7181 c39e45 7178->7181 7182 c3a19e 7179->7182 7181->7144 7183 c3a11a ___vcrt_FlsSetValue 5 API calls 7182->7183 7184 c3a1b8 7183->7184 7185 c3a1d0 TlsFree 7184->7185 7186 c3a1c4 7184->7186 7185->7186 7186->7181 7188 c37a89 GetStartupInfoW 7187->7188 7188->7071 7190 c36b81 40 API calls 7189->7190 7191 c36642 7190->7191 7192 c3665b GetModuleFileNameW 7191->7192 7193 c36673 7192->7193 7194 c3674a 7193->7194 7252 c363ff 7193->7252 7194->7075 7196 c3678d 7198 c366b0 7282 c36d27 7198->7282 7199 c366be 7291 c36c55 7199->7291 7202 c366bc 7267 c36a70 7202->7267 7204 c366db 7271 c36da4 7204->7271 7206 c366e6 7275 c36b20 7206->7275 7208 c366f8 7209 c36b81 40 API calls 7208->7209 7210 c36708 7209->7210 7211 c3671d SHGetFolderPathW 7210->7211 7212 c36736 7211->7212 7212->7194 7304 c36ae6 7212->7304 7214 c36742 7215 c36ae6 CharLowerBuffW 7214->7215 7215->7194 7217 c363ff 40 API calls 7216->7217 7218 c36b89 7217->7218 7218->7077 7220 c3686b ___scrt_fastfail 7219->7220 7221 c3687a GetModuleFileNameW 7220->7221 7222 c36895 7221->7222 7223 c3689f PathRemoveFileSpecW 7221->7223 7225 c365ca GetLastError 7222->7225 7544 c3a7b4 7223->7544 7242 c3689a 7225->7242 7227 c368db 7553 c365e5 7227->7553 7228 c37198 _ValidateLocalCookies 5 API calls 7230 c369c6 7228->7230 7230->7080 7230->7083 7232 c368ea 7236 c36c55 25 API calls 7232->7236 7233 c3690d 7234 c3a7b4 25 API calls 7233->7234 7235 c36925 7234->7235 7237 c36b81 40 API calls 7235->7237 7236->7242 7238 c36933 7237->7238 7559 c36798 RegOpenKeyExW 7238->7559 7240 c36944 7241 c3694a PathAppendW 7240->7241 7240->7242 7243 c3696f 7241->7243 7244 c3695d PathAppendW 7241->7244 7242->7228 7246 c365ca GetLastError 7243->7246 7244->7243 7245 c36978 7244->7245 7247 c365e5 6 API calls 7245->7247 7246->7242 7248 c36983 7247->7248 7248->7242 7249 c36c55 25 API calls 7248->7249 7249->7242 7251 c365d4 7250->7251 7251->7083 7253 c3642d 7252->7253 7264 c36416 7252->7264 7309 c372b8 EnterCriticalSection 7253->7309 7255 c372b8 6 API calls 7259 c3647d 7255->7259 7256 c36438 7257 c36442 GetProcessHeap 7256->7257 7256->7264 7314 c375ca 7257->7314 7261 c375ca 28 API calls 7259->7261 7266 c36428 7259->7266 7263 c364ca 7261->7263 7265 c3726e __Init_thread_footer 5 API calls 7263->7265 7264->7255 7264->7266 7265->7266 7266->7196 7266->7198 7266->7199 7399 c36ba8 7267->7399 7269 c36a7e PathRemoveFileSpecW 7270 c36a8d 7269->7270 7270->7204 7272 c36daf 7271->7272 7274 c36dbd 7272->7274 7401 c36e4e 7272->7401 7274->7206 7276 c36b38 7275->7276 7281 c36b4c 7275->7281 7277 c36b6d 7276->7277 7279 c36b47 7276->7279 7278 c36c55 25 API calls 7277->7278 7278->7281 7280 c36da4 14 API calls 7279->7280 7280->7281 7281->7208 7407 c37131 EnterCriticalSection 7282->7407 7284 c36d99 7284->7202 7285 c36d52 FindResourceExW 7288 c36d3c 7285->7288 7286 c37131 5 API calls 7286->7288 7288->7284 7288->7285 7288->7286 7289 c36d8a 7288->7289 7412 c362e9 LoadResource 7288->7412 7289->7284 7416 c36ec2 FindResourceW 7289->7416 7292 c36c63 7291->7292 7294 c36c6d 7291->7294 7292->7202 7293 c36d01 7294->7293 7295 c36ce7 7294->7295 7296 c36c9d 7294->7296 7297 c36e4e 14 API calls 7295->7297 7296->7292 7298 c36cae 7296->7298 7299 c36cc4 7296->7299 7297->7292 7300 c3aa81 _free 14 API calls 7298->7300 7299->7292 7302 c3aa81 _free 14 API calls 7299->7302 7301 c36cb3 7300->7301 7303 c3a9c4 __fassign 25 API calls 7301->7303 7302->7301 7303->7292 7305 c36af5 7304->7305 7306 c36b00 CharLowerBuffW 7305->7306 7307 c36b15 7305->7307 7308 c36b10 7306->7308 7308->7214 7310 c372cc 7309->7310 7311 c372d1 LeaveCriticalSection 7310->7311 7322 c37340 7310->7322 7311->7256 7327 c3759d 7314->7327 7317 c3726e EnterCriticalSection LeaveCriticalSection 7318 c3730a 7317->7318 7319 c37326 SetEvent ResetEvent 7318->7319 7320 c37315 RtlWakeAllConditionVariable 7318->7320 7319->7264 7320->7264 7323 c37367 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 7322->7323 7324 c3734e SleepConditionVariableCS 7322->7324 7325 c3738b 7323->7325 7324->7325 7325->7310 7328 c375b3 7327->7328 7329 c375ac 7327->7329 7336 c3b7ad 7328->7336 7333 c3b741 7329->7333 7332 c36468 7332->7317 7334 c3b7ad 28 API calls 7333->7334 7335 c3b753 7334->7335 7335->7332 7339 c3b4e3 7336->7339 7340 c3b4ef ___scrt_is_nonwritable_in_current_image 7339->7340 7347 c3c4c9 EnterCriticalSection 7340->7347 7342 c3b4fd 7348 c3b53e 7342->7348 7344 c3b50a 7358 c3b532 7344->7358 7347->7342 7349 c3b55a 7348->7349 7351 c3b5d1 __dosmaperr 7348->7351 7350 c3b5b1 7349->7350 7349->7351 7361 c3aaaf 7349->7361 7350->7351 7353 c3aaaf 28 API calls 7350->7353 7351->7344 7355 c3b5c7 7353->7355 7354 c3b5a7 7370 c3c3b2 7354->7370 7357 c3c3b2 _free 14 API calls 7355->7357 7357->7351 7398 c3c511 LeaveCriticalSection 7358->7398 7360 c3b51b 7360->7332 7362 c3aad7 7361->7362 7363 c3aabc 7361->7363 7365 c3aae6 7362->7365 7379 c3c3ec 7362->7379 7363->7362 7364 c3aac8 7363->7364 7376 c3aa81 7364->7376 7386 c3c41f 7365->7386 7369 c3aacd ___scrt_fastfail 7369->7354 7371 c3c3e6 _free 7370->7371 7372 c3c3bd HeapFree 7370->7372 7371->7350 7372->7371 7373 c3c3d2 7372->7373 7374 c3aa81 _free 12 API calls 7373->7374 7375 c3c3d8 GetLastError 7374->7375 7375->7371 7377 c3c2b7 __dosmaperr 14 API calls 7376->7377 7378 c3aa86 7377->7378 7378->7369 7380 c3c3f7 7379->7380 7381 c3c40c HeapSize 7379->7381 7382 c3aa81 _free 14 API calls 7380->7382 7381->7365 7383 c3c3fc 7382->7383 7384 c3a9c4 __fassign 25 API calls 7383->7384 7385 c3c407 7384->7385 7385->7365 7387 c3c437 7386->7387 7388 c3c42c 7386->7388 7390 c3c43f 7387->7390 7396 c3c448 __dosmaperr 7387->7396 7389 c3e8b4 15 API calls 7388->7389 7395 c3c434 7389->7395 7391 c3c3b2 _free 14 API calls 7390->7391 7391->7395 7392 c3c472 HeapReAlloc 7392->7395 7392->7396 7393 c3c44d 7394 c3aa81 _free 14 API calls 7393->7394 7394->7395 7395->7369 7396->7392 7396->7393 7397 c3db39 __dosmaperr EnterCriticalSection LeaveCriticalSection 7396->7397 7397->7396 7398->7360 7400 c36bd9 7399->7400 7402 c36e60 7401->7402 7404 c36e83 ___scrt_uninitialize_crt 7401->7404 7403 c3aa81 _free 14 API calls 7402->7403 7405 c36e69 ___scrt_fastfail 7402->7405 7403->7405 7404->7274 7405->7404 7406 c3aa81 14 API calls _free 7405->7406 7406->7405 7409 c3714a 7407->7409 7411 c37153 LeaveCriticalSection 7407->7411 7409->7411 7422 c3710c 7409->7422 7411->7288 7413 c362ff LockResource 7412->7413 7415 c3631f 7412->7415 7414 c3630c SizeofResource 7413->7414 7413->7415 7414->7415 7415->7288 7417 c36ee3 7416->7417 7418 c36f12 7416->7418 7419 c362e9 3 API calls 7417->7419 7418->7284 7420 c36ef0 7419->7420 7420->7418 7434 c3a704 7420->7434 7423 c37116 7422->7423 7424 c3711b 7423->7424 7432 c36250 RaiseException 7423->7432 7424->7411 7429 c3714a 7430 c3710c RaiseException 7429->7430 7431 c37153 LeaveCriticalSection 7429->7431 7430->7431 7431->7411 7433 c36264 EnterCriticalSection 7432->7433 7433->7429 7433->7431 7435 c3a715 7434->7435 7438 c3a711 ___scrt_uninitialize_crt 7434->7438 7436 c3a71c 7435->7436 7440 c3a72f _wmemset 7435->7440 7437 c3aa81 _free 14 API calls 7436->7437 7439 c3a721 7437->7439 7438->7418 7448 c3a9c4 7439->7448 7440->7438 7442 c3a760 7440->7442 7444 c3a769 7440->7444 7443 c3aa81 _free 14 API calls 7442->7443 7445 c3a765 7443->7445 7444->7438 7446 c3aa81 _free 14 API calls 7444->7446 7447 c3a9c4 __fassign 25 API calls 7445->7447 7446->7445 7447->7438 7451 c3a960 7448->7451 7450 c3a9d0 7450->7438 7459 c3c2b7 GetLastError 7451->7459 7453 c3a96b 7454 c3a979 7453->7454 7482 c3a9d4 IsProcessorFeaturePresent 7453->7482 7454->7450 7456 c3a9c3 7457 c3a960 __fassign 25 API calls 7456->7457 7458 c3a9d0 7457->7458 7458->7450 7460 c3c2d4 7459->7460 7461 c3c2ce 7459->7461 7479 c3c2da SetLastError 7460->7479 7491 c3d704 7460->7491 7486 c3d6c5 7461->7486 7468 c3c321 7470 c3d704 __dosmaperr 6 API calls 7468->7470 7469 c3c30a 7471 c3d704 __dosmaperr 6 API calls 7469->7471 7472 c3c32d 7470->7472 7473 c3c318 7471->7473 7474 c3c342 7472->7474 7475 c3c331 7472->7475 7478 c3c3b2 _free 12 API calls 7473->7478 7503 c3bf8e 7474->7503 7476 c3d704 __dosmaperr 6 API calls 7475->7476 7476->7473 7478->7479 7479->7453 7481 c3c3b2 _free 12 API calls 7481->7479 7483 c3a9e0 7482->7483 7531 c3a818 7483->7531 7508 c3d584 7486->7508 7488 c3d6e1 7489 c3d6ea 7488->7489 7490 c3d6fc TlsGetValue 7488->7490 7489->7460 7492 c3d584 __dosmaperr 5 API calls 7491->7492 7493 c3d720 7492->7493 7494 c3c2f2 7493->7494 7495 c3d73e TlsSetValue 7493->7495 7494->7479 7496 c3c559 7494->7496 7502 c3c566 __dosmaperr 7496->7502 7497 c3c5a6 7499 c3aa81 _free 13 API calls 7497->7499 7498 c3c591 HeapAlloc 7500 c3c302 7498->7500 7498->7502 7499->7500 7500->7468 7500->7469 7502->7497 7502->7498 7514 c3db39 7502->7514 7517 c3be22 7503->7517 7509 c3d5b2 7508->7509 7513 c3d5ae __dosmaperr 7508->7513 7510 c3d4bd __dosmaperr LoadLibraryExW GetLastError LoadLibraryExW FreeLibrary 7509->7510 7509->7513 7511 c3d5c6 7510->7511 7512 c3d5cc GetProcAddress 7511->7512 7511->7513 7512->7513 7513->7488 7515 c3db66 __dosmaperr EnterCriticalSection LeaveCriticalSection 7514->7515 7516 c3db44 7515->7516 7516->7502 7518 c3be2e ___scrt_is_nonwritable_in_current_image 7517->7518 7519 c3c4c9 __fassign EnterCriticalSection 7518->7519 7520 c3be38 7519->7520 7521 c3be68 __dosmaperr LeaveCriticalSection 7520->7521 7522 c3be56 7521->7522 7523 c3bf34 7522->7523 7524 c3bf40 ___scrt_is_nonwritable_in_current_image 7523->7524 7525 c3c4c9 __fassign EnterCriticalSection 7524->7525 7526 c3bf4a 7525->7526 7527 c3c115 __dosmaperr 14 API calls 7526->7527 7528 c3bf62 7527->7528 7529 c3bf82 __dosmaperr LeaveCriticalSection 7528->7529 7530 c3bf70 7529->7530 7530->7481 7532 c3a834 ___scrt_fastfail 7531->7532 7533 c3a860 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7532->7533 7536 c3a931 ___scrt_fastfail 7533->7536 7535 c3a94f GetCurrentProcess TerminateProcess 7535->7456 7537 c37198 7536->7537 7538 c371a3 IsProcessorFeaturePresent 7537->7538 7539 c371a1 7537->7539 7541 c37877 7538->7541 7539->7535 7542 c3783b ___raise_securityfailure SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 7541->7542 7543 c3795a 7542->7543 7543->7535 7545 c3a7c1 7544->7545 7546 c3a7cf 7544->7546 7545->7546 7550 c3a7e8 7545->7550 7547 c3aa81 _free 14 API calls 7546->7547 7552 c3a7d9 7547->7552 7548 c3a9c4 __fassign 25 API calls 7549 c368c0 PathAppendW 7548->7549 7549->7222 7549->7227 7550->7549 7551 c3aa81 _free 14 API calls 7550->7551 7551->7552 7552->7548 7554 c365fc 7553->7554 7556 c36622 7553->7556 7555 c36603 GetFileAttributesExW 7554->7555 7554->7556 7555->7556 7557 c37198 _ValidateLocalCookies 5 API calls 7556->7557 7558 c3662f 7557->7558 7558->7232 7558->7233 7560 c367d5 7559->7560 7562 c367c9 7559->7562 7561 c367ed SHQueryValueExW 7560->7561 7561->7562 7562->7240 7564 c3addb 7563->7564 7565 c3aded 7563->7565 7566 c37aaf __fassign GetModuleHandleW 7564->7566 7575 c3ac74 7565->7575 7568 c3ade0 7566->7568 7568->7565 7591 c3ae73 GetModuleHandleExW 7568->7591 7569 c37825 7569->7112 7574 c3ae30 7576 c3ac80 ___scrt_is_nonwritable_in_current_image 7575->7576 7597 c3c4c9 EnterCriticalSection 7576->7597 7578 c3ac8a 7598 c3ace0 7578->7598 7580 c3ac97 7602 c3acb5 7580->7602 7583 c3ae31 7626 c3c528 GetPEB 7583->7626 7586 c3ae60 7589 c3ae73 __fassign 3 API calls 7586->7589 7587 c3ae40 GetPEB 7587->7586 7588 c3ae50 GetCurrentProcess TerminateProcess 7587->7588 7588->7586 7590 c3ae68 ExitProcess 7589->7590 7592 c3ae92 GetProcAddress 7591->7592 7593 c3aeb5 7591->7593 7596 c3aea7 7592->7596 7594 c3adec 7593->7594 7595 c3aebb FreeLibrary 7593->7595 7594->7565 7595->7594 7596->7593 7597->7578 7599 c3acec ___scrt_is_nonwritable_in_current_image 7598->7599 7600 c3ad4d __fassign 7599->7600 7605 c3b757 7599->7605 7600->7580 7625 c3c511 LeaveCriticalSection 7602->7625 7604 c3aca3 7604->7569 7604->7583 7608 c3b488 7605->7608 7609 c3b494 ___scrt_is_nonwritable_in_current_image 7608->7609 7616 c3c4c9 EnterCriticalSection 7609->7616 7611 c3b4a2 7617 c3b667 7611->7617 7616->7611 7618 c3b4af 7617->7618 7619 c3b686 7617->7619 7621 c3b4d7 7618->7621 7619->7618 7620 c3c3b2 _free 14 API calls 7619->7620 7620->7618 7624 c3c511 LeaveCriticalSection 7621->7624 7623 c3b4c0 7623->7600 7624->7623 7625->7604 7627 c3c542 7626->7627 7628 c3ae3b 7626->7628 7630 c3d607 7627->7630 7628->7586 7628->7587 7631 c3d584 __dosmaperr 5 API calls 7630->7631 7632 c3d623 7631->7632 7632->7628 7634 c3c17d 7633->7634 7635 c3c177 7633->7635 7636 c3d704 __dosmaperr 6 API calls 7634->7636 7658 c3c183 SetLastError 7634->7658 7637 c3d6c5 __dosmaperr 6 API calls 7635->7637 7638 c3c19b 7636->7638 7637->7634 7639 c3c559 __dosmaperr 14 API calls 7638->7639 7638->7658 7641 c3c1ab 7639->7641 7642 c3c1b3 7641->7642 7643 c3c1ca 7641->7643 7647 c3d704 __dosmaperr 6 API calls 7642->7647 7646 c3d704 __dosmaperr 6 API calls 7643->7646 7644 c3bc0b 7660 c3bc95 7644->7660 7645 c3c217 7648 c3bc95 __fassign 64 API calls 7645->7648 7650 c3c1d6 7646->7650 7653 c3c1c1 7647->7653 7649 c3c21c 7648->7649 7651 c3c1eb 7650->7651 7652 c3c1da 7650->7652 7655 c3bf8e __dosmaperr 14 API calls 7651->7655 7654 c3d704 __dosmaperr 6 API calls 7652->7654 7656 c3c3b2 _free 14 API calls 7653->7656 7654->7653 7657 c3c1f6 7655->7657 7656->7658 7659 c3c3b2 _free 14 API calls 7657->7659 7658->7644 7658->7645 7659->7658 7671 c3dc90 7660->7671 7664 c3bcce 7666 c3aef3 __fassign 23 API calls 7664->7666 7665 c3bcaf IsProcessorFeaturePresent 7668 c3bcbb 7665->7668 7669 c3bcd8 7666->7669 7667 c3bca5 7667->7664 7667->7665 7670 c3a818 __fassign 8 API calls 7668->7670 7670->7664 7707 c3dbc2 7671->7707 7674 c3dcde 7675 c3dcea ___scrt_is_nonwritable_in_current_image 7674->7675 7676 c3c2b7 __dosmaperr 14 API calls 7675->7676 7680 c3dd17 __fassign 7675->7680 7681 c3dd11 __fassign 7675->7681 7676->7681 7677 c3dd5c 7678 c3aa81 _free 14 API calls 7677->7678 7679 c3dd61 7678->7679 7682 c3a9c4 __fassign 25 API calls 7679->7682 7684 c3dd88 7680->7684 7718 c3c4c9 EnterCriticalSection 7680->7718 7681->7677 7681->7680 7702 c3dd46 7681->7702 7682->7702 7686 c3ddd0 7684->7686 7687 c3dec5 7684->7687 7697 c3ddfb 7684->7697 7686->7697 7719 c3dcd5 7686->7719 7689 c3ded0 7687->7689 7726 c3c511 LeaveCriticalSection 7687->7726 7691 c3aef3 __fassign 23 API calls 7689->7691 7696 c3ded8 ___scrt_is_nonwritable_in_current_image 7691->7696 7693 c3c160 __fassign 66 API calls 7699 c3de4f 7693->7699 7695 c3dcd5 __fassign 66 API calls 7695->7697 7727 c3e280 EnterCriticalSection 7696->7727 7722 c3de71 7697->7722 7701 c3c160 __fassign 66 API calls 7699->7701 7699->7702 7700 c3deef ___scrt_uninitialize_crt 7706 c3df28 7700->7706 7728 c3e11b 7700->7728 7701->7702 7702->7667 7738 c3df59 7706->7738 7708 c3dbce ___scrt_is_nonwritable_in_current_image 7707->7708 7713 c3c4c9 EnterCriticalSection 7708->7713 7710 c3dbdc 7714 c3dc1a 7710->7714 7713->7710 7717 c3c511 LeaveCriticalSection 7714->7717 7716 c3bc9a 7716->7667 7716->7674 7717->7716 7718->7684 7720 c3c160 __fassign 66 API calls 7719->7720 7721 c3dcda 7720->7721 7721->7695 7723 c3de40 7722->7723 7724 c3de77 7722->7724 7723->7693 7723->7699 7723->7702 7741 c3c511 LeaveCriticalSection 7724->7741 7726->7689 7727->7700 7729 c3e131 7728->7729 7730 c3e128 7728->7730 7745 c3e0b6 7729->7745 7742 c3e011 7730->7742 7734 c3e12e 7734->7706 7736 c3e14d 7758 c3fc60 7736->7758 8011 c3e294 LeaveCriticalSection 7738->8011 7740 c3df47 7740->7667 7741->7723 7769 c3df65 7742->7769 7746 c3e0ce 7745->7746 7750 c3e0f3 7745->7750 7747 c3f409 ___scrt_uninitialize_crt 25 API calls 7746->7747 7746->7750 7748 c3e0ec 7747->7748 7791 c40456 7748->7791 7750->7734 7751 c3f409 7750->7751 7752 c3f415 7751->7752 7753 c3f42a 7751->7753 7754 c3aa81 _free 14 API calls 7752->7754 7753->7736 7755 c3f41a 7754->7755 7756 c3a9c4 __fassign 25 API calls 7755->7756 7757 c3f425 7756->7757 7757->7736 7759 c3fc71 7758->7759 7761 c3fc7e 7758->7761 7760 c3aa81 _free 14 API calls 7759->7760 7768 c3fc76 7760->7768 7762 c3fcc7 7761->7762 7765 c3fca5 7761->7765 7763 c3aa81 _free 14 API calls 7762->7763 7764 c3fccc 7763->7764 7766 c3a9c4 __fassign 25 API calls 7764->7766 7992 c3fbbe 7765->7992 7766->7768 7768->7734 7770 c3df71 ___scrt_is_nonwritable_in_current_image 7769->7770 7777 c3c4c9 EnterCriticalSection 7770->7777 7772 c3dfe7 7786 c3e005 7772->7786 7775 c3df7b ___scrt_uninitialize_crt 7775->7772 7778 c3ded9 7775->7778 7777->7775 7779 c3dee5 ___scrt_is_nonwritable_in_current_image 7778->7779 7789 c3e280 EnterCriticalSection 7779->7789 7781 c3deef ___scrt_uninitialize_crt 7784 c3e11b ___scrt_uninitialize_crt 66 API calls 7781->7784 7785 c3df28 7781->7785 7782 c3df59 ___scrt_uninitialize_crt LeaveCriticalSection 7783 c3df47 7782->7783 7783->7775 7784->7785 7785->7782 7790 c3c511 LeaveCriticalSection 7786->7790 7788 c3dff3 7788->7734 7789->7781 7790->7788 7792 c40462 ___scrt_is_nonwritable_in_current_image 7791->7792 7793 c40482 7792->7793 7794 c4046a 7792->7794 7795 c4051d 7793->7795 7801 c404b4 7793->7801 7816 c3aa6e 7794->7816 7797 c3aa6e __dosmaperr 14 API calls 7795->7797 7800 c40522 7797->7800 7799 c3aa81 _free 14 API calls 7804 c40477 7799->7804 7802 c3aa81 _free 14 API calls 7800->7802 7819 c3e4cc EnterCriticalSection 7801->7819 7805 c4052a 7802->7805 7804->7750 7807 c3a9c4 __fassign 25 API calls 7805->7807 7806 c404ba 7808 c404d6 7806->7808 7809 c404eb 7806->7809 7807->7804 7810 c3aa81 _free 14 API calls 7808->7810 7820 c40548 7809->7820 7812 c404db 7810->7812 7814 c3aa6e __dosmaperr 14 API calls 7812->7814 7813 c404e6 7862 c40515 7813->7862 7814->7813 7817 c3c2b7 __dosmaperr 14 API calls 7816->7817 7818 c3aa73 7817->7818 7818->7799 7819->7806 7821 c4056a 7820->7821 7858 c40586 7820->7858 7822 c4056e 7821->7822 7825 c405be 7821->7825 7823 c3aa6e __dosmaperr 14 API calls 7822->7823 7824 c40573 7823->7824 7826 c3aa81 _free 14 API calls 7824->7826 7827 c405d1 7825->7827 7865 c40c36 7825->7865 7830 c4057b 7826->7830 7868 c400ef 7827->7868 7832 c3a9c4 __fassign 25 API calls 7830->7832 7832->7858 7833 c40626 7837 c4067f WriteFile 7833->7837 7838 c4063a 7833->7838 7834 c405e7 7835 c40610 7834->7835 7836 c405eb 7834->7836 7880 c3fcdd GetConsoleCP 7835->7880 7847 c40606 7836->7847 7875 c40087 7836->7875 7842 c406a3 GetLastError 7837->7842 7837->7847 7839 c40645 7838->7839 7840 c4066f 7838->7840 7843 c4065f 7839->7843 7844 c4064a 7839->7844 7908 c40160 7840->7908 7842->7847 7900 c40324 7843->7900 7844->7847 7893 c4023b 7844->7893 7849 c406f3 7847->7849 7850 c406c9 7847->7850 7847->7858 7856 c3aa81 _free 14 API calls 7849->7856 7849->7858 7852 c406e7 7850->7852 7853 c406d0 7850->7853 7915 c3aa4b 7852->7915 7854 c3aa81 _free 14 API calls 7853->7854 7857 c406d5 7854->7857 7859 c4070b 7856->7859 7861 c3aa6e __dosmaperr 14 API calls 7857->7861 7858->7813 7860 c3aa6e __dosmaperr 14 API calls 7859->7860 7860->7858 7861->7858 7991 c3e4ef LeaveCriticalSection 7862->7991 7864 c4051b 7864->7804 7920 c40bba 7865->7920 7942 c40815 7868->7942 7870 c40100 7871 c40156 7870->7871 7872 c3c160 __fassign 65 API calls 7870->7872 7871->7833 7871->7834 7873 c40123 7872->7873 7873->7871 7874 c4013d GetConsoleMode 7873->7874 7874->7871 7876 c400de 7875->7876 7878 c400a9 7875->7878 7876->7847 7877 c40c51 5 API calls ___scrt_uninitialize_crt 7877->7878 7878->7876 7878->7877 7879 c400e0 GetLastError 7878->7879 7879->7876 7951 c3bce4 7880->7951 7882 c37198 _ValidateLocalCookies 5 API calls 7884 c40085 7882->7884 7884->7847 7885 c3ffd9 7885->7882 7886 c3fd39 ___scrt_uninitialize_crt 7886->7885 7887 c3f395 62 API calls __fassign 7886->7887 7890 c3ff5c WriteFile 7886->7890 7892 c3ff94 WriteFile 7886->7892 7959 c40a84 7886->7959 7969 c3e890 7886->7969 7974 c3d355 7886->7974 7887->7886 7890->7886 7891 c40055 GetLastError 7890->7891 7891->7885 7892->7886 7892->7891 7894 c4024a ___scrt_uninitialize_crt 7893->7894 7895 c40309 7894->7895 7896 c402bf WriteFile 7894->7896 7897 c37198 _ValidateLocalCookies 5 API calls 7895->7897 7896->7894 7898 c4030b GetLastError 7896->7898 7899 c40322 7897->7899 7898->7895 7899->7847 7907 c40333 ___scrt_uninitialize_crt 7900->7907 7901 c4043b 7902 c37198 _ValidateLocalCookies 5 API calls 7901->7902 7903 c40454 7902->7903 7903->7847 7904 c3d355 ___scrt_uninitialize_crt WideCharToMultiByte 7904->7907 7905 c4043d GetLastError 7905->7901 7906 c403f2 WriteFile 7906->7905 7906->7907 7907->7901 7907->7904 7907->7905 7907->7906 7913 c4016f ___scrt_uninitialize_crt 7908->7913 7909 c40220 7910 c37198 _ValidateLocalCookies 5 API calls 7909->7910 7911 c40239 7910->7911 7911->7847 7912 c401df WriteFile 7912->7913 7914 c40222 GetLastError 7912->7914 7913->7909 7913->7912 7914->7909 7916 c3aa6e __dosmaperr 14 API calls 7915->7916 7917 c3aa56 _free 7916->7917 7918 c3aa81 _free 14 API calls 7917->7918 7919 c3aa69 7918->7919 7919->7858 7929 c3e5a3 7920->7929 7922 c40bcc 7923 c40bd4 7922->7923 7924 c40be5 SetFilePointerEx 7922->7924 7925 c3aa81 _free 14 API calls 7923->7925 7926 c40bfd GetLastError 7924->7926 7928 c40bd9 7924->7928 7925->7928 7927 c3aa4b __dosmaperr 14 API calls 7926->7927 7927->7928 7928->7827 7930 c3e5b0 7929->7930 7931 c3e5c5 7929->7931 7932 c3aa6e __dosmaperr 14 API calls 7930->7932 7934 c3aa6e __dosmaperr 14 API calls 7931->7934 7936 c3e5ea 7931->7936 7933 c3e5b5 7932->7933 7935 c3aa81 _free 14 API calls 7933->7935 7937 c3e5f5 7934->7937 7939 c3e5bd 7935->7939 7936->7922 7938 c3aa81 _free 14 API calls 7937->7938 7940 c3e5fd 7938->7940 7939->7922 7941 c3a9c4 __fassign 25 API calls 7940->7941 7941->7939 7943 c40822 7942->7943 7945 c4082f 7942->7945 7944 c3aa81 _free 14 API calls 7943->7944 7946 c40827 7944->7946 7947 c4083b 7945->7947 7948 c3aa81 _free 14 API calls 7945->7948 7946->7870 7947->7870 7949 c4085c 7948->7949 7950 c3a9c4 __fassign 25 API calls 7949->7950 7950->7946 7952 c3bd04 7951->7952 7958 c3bcfb 7951->7958 7953 c3c160 __fassign 66 API calls 7952->7953 7952->7958 7954 c3bd24 7953->7954 7977 c3f3af 7954->7977 7958->7886 7963 c40a9d ___scrt_uninitialize_crt 7959->7963 7964 c40b39 ___scrt_uninitialize_crt 7959->7964 7961 c40d7e __fassign 19 API calls 7961->7964 7962 c40b24 7968 c3aa81 _free 14 API calls 7962->7968 7963->7962 7966 c40b0f 7963->7966 7985 c40d7e 7963->7985 7964->7961 7965 c40b69 7964->7965 7964->7966 7967 c3aa81 _free 14 API calls 7965->7967 7966->7886 7967->7966 7968->7966 7970 c3c160 __fassign 66 API calls 7969->7970 7971 c3e89b 7970->7971 7972 c3f3af __fassign 66 API calls 7971->7972 7973 c3e8ab 7972->7973 7973->7886 7976 c3d36e WideCharToMultiByte 7974->7976 7976->7886 7978 c3f3c2 7977->7978 7979 c3bd3a 7977->7979 7978->7979 7980 c3ed3c __fassign 66 API calls 7978->7980 7981 c3f3dc 7979->7981 7980->7979 7982 c3f404 7981->7982 7983 c3f3ef 7981->7983 7982->7958 7983->7982 7984 c3d039 __fassign 66 API calls 7983->7984 7984->7982 7990 c40da5 7985->7990 7986 c37198 _ValidateLocalCookies 5 API calls 7987 c40f23 7986->7987 7987->7963 7988 c40dca 7988->7986 7989 c40b7f __fassign 14 API calls 7989->7988 7990->7988 7990->7989 7991->7864 7993 c3fbca ___scrt_is_nonwritable_in_current_image 7992->7993 8006 c3e4cc EnterCriticalSection 7993->8006 7995 c3fc20 7998 c3aa81 _free 14 API calls 7995->7998 7996 c3fbd9 7996->7995 7997 c3e5a3 ___scrt_uninitialize_crt 25 API calls 7996->7997 7999 c3fc05 FlushFileBuffers 7997->7999 8000 c3fc25 7998->8000 7999->8000 8001 c3fc11 7999->8001 8007 c3fc54 8000->8007 8003 c3aa6e __dosmaperr 14 API calls 8001->8003 8005 c3fc16 GetLastError 8003->8005 8005->7995 8006->7996 8010 c3e4ef LeaveCriticalSection 8007->8010 8009 c3fc3d 8009->7768 8010->8009 8011->7740 8013 c3b8f8 8012->8013 8015 c3b90a ___scrt_uninitialize_crt 8012->8015 8014 c3b906 8013->8014 8017 c3e163 8013->8017 8014->7106 8015->7106 8018 c3e011 ___scrt_uninitialize_crt 66 API calls 8017->8018 8019 c3e16a 8018->8019 8019->8014

                                                                                        Executed Functions

                                                                                        Function 00C369C8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00C369D6
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 00C369DD
                                                                                        • LoadLibraryExW.KERNELBASE(?,00000000,00000000), ref: 00C36A1C
                                                                                        • GetProcAddress.KERNEL32(00000000,DllEntry), ref: 00C36A37
                                                                                        • GetCommandLineW.KERNEL32(?), ref: 00C36A46
                                                                                        • FreeLibrary.KERNELBASE(00000000), ref: 00C36A59
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressLibraryProc$CommandFreeHandleLineLoadModule
                                                                                        • String ID: DllEntry$SetDefaultDllDirectories$kernel32.dll
                                                                                        • API String ID: 1042781669-3472957018
                                                                                        • Opcode ID: 01ae1bc6c209d5098f0306f49ff6f032e70230687fb8e4d11014db470350add1
                                                                                        • Instruction ID: e5dda214a9f592e56840a59b5636200e9b641c949c6009982b930ce729e28325
                                                                                        • Opcode Fuzzy Hash: 01ae1bc6c209d5098f0306f49ff6f032e70230687fb8e4d11014db470350add1
                                                                                        • Instruction Fuzzy Hash: 96112B36950219BBC720E7A0DC0AB6E7BA8AF07754F10C024F902F72A0DF708D00A7A1
                                                                                        Function 00C3AE31 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 139 c3ae31-c3ae3e call c3c528 142 c3ae60-c3ae6c call c3ae73 ExitProcess 139->142 143 c3ae40-c3ae4e GetPEB 139->143 143->142 144 c3ae50-c3ae5a GetCurrentProcess TerminateProcess 143->144 144->142
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(?,?,00C3AE30,?,?,?,?,?,00C405E2), ref: 00C3AE53
                                                                                        • TerminateProcess.KERNEL32(00000000,?,00C3AE30,?,?,?,?,?,00C405E2), ref: 00C3AE5A
                                                                                        • ExitProcess.KERNEL32 ref: 00C3AE6C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                        • String ID:
                                                                                        • API String ID: 1703294689-0
                                                                                        • Opcode ID: faf610ca7c4f753eede018e0059477b3e26d51326238a78be0192104508198d1
                                                                                        • Instruction ID: a823ba2cc5e32a4cb96aefa58c41abde4b1fce77db4501aed591b45ca49d9c53
                                                                                        • Opcode Fuzzy Hash: faf610ca7c4f753eede018e0059477b3e26d51326238a78be0192104508198d1
                                                                                        • Instruction Fuzzy Hash: 6CE08C36010208AFCF116FA4CC08B0D3F6AFB02742F008414F91586131CB36EE61DB86
                                                                                        Function 00C36836 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00C3688B
                                                                                        • PathRemoveFileSpecW.SHLWAPI(?,?,?,00000104), ref: 00C368A6
                                                                                        • PathAppendW.SHLWAPI(?,swupdater.dll,?,?,00000104), ref: 00C368D5
                                                                                          • Part of subcall function 00C365CA: GetLastError.KERNEL32(00C3689A,?,?,00000104), ref: 00C365CA
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FilePath$AppendErrorLastModuleNameRemoveSpec
                                                                                        • String ID: swupdater.dll
                                                                                        • API String ID: 3739599460-2098814528
                                                                                        • Opcode ID: 21eb4ec96e4370cd6c4cf2cf6756e275321408780361fcb1ef64d2dee7ddc9f4
                                                                                        • Instruction ID: 9a862271929948b54bdfbe443c0f39c5dc45ac1ec0b98a9b1e36958e3f526580
                                                                                        • Opcode Fuzzy Hash: 21eb4ec96e4370cd6c4cf2cf6756e275321408780361fcb1ef64d2dee7ddc9f4
                                                                                        • Instruction Fuzzy Hash: 1D4181F592031CAACF20EB64DC49FDE77BC9B45304F1081B5A505E3142EA71AF899B65
                                                                                        Function 00C36631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,00000104), ref: 00C36663
                                                                                        • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00000000,00000104,?,?,00000000), ref: 00C36726
                                                                                          • Part of subcall function 00C36D27: FindResourceExW.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,00000000,?,?,00C366BC,-00000010), ref: 00C36D58
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileFindFolderModuleNamePathResource
                                                                                        • String ID: h=
                                                                                        • API String ID: 2248019921-293419298
                                                                                        • Opcode ID: 3ce36e09dd9d53351fe1d8e4ee677a8808f408df32223fa67430f35a27720705
                                                                                        • Instruction ID: e7b7ef341d7e82021b52a6230aeae4c8e7d9fb92585f3a6c4c4d63fa738c9bcb
                                                                                        • Opcode Fuzzy Hash: 3ce36e09dd9d53351fe1d8e4ee677a8808f408df32223fa67430f35a27720705
                                                                                        • Instruction Fuzzy Hash: B1416D71D20119BBCB04EBA5C9969FEB778AF41344F50C169A912A7291EB309F04EB90
                                                                                        Function 00C36798 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 126 c36798-c367c7 RegOpenKeyExW 127 c367d5-c3680d call c36ba8 SHQueryValueExW call c36ac0 126->127 128 c367c9 126->128 134 c36812-c36814 127->134 129 c36832-c36835 128->129 130 c367cb-c367d3 128->130 130->129 135 c36816 134->135 136 c36825-c3682d 134->136 137 c36821-c36823 135->137 138 c36818-c3681b 135->138 136->129 137->129 138->137
                                                                                        APIs
                                                                                        • RegOpenKeyExW.KERNELBASE(?,Software\Wavesor\SWUpdater\Clients\{F6F60ACE-71AD-4610-80D4-9253729FB4B7},00000000,00020019,?,?,?), ref: 00C367BF
                                                                                        • SHQueryValueExW.SHLWAPI(?,00C35C84,00000000,?,00000000,?,00000032,?,?), ref: 00C36802
                                                                                        Strings
                                                                                        • Software\Wavesor\SWUpdater\Clients\{F6F60ACE-71AD-4610-80D4-9253729FB4B7}, xrefs: 00C367B1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: OpenQueryValue
                                                                                        • String ID: Software\Wavesor\SWUpdater\Clients\{F6F60ACE-71AD-4610-80D4-9253729FB4B7}
                                                                                        • API String ID: 4153817207-798717047
                                                                                        • Opcode ID: f86148b1fdac95532b0c179b0760fe85c71e16b7ef1d1571c5c906828277a605
                                                                                        • Instruction ID: c2c6e5b4d15c418331c3992d024ffa8a5a9f6791f6391de7115c4cfdff2a64bc
                                                                                        • Opcode Fuzzy Hash: f86148b1fdac95532b0c179b0760fe85c71e16b7ef1d1571c5c906828277a605
                                                                                        • Instruction Fuzzy Hash: E911A976D50229BB9B209BA9DC05EBFBFB8FB45714F108265B811E71C1D6348B00DBE1

                                                                                        Non-executed Functions

                                                                                        Function 00C371D0 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 234 c371d0-c371f1 InitializeCriticalSectionAndSpinCount GetModuleHandleW 235 c371f3-c37202 GetModuleHandleW 234->235 236 c37204-c37220 GetProcAddress * 2 234->236 235->236 237 c3724a-c37264 call c3795c DeleteCriticalSection 235->237 238 c37222-c37224 236->238 239 c37234-c37248 CreateEventW 236->239 244 c37266-c37267 CloseHandle 237->244 245 c3726d 237->245 238->239 242 c37226-c3722c 238->242 239->237 240 c37231-c37233 239->240 242->240 244->245
                                                                                        APIs
                                                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(00C448D4,00000FA0,?,?,00C371AE), ref: 00C371DC
                                                                                        • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00C371AE), ref: 00C371E7
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00C371AE), ref: 00C371F8
                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00C3720A
                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00C37218
                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00C371AE), ref: 00C3723B
                                                                                        • ___scrt_fastfail.LIBCMT ref: 00C3724C
                                                                                        • DeleteCriticalSection.KERNEL32(00C448D4,00000007,?,?,00C371AE), ref: 00C37257
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00C371AE), ref: 00C37267
                                                                                        Strings
                                                                                        • WakeAllConditionVariable, xrefs: 00C37210
                                                                                        • SleepConditionVariableCS, xrefs: 00C37204
                                                                                        • kernel32.dll, xrefs: 00C371F3
                                                                                        • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00C371E2
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
                                                                                        • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                        • API String ID: 3578986977-3242537097
                                                                                        • Opcode ID: 5a2d9302b200ce98038794ccb8f55dffd9c6003d22b293b58a0ec1ec57a9e6d9
                                                                                        • Instruction ID: c839d6264a0f0389567b958d99a6ea046e981704412898747a83744c91d2f36f
                                                                                        • Opcode Fuzzy Hash: 5a2d9302b200ce98038794ccb8f55dffd9c6003d22b293b58a0ec1ec57a9e6d9
                                                                                        • Instruction Fuzzy Hash: 6C01D4F8655391AFDB345B71BC0DF6F3698BB43B11F140221FD15E2294DB61C8048B61
                                                                                        Function 00C3EAF0 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 246 c3eaf0-c3eb04 247 c3eb72-c3eb7a 246->247 248 c3eb06-c3eb0b 246->248 250 c3ebc1-c3ebd9 call c3ec61 247->250 251 c3eb7c-c3eb7f 247->251 248->247 249 c3eb0d-c3eb12 248->249 249->247 252 c3eb14-c3eb17 249->252 260 c3ebdc-c3ebe3 250->260 251->250 254 c3eb81-c3ebbe call c3c3b2 * 4 251->254 252->247 255 c3eb19-c3eb21 252->255 254->250 258 c3eb23-c3eb26 255->258 259 c3eb3b-c3eb43 255->259 258->259 262 c3eb28-c3eb3a call c3c3b2 call c3e60d 258->262 265 c3eb45-c3eb48 259->265 266 c3eb5d-c3eb71 call c3c3b2 * 2 259->266 263 c3ec02-c3ec06 260->263 264 c3ebe5-c3ebe9 260->264 262->259 268 c3ec08-c3ec0d 263->268 269 c3ec1e-c3ec2a 263->269 272 c3ebeb-c3ebee 264->272 273 c3ebff 264->273 265->266 274 c3eb4a-c3eb5c call c3c3b2 call c3e70b 265->274 266->247 276 c3ec1b 268->276 277 c3ec0f-c3ec12 268->277 269->260 279 c3ec2c-c3ec37 call c3c3b2 269->279 272->273 281 c3ebf0-c3ebfe call c3c3b2 * 2 272->281 273->263 274->266 276->269 277->276 286 c3ec14-c3ec1a call c3c3b2 277->286 281->273 286->276
                                                                                        APIs
                                                                                        • ___free_lconv_mon.LIBCMT ref: 00C3EB34
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E62A
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E63C
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E64E
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E660
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E672
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E684
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E696
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E6A8
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E6BA
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E6CC
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E6DE
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E6F0
                                                                                          • Part of subcall function 00C3E60D: _free.LIBCMT ref: 00C3E702
                                                                                        • _free.LIBCMT ref: 00C3EB29
                                                                                          • Part of subcall function 00C3C3B2: HeapFree.KERNEL32(00000000,00000000,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?), ref: 00C3C3C8
                                                                                          • Part of subcall function 00C3C3B2: GetLastError.KERNEL32(?,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?,?), ref: 00C3C3DA
                                                                                        • _free.LIBCMT ref: 00C3EB4B
                                                                                        • _free.LIBCMT ref: 00C3EB60
                                                                                        • _free.LIBCMT ref: 00C3EB6B
                                                                                        • _free.LIBCMT ref: 00C3EB8D
                                                                                        • _free.LIBCMT ref: 00C3EBA0
                                                                                        • _free.LIBCMT ref: 00C3EBAE
                                                                                        • _free.LIBCMT ref: 00C3EBB9
                                                                                        • _free.LIBCMT ref: 00C3EBF1
                                                                                        • _free.LIBCMT ref: 00C3EBF8
                                                                                        • _free.LIBCMT ref: 00C3EC15
                                                                                        • _free.LIBCMT ref: 00C3EC2D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                        • String ID:
                                                                                        • API String ID: 161543041-0
                                                                                        • Opcode ID: 849698d9a8fd3caf8809a37135c85c2f34a91de5581f7ababa397128084b6c0d
                                                                                        • Instruction ID: 8b7ae999b69f237d2953567b050a6633ae90db2cf43f779d6d0025fe920dd0c7
                                                                                        • Opcode Fuzzy Hash: 849698d9a8fd3caf8809a37135c85c2f34a91de5581f7ababa397128084b6c0d
                                                                                        • Instruction Fuzzy Hash: A1318F71624600DFDB31AA39D885B9AB3E8FF10354F14852AF4A9E71A1DF31FE809B54
                                                                                        Function 00C3C048 Relevance: 15.1, APIs: 10, Instructions: 69COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 303 c3c048-c3c05b 304 c3c067-c3c114 call c3c3b2 * 9 call c3be74 call c3bedf 303->304 305 c3c05d-c3c066 call c3c3b2 303->305 305->304
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00C3C05E
                                                                                          • Part of subcall function 00C3C3B2: HeapFree.KERNEL32(00000000,00000000,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?), ref: 00C3C3C8
                                                                                          • Part of subcall function 00C3C3B2: GetLastError.KERNEL32(?,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?,?), ref: 00C3C3DA
                                                                                        • _free.LIBCMT ref: 00C3C06A
                                                                                        • _free.LIBCMT ref: 00C3C075
                                                                                        • _free.LIBCMT ref: 00C3C080
                                                                                        • _free.LIBCMT ref: 00C3C08B
                                                                                        • _free.LIBCMT ref: 00C3C096
                                                                                        • _free.LIBCMT ref: 00C3C0A1
                                                                                        • _free.LIBCMT ref: 00C3C0AC
                                                                                        • _free.LIBCMT ref: 00C3C0B7
                                                                                        • _free.LIBCMT ref: 00C3C0C5
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: f6b698848f8a24daabcd84c633b9ebefc4ee3996c667c781e024aadaf35b2abb
                                                                                        • Instruction ID: ccd16387a14572b83aba8b5850eb90db2427bd94c1d3adc3fc4d542df196b85c
                                                                                        • Opcode Fuzzy Hash: f6b698848f8a24daabcd84c633b9ebefc4ee3996c667c781e024aadaf35b2abb
                                                                                        • Instruction Fuzzy Hash: 8D217B76914108AFCB45EF94C881DDE7BB9FF18340F018166F655AB221DB32EA94DBC0
                                                                                        Function 00C39AD0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 330 c39ad0-c39b21 call c43457 call c39a90 call c3a023 337 c39b23-c39b35 330->337 338 c39b7d-c39b80 330->338 340 c39ba0-c39ba9 337->340 341 c39b37-c39b4e 337->341 339 c39b82-c39b8f call c3a00c 338->339 338->340 345 c39b94-c39b9d call c39a90 339->345 343 c39b50-c39b5e call c39fbc 341->343 344 c39b64 341->344 352 c39b60 343->352 353 c39b74-c39b7b 343->353 347 c39b67-c39b6c 344->347 345->340 347->341 350 c39b6e-c39b70 347->350 350->340 354 c39b72 350->354 355 c39b62 352->355 356 c39baa-c39bb3 352->356 353->345 354->345 355->347 357 c39bb5-c39bbc 356->357 358 c39bed-c39bfd call c39ff0 356->358 357->358 360 c39bbe-c39bcd call c42be0 357->360 363 c39c11-c39c3f call c39a90 call c39fd4 call c37d40 358->363 364 c39bff-c39c0e call c3a00c 358->364 368 c39bea 360->368 369 c39bcf-c39be7 360->369 378 c39c41-c39c47 363->378 379 c39cbf-c39cce 363->379 364->363 368->358 369->368 378->379 380 c39c49-c39c4d 378->380 380->379 381 c39c4f-c39c56 380->381 382 c39c6a-c39c6f 381->382 383 c39c58-c39c5f 381->383 382->379 385 c39c71-c39c76 382->385 383->382 384 c39c61-c39c68 383->384 384->379 384->382 386 c39ca1-c39ca4 385->386 387 c39c78-c39c8c call c39ccf 385->387 386->379 389 c39ca6-c39cad 386->389 387->379 389->379 391 c39caf-c39cbd 389->391 391->379
                                                                                        APIs
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00C39B07
                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 00C39B0F
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00C39B98
                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00C39BC3
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 00C39C18
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                        • String ID: csm$csm
                                                                                        • API String ID: 1170836740-3733052814
                                                                                        • Opcode ID: 79b6cbad44ef0563b6dfc821584912301295187249c1d571581b1cf8897420f1
                                                                                        • Instruction ID: 12c5e3ef0d7cdee5be8b3b2461e3e6673b878d7e0b6595bb2beb6bc1907dbf13
                                                                                        • Opcode Fuzzy Hash: 79b6cbad44ef0563b6dfc821584912301295187249c1d571581b1cf8897420f1
                                                                                        • Instruction Fuzzy Hash: FE519134A20209DFCF24DF68E884B9EBBB5FF45324F148159E8259B392D7B1DA01DB91
                                                                                        Function 00C3D4BD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 393 c3d4bd-c3d4c9 394 c3d570-c3d573 393->394 395 c3d579 394->395 396 c3d4ce-c3d4df 394->396 399 c3d57b-c3d57f 395->399 397 c3d4e1-c3d4e4 396->397 398 c3d4ec-c3d505 LoadLibraryExW 396->398 400 c3d4ea 397->400 401 c3d56d 397->401 402 c3d557-c3d560 398->402 403 c3d507-c3d510 GetLastError 398->403 405 c3d569-c3d56b 400->405 401->394 404 c3d562-c3d563 FreeLibrary 402->404 402->405 406 c3d512-c3d524 call c3bde8 403->406 407 c3d547 403->407 404->405 405->401 408 c3d580-c3d582 405->408 406->407 413 c3d526-c3d538 call c3bde8 406->413 410 c3d549-c3d54b 407->410 408->399 410->402 412 c3d54d-c3d555 410->412 412->401 413->407 416 c3d53a-c3d545 LoadLibraryExW 413->416 416->410
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: api-ms-$ext-ms-
                                                                                        • API String ID: 0-537541572
                                                                                        • Opcode ID: f8466e1a816cb52970874b585ba6e22c7dd14a24ae7ce83149417550772c2409
                                                                                        • Instruction ID: 02f689b7579d44dd72373cbe248ec079ab9abd36e31861cea6becd7153c1b0c2
                                                                                        • Opcode Fuzzy Hash: f8466e1a816cb52970874b585ba6e22c7dd14a24ae7ce83149417550772c2409
                                                                                        • Instruction Fuzzy Hash: 6E21DAF6A21310ABCB228769BC45B6E7778AF42768F250521FD27A7291D730EE00D5E1
                                                                                        Function 00C3E7AC Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 417 c3e7ac-c3e7b7 418 c3e88d-c3e88f 417->418 419 c3e7bd-c3e88a call c3e774 * 5 call c3c3b2 * 3 call c3e774 * 5 call c3c3b2 * 4 417->419 419->418
                                                                                        APIs
                                                                                          • Part of subcall function 00C3E774: _free.LIBCMT ref: 00C3E799
                                                                                        • _free.LIBCMT ref: 00C3E7FA
                                                                                          • Part of subcall function 00C3C3B2: HeapFree.KERNEL32(00000000,00000000,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?), ref: 00C3C3C8
                                                                                          • Part of subcall function 00C3C3B2: GetLastError.KERNEL32(?,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?,?), ref: 00C3C3DA
                                                                                        • _free.LIBCMT ref: 00C3E805
                                                                                        • _free.LIBCMT ref: 00C3E810
                                                                                        • _free.LIBCMT ref: 00C3E864
                                                                                        • _free.LIBCMT ref: 00C3E86F
                                                                                        • _free.LIBCMT ref: 00C3E87A
                                                                                        • _free.LIBCMT ref: 00C3E885
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: dcb31790bdfd7afe4745d9090afd41ecfff798791d41c0f986f5dccb79862b39
                                                                                        • Instruction ID: 5c8e7241e658f116d0fbdc318e6a7c26b2f81f822b3d50f2ca328bd28c5e3a32
                                                                                        • Opcode Fuzzy Hash: dcb31790bdfd7afe4745d9090afd41ecfff798791d41c0f986f5dccb79862b39
                                                                                        • Instruction Fuzzy Hash: 46116371560B04FAD530BBB1CC47FDB779C5F01700F408A15F6E9A60E2EA75B544A791
                                                                                        Function 00C3FCDD Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetConsoleCP.KERNEL32(?,00000001,00000000), ref: 00C3FD25
                                                                                        • __fassign.LIBCMT ref: 00C3FF04
                                                                                        • __fassign.LIBCMT ref: 00C3FF21
                                                                                        • WriteFile.KERNEL32(?,00C3DFDF,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C3FF69
                                                                                        • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00C3FFA9
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C40055
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileWrite__fassign$ConsoleErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 4031098158-0
                                                                                        • Opcode ID: 1b616bcf1a9d0f1548245a0302fc5765ff19abac358568f7fba13289ea96aae8
                                                                                        • Instruction ID: fdccba6f88b2bf784daa75e00333447efd5edfa871bf08e53d9c81855db2487a
                                                                                        • Opcode Fuzzy Hash: 1b616bcf1a9d0f1548245a0302fc5765ff19abac358568f7fba13289ea96aae8
                                                                                        • Instruction Fuzzy Hash: 50D1A975D002589FCF15CFE8C880AEDBBB5BF49314F28016AE965BB252D731AE46CB50
                                                                                        Function 00C39D70 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,00C39D67,00C39D39,00C37B42), ref: 00C39D7E
                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00C39D8C
                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00C39DA5
                                                                                        • SetLastError.KERNEL32(00000000,00C39D67,00C39D39,00C37B42), ref: 00C39DF7
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                        • String ID:
                                                                                        • API String ID: 3852720340-0
                                                                                        • Opcode ID: 2b55af1152ccf915362eaa3aa8a2978441eeb1a15599723d8ba109d40cf941ae
                                                                                        • Instruction ID: 2d320a50fbd3d46a43b8baa2329863379c5e219452fa9c3e7ad502056d4fc5c2
                                                                                        • Opcode Fuzzy Hash: 2b55af1152ccf915362eaa3aa8a2978441eeb1a15599723d8ba109d40cf941ae
                                                                                        • Instruction Fuzzy Hash: 0901D43663A3125EE72927B5BCC776B2B55FF137B0F30022AF625410E4EFA24C20A551
                                                                                        Function 00C3A080 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,00C3A141,?,?,00C44C8C,00000000,?,00C3A26C,00000004,InitializeCriticalSectionEx,00C31C14,InitializeCriticalSectionEx,00000000), ref: 00C3A110
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary
                                                                                        • String ID: api-ms-
                                                                                        • API String ID: 3664257935-2084034818
                                                                                        • Opcode ID: 2f85c1ce8c844b90b4ba2dd5b414a45a745a06a4b44695fe499318a68b8785a7
                                                                                        • Instruction ID: 4b8c18d735e5fb17a4c1aa1649d4217820977c1c9f05c72a4fd15788266a4243
                                                                                        • Opcode Fuzzy Hash: 2f85c1ce8c844b90b4ba2dd5b414a45a745a06a4b44695fe499318a68b8785a7
                                                                                        • Instruction Fuzzy Hash: 5711A036A61625EBCB228B699C45B5D73A4AF07770F240121E9A2F7280D770EE1086D7
                                                                                        Function 00C3AE73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00C3AE68,?,?,00C3AE30,?,?,?), ref: 00C3AE88
                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C3AE9B
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,00C3AE68,?,?,00C3AE30,?,?,?), ref: 00C3AEBE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                        • API String ID: 4061214504-1276376045
                                                                                        • Opcode ID: 53601e1d22c0a71148928f123d25ea648abde4edea12a4514d631d3f00221dda
                                                                                        • Instruction ID: 26a9e685ce2fe80937039dc52ad89015d862815020dfe5d14bc811cc9dd84c14
                                                                                        • Opcode Fuzzy Hash: 53601e1d22c0a71148928f123d25ea648abde4edea12a4514d631d3f00221dda
                                                                                        • Instruction Fuzzy Hash: 65F0A035A10218FBDB119B50DC0DB9EBB78FB02755F040060FC01A21A0DB758F10DBA6
                                                                                        Function 00C3E70B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00C3E723
                                                                                          • Part of subcall function 00C3C3B2: HeapFree.KERNEL32(00000000,00000000,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?), ref: 00C3C3C8
                                                                                          • Part of subcall function 00C3C3B2: GetLastError.KERNEL32(?,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?,?), ref: 00C3C3DA
                                                                                        • _free.LIBCMT ref: 00C3E735
                                                                                        • _free.LIBCMT ref: 00C3E747
                                                                                        • _free.LIBCMT ref: 00C3E759
                                                                                        • _free.LIBCMT ref: 00C3E76B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 816c5b0414de25cd7f5911d3ddf423d8bcbddadc455c843e4e7d98d5908f8935
                                                                                        • Instruction ID: 8bb8353df8fc1149042fc4443d9ca53c6e59fcd86cd6293fe99d390b01ef3694
                                                                                        • Opcode Fuzzy Hash: 816c5b0414de25cd7f5911d3ddf423d8bcbddadc455c843e4e7d98d5908f8935
                                                                                        • Instruction Fuzzy Hash: BCF04F36524600ABC664DB68E4C5E5E73E9BB06350B658906F454E76A0CB31FCC08B90
                                                                                        Function 00C3AF45 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: C:\Users\user\Wavesor Software\SWUpdater\SWUpdater.exe
                                                                                        • API String ID: 0-3959006988
                                                                                        • Opcode ID: d19348cd7ff7122a2a04e40acec97e4b92e1d97512813c650c3d981d2b6463c6
                                                                                        • Instruction ID: e4b4a1ed529617ae805e7ec446f762589031530fee443abb77d7f5c8e5de956a
                                                                                        • Opcode Fuzzy Hash: d19348cd7ff7122a2a04e40acec97e4b92e1d97512813c650c3d981d2b6463c6
                                                                                        • Instruction Fuzzy Hash: C531DFB5A10214EFCB25DF9AC881A9FBBB8EF89300F204166F625E7211D7718E40DB91
                                                                                        Function 00C3C160 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,?,00C40123,?,00000001,00C3E050,?,00C405E2,00000001,?,?,?,00C3DFDF,?,?), ref: 00C3C165
                                                                                        • _free.LIBCMT ref: 00C3C1C2
                                                                                        • _free.LIBCMT ref: 00C3C1F8
                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,00C405E2,00000001,?,?,?,00C3DFDF,?,?,?,00C43778,0000002C,00C3E050), ref: 00C3C203
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast_free
                                                                                        • String ID:
                                                                                        • API String ID: 2283115069-0
                                                                                        • Opcode ID: 2280f181dc3a1fddf8138abcbb82856cf1ce526452ba6e4d134ccd273c3efac1
                                                                                        • Instruction ID: 7e28bcda8ae73eb952ff402c1871657b16ab8d823f531dece57ae16066a8501d
                                                                                        • Opcode Fuzzy Hash: 2280f181dc3a1fddf8138abcbb82856cf1ce526452ba6e4d134ccd273c3efac1
                                                                                        • Instruction Fuzzy Hash: 3F11C2362642046BD61167B9BCC6B6F3159BBC2779F240225F636A21E2DE218C017710
                                                                                        Function 00C3C2B7 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(00C45448,00C4541C,00C45448,00C3AA86,00C3C452,?,00C3AAF8,00C45448,00000004,00000004,?,00000000,?,00C3B5C7,?,00000004), ref: 00C3C2BC
                                                                                        • _free.LIBCMT ref: 00C3C319
                                                                                        • _free.LIBCMT ref: 00C3C34F
                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,00C3AAF8,00C45448,00000004,00000004,?,00000000,?,00C3B5C7,?,00000004,00000004,00C4541C), ref: 00C3C35A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast_free
                                                                                        • String ID:
                                                                                        • API String ID: 2283115069-0
                                                                                        • Opcode ID: ac2a281d06ba810ee7cc6f4e5e5cd27a80ebbf9c497ee28f8d081ec5870cb080
                                                                                        • Instruction ID: fbfd3c2e71913baacb7b1c6432f5318daf37bda9bd1ae8f445810ec42b362597
                                                                                        • Opcode Fuzzy Hash: ac2a281d06ba810ee7cc6f4e5e5cd27a80ebbf9c497ee28f8d081ec5870cb080
                                                                                        • Instruction Fuzzy Hash: F511A1362642046BD65167B9BCC6FAF2569BBC6778F240225F636F21F2DE228C016351
                                                                                        Function 00C41216 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteConsoleW.KERNEL32(?,?,00C3E050,00000000,?,?,00C40C6F,?,00000001,?,00000001,?,00C400B2,00000000,?,00000001), ref: 00C4122D
                                                                                        • GetLastError.KERNEL32(?,00C40C6F,?,00000001,?,00000001,?,00C400B2,00000000,?,00000001,00000000,00000001,?,00C40606,00C3DFDF), ref: 00C41239
                                                                                          • Part of subcall function 00C411FF: CloseHandle.KERNEL32(FFFFFFFE,00C41249,?,00C40C6F,?,00000001,?,00000001,?,00C400B2,00000000,?,00000001,00000000,00000001), ref: 00C4120F
                                                                                        • ___initconout.LIBCMT ref: 00C41249
                                                                                          • Part of subcall function 00C411C1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00C411F0,00C40C5C,00000001,?,00C400B2,00000000,?,00000001,00000000), ref: 00C411D4
                                                                                        • WriteConsoleW.KERNEL32(?,?,00C3E050,00000000,?,00C40C6F,?,00000001,?,00000001,?,00C400B2,00000000,?,00000001,00000000), ref: 00C4125E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                        • String ID:
                                                                                        • API String ID: 2744216297-0
                                                                                        • Opcode ID: 14cbad5a199f9377e435185092cbfcfffd01806185b98722671205caf27259fb
                                                                                        • Instruction ID: 9200d9bc8f161a36d36287abc4ac856829c901cd2a9f2992147d7b167ce35129
                                                                                        • Opcode Fuzzy Hash: 14cbad5a199f9377e435185092cbfcfffd01806185b98722671205caf27259fb
                                                                                        • Instruction Fuzzy Hash: 3CF0F83A900154BBCF222F91EC04B8D3E66FB0A3A1F094010FE19D6161C6328AA0AB91
                                                                                        Function 00C37340 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SleepConditionVariableCS.KERNELBASE(?,00C372DD,00000064), ref: 00C37363
                                                                                        • LeaveCriticalSection.KERNEL32(00C448D4,?,?,00C372DD,00000064,?,00C36438,00C45444,?,?,00C36B89,?,00C36642), ref: 00C3736D
                                                                                        • WaitForSingleObjectEx.KERNEL32(?,00000000,?,00C372DD,00000064,?,00C36438,00C45444,?,?,00C36B89,?,00C36642), ref: 00C3737E
                                                                                        • EnterCriticalSection.KERNEL32(00C448D4,?,00C372DD,00000064,?,00C36438,00C45444,?,?,00C36B89,?,00C36642), ref: 00C37385
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                        • String ID:
                                                                                        • API String ID: 3269011525-0
                                                                                        • Opcode ID: c78abcaf29e2d169a0589d46a86d9bdf137185c8b0481407f2960eb730b69219
                                                                                        • Instruction ID: 4110735dd54d3a9b074189cd8a1c7cfee4ec00a6160eba299fbec83f9330a085
                                                                                        • Opcode Fuzzy Hash: c78abcaf29e2d169a0589d46a86d9bdf137185c8b0481407f2960eb730b69219
                                                                                        • Instruction Fuzzy Hash: 1BE0D879501564BBCF152B90FC09B9D7F28FB07B61F100024F906D62B0C77159109BD5
                                                                                        Function 00C3B85D Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00C3B866
                                                                                          • Part of subcall function 00C3C3B2: HeapFree.KERNEL32(00000000,00000000,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?), ref: 00C3C3C8
                                                                                          • Part of subcall function 00C3C3B2: GetLastError.KERNEL32(?,?,00C3E79E,?,00000000,?,00C45448,?,00C3E7C5,?,00000007,?,?,00C3EC87,?,?), ref: 00C3C3DA
                                                                                        • _free.LIBCMT ref: 00C3B879
                                                                                        • _free.LIBCMT ref: 00C3B88A
                                                                                        • _free.LIBCMT ref: 00C3B89B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 383c0d7bd1c1ae66f024f48b9c6cbd13e57f049b41dc9b60fa08db5e562878e6
                                                                                        • Instruction ID: 0ecca169db38255dbc92094802c0cc310f5df7bb62457f174e8dce6c28d5c7c7
                                                                                        • Opcode Fuzzy Hash: 383c0d7bd1c1ae66f024f48b9c6cbd13e57f049b41dc9b60fa08db5e562878e6
                                                                                        • Instruction Fuzzy Hash: B0E0467E8249209BC6626F14BC81B8D3AA5FB26B407A08207F80422233C7731896AFC0
                                                                                        Function 00C37080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00C362C1: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00C362C6
                                                                                          • Part of subcall function 00C362C1: GetLastError.KERNEL32(?,00000000,?,8007000E,?,-C000001E,00000001), ref: 00C362D0
                                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,00C36236), ref: 00C370B3
                                                                                        • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00C36236), ref: 00C370C2
                                                                                        Strings
                                                                                        • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00C370BD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000003.00000002.1746039937.0000000000C31000.00000020.00000001.01000000.00000012.sdmp, Offset: 00C30000, based on PE: true
                                                                                        • Associated: 00000003.00000002.1746021733.0000000000C30000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746064121.0000000000C44000.00000004.00000001.01000000.00000012.sdmpDownload File
                                                                                        • Associated: 00000003.00000002.1746080371.0000000000C46000.00000002.00000001.01000000.00000012.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_3_2_c30000_SWUpdater.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                        • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                        • API String ID: 450123788-631824599
                                                                                        • Opcode ID: 590bcc49ab239ce3768c56dddb18083de4997caaaaf22d01452fe2ade6b8e52d
                                                                                        • Instruction ID: 4fae200fe8d7200ecc2fc2e181a565f21689fb6e846620692ced4e5c7d5bb5d8
                                                                                        • Opcode Fuzzy Hash: 590bcc49ab239ce3768c56dddb18083de4997caaaaf22d01452fe2ade6b8e52d
                                                                                        • Instruction Fuzzy Hash: DDE092B02247418FC374EF34D908346BAE4AF05344F108A2CE896C7345DBB1E488CBA2

                                                                                        Executed Functions

                                                                                        Function 00007FF6B353397C Relevance: 4.5, APIs: 3, Instructions: 33libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • LoadLibraryW.KERNELBASE ref: 00007FF6B3533991
                                                                                        • GetProcAddress.KERNEL32 ref: 00007FF6B35339AE
                                                                                        • FreeLibrary.KERNELBASE ref: 00007FF6B35339CE
                                                                                          • Part of subcall function 00007FF6B353392C: GetLastError.KERNEL32(?,?,?,00007FF6B3533AEC,?,?,?,00007FF6B3534248,?,?,?,?,00007FF6B3531015), ref: 00007FF6B3533932
                                                                                          • Part of subcall function 00007FF6B353392C: RaiseException.KERNEL32(?,?,?,00007FF6B3533AEC,?,?,?,00007FF6B3534248,?,?,?,?,00007FF6B3531015), ref: 00007FF6B353396B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$AddressErrorExceptionFreeLastLoadProcRaise
                                                                                        • String ID:
                                                                                        • API String ID: 386220097-0
                                                                                        • Opcode ID: c9290ad91551b8e68e755518c6f29a62508ea474593a4d7933c50e25677754d1
                                                                                        • Instruction ID: 3a4434f28be25fd95a8858827f3e5ec2f6abfb83d46113d7f36384fe235292fb
                                                                                        • Opcode Fuzzy Hash: c9290ad91551b8e68e755518c6f29a62508ea474593a4d7933c50e25677754d1
                                                                                        • Instruction Fuzzy Hash: E4F06237B1D742C2FB685F1A7442139A2A59F94BC0B1D5430DB5F97758EE3CD4518700
                                                                                        Function 00007FF6B3534BB8 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 67libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressCommandHandleLineModuleProc
                                                                                        • String ID: SetDefaultDllDirectories$kernel32.dll$unregister$user
                                                                                        • API String ID: 147197560-815688805
                                                                                        • Opcode ID: 671a0be3d85d271d3aade06a8125ec51e9e27889a623ae1f80de0d04b2dec567
                                                                                        • Instruction ID: cf49ad6de6d5f4ec7a06c96b72ce66901a551728d48797c7cb2769b5601444cd
                                                                                        • Opcode Fuzzy Hash: 671a0be3d85d271d3aade06a8125ec51e9e27889a623ae1f80de0d04b2dec567
                                                                                        • Instruction Fuzzy Hash: C7218463B1CA4682DF209B2CE4825AD6360FF84BA4B444331E77E972E9DF2CE549C740
                                                                                        Function 00007FF6B3534EFC Relevance: 9.1, APIs: 6, Instructions: 94COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: __scrt_fastfail$__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
                                                                                        • String ID:
                                                                                        • API String ID: 2689033250-0
                                                                                        • Opcode ID: 9d1dbfeaf995a7f4291a0c61ab7239122f8d15c07a0cd26abf2e1cbbf3947719
                                                                                        • Instruction ID: d8e5b88c4f0fec9f1d36812da2043f38bb82ac824668e9ef31bf909c4f393aa2
                                                                                        • Opcode Fuzzy Hash: 9d1dbfeaf995a7f4291a0c61ab7239122f8d15c07a0cd26abf2e1cbbf3947719
                                                                                        • Instruction Fuzzy Hash: E0310663B4C24241FB34AB6C94533B923919F81384F856834EB8FEB297DE2DA4448251
                                                                                        Function 00007FF6B35340B4 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 160stringCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 84 7ff6b35340b4-7ff6b35340ff call 7ff6b35318b4 call 7ff6b3531738 call 7ff6b35318b4 call 7ff6b3531dec 93 7ff6b3534190-7ff6b35341b8 call 7ff6b3531210 call 7ff6b353145c 84->93 94 7ff6b3534105-7ff6b3534118 lstrcmpiW 84->94 111 7ff6b353436e-7ff6b35343a0 call 7ff6b3531210 93->111 112 7ff6b35341be-7ff6b3534222 InitializeCriticalSection call 7ff6b3531abc call 7ff6b353145c 93->112 96 7ff6b3534147-7ff6b3534159 94->96 97 7ff6b353411a-7ff6b3534142 call 7ff6b353a1bc call 7ff6b3533c40 * 2 94->97 98 7ff6b353415b-7ff6b353415e 96->98 99 7ff6b3534164-7ff6b353416f 96->99 97->96 98->99 102 7ff6b353417d-7ff6b353418f 99->102 103 7ff6b3534171-7ff6b3534177 99->103 103->102 120 7ff6b35343a2-7ff6b35343ac 111->120 124 7ff6b3534228-7ff6b3534251 call 7ff6b3533a38 112->124 125 7ff6b3534363-7ff6b353436d call 7ff6b3531210 112->125 122 7ff6b35343cd-7ff6b3534430 call 7ff6b3531a94 * 2 call 7ff6b3534790 call 7ff6b3531a94 120->122 123 7ff6b35343ae-7ff6b35343bc 120->123 126 7ff6b35343c9-7ff6b35343cb 123->126 127 7ff6b35343be-7ff6b35343c1 123->127 138 7ff6b3534282-7ff6b35342ae call 7ff6b35319f8 124->138 139 7ff6b3534253-7ff6b353427d call 7ff6b3532f6c call 7ff6b353a1bc call 7ff6b3533c40 124->139 125->111 126->120 127->126 146 7ff6b35342b9-7ff6b35342cd 138->146 147 7ff6b35342b0-7ff6b35342b3 138->147 139->138 150 7ff6b35342d8-7ff6b3534311 call 7ff6b3536960 call 7ff6b35340b4 146->150 151 7ff6b35342cf-7ff6b35342d2 146->151 147->146 159 7ff6b3534316-7ff6b3534339 call 7ff6b3532f6c 150->159 151->150 162 7ff6b353433b-7ff6b353433e 159->162 163 7ff6b3534344-7ff6b3534362 call 7ff6b3534434 159->163 162->163
                                                                                        APIs
                                                                                          • Part of subcall function 00007FF6B35318B4: PathRemoveExtensionW.SHLWAPI(?,?,?,00007FF6B35340D2,?,?,?,00007FF6B3534316,?,?,?,?,00007FF6B3531015), ref: 00007FF6B3531910
                                                                                          • Part of subcall function 00007FF6B3531738: VirtualQuery.KERNEL32 ref: 00007FF6B353175F
                                                                                        • lstrcmpiW.KERNELBASE(?,?,?,00007FF6B3534316,?,?,?,?,00007FF6B3531015), ref: 00007FF6B3534110
                                                                                        • InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF6B3531015), ref: 00007FF6B35341E4
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalExtensionInitializePathQueryRemoveSectionVirtuallstrcmpi
                                                                                        • String ID: SWUpdater.ini$SWUpdater.log$SystemDrive
                                                                                        • API String ID: 4116145752-130341108
                                                                                        • Opcode ID: 32266d06da3b875dfa3287cd17a592dde2ffcc3f41a78654f2d9d62d28bd5d31
                                                                                        • Instruction ID: e3e17839ab775088831b1b48bfb33cb0ac325e72da2b20ce25fd984e8185a363
                                                                                        • Opcode Fuzzy Hash: 32266d06da3b875dfa3287cd17a592dde2ffcc3f41a78654f2d9d62d28bd5d31
                                                                                        • Instruction Fuzzy Hash: E0715F63B1DA4681EB10DB2DD88626863B0FF80BA0F454231EB6EA77A5DF2CE545C340
                                                                                        Function 00007FF6B3534A78 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 166 7ff6b3534a78-7ff6b3534ab0 RegOpenKeyExW 167 7ff6b3534ac8-7ff6b3534ad6 166->167 168 7ff6b3534ab2-7ff6b3534ac6 RegOverridePredefKey 166->168 170 7ff6b3534ada-7ff6b3534ae2 167->170 168->167 169 7ff6b3534ad8 168->169 169->170 171 7ff6b3534aea-7ff6b3534af1 170->171 172 7ff6b3534ae4 RegCloseKey 170->172 172->171
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: CloseOpenOverridePredef
                                                                                        • String ID: Software\Classes
                                                                                        • API String ID: 2630863477-1656466771
                                                                                        • Opcode ID: 051eee206094364067c945b6fe3a91cd575629893bf5bb1f97f32024f564658e
                                                                                        • Instruction ID: 39d3e45570d2ff45cfb076f189817182489a619623249d160eff2b1eee5186fa
                                                                                        • Opcode Fuzzy Hash: 051eee206094364067c945b6fe3a91cd575629893bf5bb1f97f32024f564658e
                                                                                        • Instruction Fuzzy Hash: 8CF02266B1C60285EB208B2DE48233A23A4EF457A0F500634DF6EE26E4DF2CE0588714
                                                                                        Function 00007FF6B353419C Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 146COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF6B3531015), ref: 00007FF6B35341E4
                                                                                          • Part of subcall function 00007FF6B353145C: GetProcessHeap.KERNEL32(?,?,?,00007FF6B35341B2,?,?,?,?,00007FF6B3531015), ref: 00007FF6B35314D2
                                                                                          • Part of subcall function 00007FF6B353145C: _Init_thread_footer.LIBCMT ref: 00007FF6B3531507
                                                                                          • Part of subcall function 00007FF6B353145C: _Init_thread_footer.LIBCMT ref: 00007FF6B3531570
                                                                                          • Part of subcall function 00007FF6B3533A38: GetEnvironmentVariableW.KERNEL32(?,?,?,00007FF6B3534248,?,?,?,?,00007FF6B3531015), ref: 00007FF6B3533A7A
                                                                                          • Part of subcall function 00007FF6B3533A38: GetEnvironmentVariableW.KERNEL32(?,?,?,00007FF6B3534248,?,?,?,?,00007FF6B3531015), ref: 00007FF6B3533AB2
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: EnvironmentInit_thread_footerVariable$CriticalHeapInitializeProcessSection
                                                                                        • String ID: SWUpdater.ini$SWUpdater.log$SystemDrive
                                                                                        • API String ID: 3489650459-130341108
                                                                                        • Opcode ID: ff11fede2e9287f710dcf653596ce64e84e1f611f30688aea62470e8c3adb169
                                                                                        • Instruction ID: 25771308988f9de8c189b3869130cf9e4adc254c01d837ccf188524de46e140c
                                                                                        • Opcode Fuzzy Hash: ff11fede2e9287f710dcf653596ce64e84e1f611f30688aea62470e8c3adb169
                                                                                        • Instruction Fuzzy Hash: AC715B63B1DA4681EB14EB2CD8863A86360FF80B54F414231E76EA36A5DF3CF598C340
                                                                                        Function 00007FF6B353B600 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                        • String ID:
                                                                                        • API String ID: 1703294689-0
                                                                                        • Opcode ID: e60c87af12133c403395cd3438c6da16b6950e49ae9ffa6ffe70553606710900
                                                                                        • Instruction ID: 7cc0d0debfc1069115cdbda1ac6a49becc6443ddacad33d0f4d031b3228c6bf3
                                                                                        • Opcode Fuzzy Hash: e60c87af12133c403395cd3438c6da16b6950e49ae9ffa6ffe70553606710900
                                                                                        • Instruction Fuzzy Hash: 18E04F26B4C70542FF286B689C9727D2256AF84701F005438CA5F933A7CE3DE4598241
                                                                                        Function 00007FF6B353F104 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 251 7ff6b353f104-7ff6b353f127 call 7ff6b353ef2c 253 7ff6b353f12c-7ff6b353f12f 251->253 254 7ff6b353f147-7ff6b353f151 253->254 255 7ff6b353f131-7ff6b353f140 253->255 255->254
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: try_get_function
                                                                                        • String ID: AppPolicyGetProcessTerminationMethod
                                                                                        • API String ID: 2742660187-2031265017
                                                                                        • Opcode ID: 9f341f2554a4bb58493b668fc45e91f20dfdc4af7ead02beb13f7b0f0e184a74
                                                                                        • Instruction ID: fd132323dddfbc33f666209b1bb592457c02a6c2840eb0e1ced58964396d63aa
                                                                                        • Opcode Fuzzy Hash: 9f341f2554a4bb58493b668fc45e91f20dfdc4af7ead02beb13f7b0f0e184a74
                                                                                        • Instruction Fuzzy Hash: 6CE04F57F0D50691FE5847ADA8025F02250AF0C770F484731DB3D963D99E2CAAE5C210
                                                                                        Function 00007FF6B3532518 Relevance: 3.2, APIs: 2, Instructions: 240COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 256 7ff6b3532518-7ff6b3532550 call 7ff6b3531abc call 7ff6b3532c10 261 7ff6b3532592-7ff6b35325aa CommandLineToArgvW 256->261 262 7ff6b3532552-7ff6b353257e call 7ff6b3531778 call 7ff6b3532f6c 256->262 263 7ff6b35325b8-7ff6b35325be 261->263 264 7ff6b35325ac-7ff6b35325b3 call 7ff6b353392c 261->264 279 7ff6b3532589-7ff6b353258d call 7ff6b3533eec 262->279 280 7ff6b3532580-7ff6b3532583 262->280 267 7ff6b3532806 263->267 268 7ff6b35325c4-7ff6b3532616 call 7ff6b353327c * 2 263->268 274 7ff6b3532814-7ff6b3532829 264->274 272 7ff6b353280b-7ff6b353280e LocalFree 267->272 284 7ff6b3532618-7ff6b353261a 268->284 285 7ff6b353261f-7ff6b353262a call 7ff6b353145c 268->285 272->274 277 7ff6b353282b-7ff6b353282e 274->277 278 7ff6b3532834-7ff6b353284d 274->278 277->278 279->261 280->279 284->272 288 7ff6b3532630-7ff6b3532645 285->288 289 7ff6b353284e-7ff6b353285b call 7ff6b3531210 285->289 293 7ff6b353264b 288->293 294 7ff6b3532782-7ff6b3532797 288->294 296 7ff6b3532650-7ff6b3532675 call 7ff6b3531abc call 7ff6b3532c10 call 7ff6b353285c 293->296 294->284 295 7ff6b353279d-7ff6b35327a6 294->295 295->284 304 7ff6b35326a8-7ff6b35326af call 7ff6b35328b4 296->304 305 7ff6b3532677-7ff6b3532684 call 7ff6b3532948 296->305 312 7ff6b3532730-7ff6b353274e call 7ff6b3532294 304->312 313 7ff6b35326b1-7ff6b35326bc call 7ff6b35328b4 304->313 310 7ff6b353268a-7ff6b353269a call 7ff6b35321d8 305->310 311 7ff6b35327ab 305->311 310->311 322 7ff6b35326a0-7ff6b35326a3 310->322 315 7ff6b35327af-7ff6b35327b3 311->315 325 7ff6b35327f8-7ff6b3532804 312->325 326 7ff6b3532754-7ff6b3532767 312->326 327 7ff6b35327f1-7ff6b35327f6 313->327 328 7ff6b35326c2-7ff6b3532701 call 7ff6b3532b78 call 7ff6b3532948 313->328 319 7ff6b35327b7-7ff6b35327c4 315->319 323 7ff6b35327c6-7ff6b35327c9 319->323 324 7ff6b35327cf-7ff6b35327e4 319->324 322->326 323->324 324->272 329 7ff6b35327e6-7ff6b35327ef 324->329 325->319 330 7ff6b3532769-7ff6b353276c 326->330 331 7ff6b3532772-7ff6b3532778 326->331 327->311 338 7ff6b353270c-7ff6b353270e 328->338 339 7ff6b3532703-7ff6b3532706 328->339 329->272 330->331 331->296 334 7ff6b353277e 331->334 334->294 338->315 340 7ff6b3532714-7ff6b3532725 call 7ff6b35321d8 338->340 339->338 340->315 343 7ff6b353272b-7ff6b353272e 340->343 343->326
                                                                                        APIs
                                                                                        • CommandLineToArgvW.SHELL32 ref: 00007FF6B353259E
                                                                                          • Part of subcall function 00007FF6B3531778: GetModuleFileNameW.KERNEL32(?,?,?,00007FF6B353187F,?,?,?,00007FF6B35318D0,?,?,?,00007FF6B35340D2,?,?,?,00007FF6B3534316), ref: 00007FF6B35317EF
                                                                                        • LocalFree.KERNEL32 ref: 00007FF6B353280E
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ArgvCommandFileFreeLineLocalModuleName
                                                                                        • String ID:
                                                                                        • API String ID: 871553864-0
                                                                                        • Opcode ID: 9c203e3dd5942a340273348b667619ed2b74e7b694943ae0b9185a8ba0309f15
                                                                                        • Instruction ID: 81eaff4ded63b8ef87cd9916af01fbac03d1c830a08eb77c864ee402830189a6
                                                                                        • Opcode Fuzzy Hash: 9c203e3dd5942a340273348b667619ed2b74e7b694943ae0b9185a8ba0309f15
                                                                                        • Instruction Fuzzy Hash: 81A14063B08E4686EB209F6DC8422AD6761FF44BB8B044231DF2EA77D5DF78D9458340
                                                                                        Function 00007FF6B353B544 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: HandleModule$AddressFreeLibraryProc
                                                                                        • String ID:
                                                                                        • API String ID: 3947729631-0
                                                                                        • Opcode ID: d52e3991fbc9ca3334b84e3e4341ac8e611fff17074179076408dd2a728e5740
                                                                                        • Instruction ID: 7aedb419cc9de2381479e467a35dc77b3216ed777b74115be5fdebc443316283
                                                                                        • Opcode Fuzzy Hash: d52e3991fbc9ca3334b84e3e4341ac8e611fff17074179076408dd2a728e5740
                                                                                        • Instruction Fuzzy Hash: 18214C72B19B418EEB258F68C4852AC37F0EB44708F44453AD79EA2A85EF38D595CB80
                                                                                        Function 00007FF6B35418D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                        • String ID:
                                                                                        • API String ID: 3215553584-0
                                                                                        • Opcode ID: 1c8a84715a6e5e3ddbfed77e0d88c430a21cb96b07097c70f42996aa7bcdc6d8
                                                                                        • Instruction ID: eab2367ed3804025152fd5d5cc82a4cf24ad7504359772444cc2a615c50afc6a
                                                                                        • Opcode Fuzzy Hash: 1c8a84715a6e5e3ddbfed77e0d88c430a21cb96b07097c70f42996aa7bcdc6d8
                                                                                        • Instruction Fuzzy Hash: 65113D33B0C64682F3189F19A48717963A5EB40740F150435E79EB77AADF3CFA208B00
                                                                                        Function 00007FF6B353F4C4 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6B353EE1D,?,?,0000A04F561556C4,00007FF6B353A1A5,?,?,?,?,00007FF6B353FC32,?,?,00000000), ref: 00007FF6B353F519
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: AllocateHeap
                                                                                        • String ID:
                                                                                        • API String ID: 1279760036-0
                                                                                        • Opcode ID: 3e85f128de049c1b7e26d089d138d5a87877e00522fdbbbd41d1adc0f3218664
                                                                                        • Instruction ID: 2aec9a2dfbc6eb6a1252f0f58003e6c3727aef2a56bb78e82fb213f4dfa6d0a6
                                                                                        • Opcode Fuzzy Hash: 3e85f128de049c1b7e26d089d138d5a87877e00522fdbbbd41d1adc0f3218664
                                                                                        • Instruction Fuzzy Hash: 3CF06D46B0E20341FF795BAEED073B812905F98B84F0C5430CB0FE62C2EE1CE4818210
                                                                                        Function 00007FF6B3534A48 Relevance: 1.5, APIs: 1, Instructions: 15registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 424 7ff6b3534a48-7ff6b3534a5f RegOverridePredefKey 425 7ff6b3534a70 424->425 426 7ff6b3534a61-7ff6b3534a6e 424->426 427 7ff6b3534a72-7ff6b3534a76 425->427 426->427
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: OverridePredef
                                                                                        • String ID:
                                                                                        • API String ID: 898253552-0
                                                                                        • Opcode ID: 79a97c6fc667990d3d8c910131395f4470f636a3e8e1ee5314a04dc805545fad
                                                                                        • Instruction ID: c660294a009c5a147577695be0e754fdc078625c1bbd4dab1fca906892d6b4e9
                                                                                        • Opcode Fuzzy Hash: 79a97c6fc667990d3d8c910131395f4470f636a3e8e1ee5314a04dc805545fad
                                                                                        • Instruction Fuzzy Hash: E4D0A921B6E80381EB6CA27B0C1233700C26F84671FA00238CF2FC02E4FE1CE8416008

                                                                                        Non-executed Functions

                                                                                        Function 00007FF6B3536138 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 169libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$HandleModule
                                                                                        • String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
                                                                                        • API String ID: 667068680-295688737
                                                                                        • Opcode ID: 1b993a159e12261389cce29d393997aa607e3e9add39b90a74bc592dd0ec68a9
                                                                                        • Instruction ID: bf265aef5258272ece0b66945f2158e3fb96eebf2715bb13cfd7a77fcdbea7a6
                                                                                        • Opcode Fuzzy Hash: 1b993a159e12261389cce29d393997aa607e3e9add39b90a74bc592dd0ec68a9
                                                                                        • Instruction Fuzzy Hash: 3FA1A526B0EF0791EA499B59BC5A07433B5BF08780B815031C71DA2378EE7DF1A9C741
                                                                                        Function 00007FF6B3534434 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 168COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: PrivateProfile$String
                                                                                        • String ID: AppendToFile$EnableLogging$LogFilePath$LogToFile$LogToOutputDebug$LoggingLevel$LoggingSettings$SWUpdater.log$ShowTime
                                                                                        • API String ID: 83056003-4165658562
                                                                                        • Opcode ID: bca0683641e1da36868b9db574e3dbf32fcf5b66c3b246eba42fd4a1f895fe53
                                                                                        • Instruction ID: 68e24dc2fe01d6377d8c73e658f543ef4be368f9d535e39efe0b79beb6c2cf83
                                                                                        • Opcode Fuzzy Hash: bca0683641e1da36868b9db574e3dbf32fcf5b66c3b246eba42fd4a1f895fe53
                                                                                        • Instruction Fuzzy Hash: 38716967B0C68296EB14CF29D4066A97BA0FB40B98F454535DB2E93652DF3CF568C700
                                                                                        Function 00007FF6B3534968 Relevance: 13.5, APIs: 9, Instructions: 42clipboardmemorystringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlocklstrlen
                                                                                        • String ID:
                                                                                        • API String ID: 2633044538-0
                                                                                        • Opcode ID: 27f35525045d9171a78b146a570c80a2199da98478b94d029d1546d99f4c38ed
                                                                                        • Instruction ID: 9ee5977fe035fb709837452f34e7131ee682d549a209d34e6601fddbfd1ac643
                                                                                        • Opcode Fuzzy Hash: 27f35525045d9171a78b146a570c80a2199da98478b94d029d1546d99f4c38ed
                                                                                        • Instruction Fuzzy Hash: 5A012D26B0D74282EB585B69A94A13963A9AF48FC1F084538DF1FA7768EE3CE4558300
                                                                                        Function 00007FF6B3539E38 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                        • String ID:
                                                                                        • API String ID: 1239891234-0
                                                                                        • Opcode ID: df548436a9a07ec0d6bf9f8c4e946ab9dff518778ccc648dcba72631c7de686d
                                                                                        • Instruction ID: cfa79a912db3775aa57f1ddcde5b96fbc32dce983ee380d957951a429044ce39
                                                                                        • Opcode Fuzzy Hash: df548436a9a07ec0d6bf9f8c4e946ab9dff518778ccc648dcba72631c7de686d
                                                                                        • Instruction Fuzzy Hash: 6E315B3770CB8186DB64CF29E8412AA73A4FB88754F540136EB9E93BA8DF38D555CB00
                                                                                        Function 00007FF6B3534CC4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF6B3534D47
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                        • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                        • API String ID: 450123788-631824599
                                                                                        • Opcode ID: 792917fac419028c1c66a9463eab2e10838692ece48c326b21ed3e2d55a9701e
                                                                                        • Instruction ID: 9dd40e967a4af7fe9e9a394895811839852ae747427daa213de08c262d1cff2b
                                                                                        • Opcode Fuzzy Hash: 792917fac419028c1c66a9463eab2e10838692ece48c326b21ed3e2d55a9701e
                                                                                        • Instruction Fuzzy Hash: 0B113A33B1CB8297E7189B2AD6863B932A4FB44344F414535C75ED2AA4EF3CE0748710
                                                                                        Function 00007FF6B3543D14 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorFileLastWrite$Console
                                                                                        • String ID:
                                                                                        • API String ID: 786612050-0
                                                                                        • Opcode ID: 1637991051e3f441af15b7648503c40555f6d8c781a96736ddf5aeebbb1a5e98
                                                                                        • Instruction ID: db4b6282cd65c93e99dbf2b126ebadcfe08202fa42a12fa1e3777a8ec5815f17
                                                                                        • Opcode Fuzzy Hash: 1637991051e3f441af15b7648503c40555f6d8c781a96736ddf5aeebbb1a5e98
                                                                                        • Instruction Fuzzy Hash: 72D1DE73B4CB819AE715CB69D4951EE7BB1FB44788B540136CB8E97B98DE38E126C300
                                                                                        Function 00007FF6B35352DC Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 61libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin__scrt_fastfail
                                                                                        • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                        • API String ID: 2680415206-3242537097
                                                                                        • Opcode ID: 5cc7492ea17259b107d41c2c691f4a020cb6da5e73ede6c8c8e4ef11cb8afbb1
                                                                                        • Instruction ID: e67d52029ac4225e2ac2aaa1650a05b451dff2eae19204b58e2fc6ac11cdb8e2
                                                                                        • Opcode Fuzzy Hash: 5cc7492ea17259b107d41c2c691f4a020cb6da5e73ede6c8c8e4ef11cb8afbb1
                                                                                        • Instruction Fuzzy Hash: FA213B26B1EA4381FF299B2DE85667423A5AF44741F881834CB1FE26A4EF6CF4548700
                                                                                        Function 00007FF6B3539A48 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86libraryloaderCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryExW.KERNEL32(?,?,?,00007FF6B3539CF6,?,?,?,00007FF6B3537B5C,?,?,?,?,00007FF6B3536E01), ref: 00007FF6B3539ACB
                                                                                        • GetLastError.KERNEL32(?,?,?,00007FF6B3539CF6,?,?,?,00007FF6B3537B5C,?,?,?,?,00007FF6B3536E01), ref: 00007FF6B3539AD9
                                                                                        • LoadLibraryExW.KERNEL32(?,?,?,00007FF6B3539CF6,?,?,?,00007FF6B3537B5C,?,?,?,?,00007FF6B3536E01), ref: 00007FF6B3539B03
                                                                                        • FreeLibrary.KERNEL32(?,?,?,00007FF6B3539CF6,?,?,?,00007FF6B3537B5C,?,?,?,?,00007FF6B3536E01), ref: 00007FF6B3539B49
                                                                                        • GetProcAddress.KERNEL32(?,?,?,00007FF6B3539CF6,?,?,?,00007FF6B3537B5C,?,?,?,?,00007FF6B3536E01), ref: 00007FF6B3539B55
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                        • String ID: api-ms-
                                                                                        • API String ID: 2559590344-2084034818
                                                                                        • Opcode ID: f8fd38fec7b975c1f11a40d9ea812fcd260055e529f47a74ffc4e142dee0ced1
                                                                                        • Instruction ID: f789876794107179678b6b019f242fbafcd1c89ab9518d56154dcb8d7d897777
                                                                                        • Opcode Fuzzy Hash: f8fd38fec7b975c1f11a40d9ea812fcd260055e529f47a74ffc4e142dee0ced1
                                                                                        • Instruction Fuzzy Hash: FA31B063B0EA4295EF259B0AA8126756394FF48BA0F590535DE2FA7784EF3CE0408301
                                                                                        Function 00007FF6B3534854 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExitMessageProcesswsprintf
                                                                                        • String ID: Exception$Exception %x in %s %s %u%hs:%d$base\logging.cc
                                                                                        • API String ID: 1070390611-1730742759
                                                                                        • Opcode ID: e030a8fce372e6a21577cdcdb9e02349ef0226b342d0a5f412455fba04f6e210
                                                                                        • Instruction ID: 5cbeaad139d53d46fdae451db4d86ad6e13ef7f39111a675b452648732d30d41
                                                                                        • Opcode Fuzzy Hash: e030a8fce372e6a21577cdcdb9e02349ef0226b342d0a5f412455fba04f6e210
                                                                                        • Instruction Fuzzy Hash: 9931EA33B1CA8582D720CB29E4412697360FB84B64F544636EB6E93698CF7CE545CB40
                                                                                        Function 00007FF6B354596C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                        • String ID: CONOUT$
                                                                                        • API String ID: 3230265001-3130406586
                                                                                        • Opcode ID: 8faebeb565f8038fa3fe1a53a9d433bad7b25df260ea8a85d523a8a231075bd6
                                                                                        • Instruction ID: 09a35a840cd4d647adbbb03ea8b99af8e0cf9b6c2c053f284d76b8f735570645
                                                                                        • Opcode Fuzzy Hash: 8faebeb565f8038fa3fe1a53a9d433bad7b25df260ea8a85d523a8a231075bd6
                                                                                        • Instruction Fuzzy Hash: 66118E22B1CA4186E7548B1AE84632963A4FB88BE4F400234EF6ED7B98DF3CE454C740
                                                                                        Function 00007FF6B353803C Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 321COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                                                        • String ID: csm$csm$csm
                                                                                        • API String ID: 3523768491-393685449
                                                                                        • Opcode ID: c77e347740f8d5b01af8c340d7d0b22e56d6a275aa49a797d171f2426886df33
                                                                                        • Instruction ID: 24914567eda12df83f30b4645698e5463160a78c8ec013f5f9cbe8137d806165
                                                                                        • Opcode Fuzzy Hash: c77e347740f8d5b01af8c340d7d0b22e56d6a275aa49a797d171f2426886df33
                                                                                        • Instruction Fuzzy Hash: 46E18E73B0C6828AE7259F28D4423ED3BB4FB45758F144235DB9EA7696DE38E489C700
                                                                                        Function 00007FF6B353B64C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                        • API String ID: 4061214504-1276376045
                                                                                        • Opcode ID: 896eeab7b4193552918aec0baa3d090d1ea2d4ed881121a7002e97e7764badaf
                                                                                        • Instruction ID: 5b9927996a2bba74b8cd125e973c63c018ef57bce3667a9079f2e418f86050d6
                                                                                        • Opcode Fuzzy Hash: 896eeab7b4193552918aec0baa3d090d1ea2d4ed881121a7002e97e7764badaf
                                                                                        • Instruction Fuzzy Hash: EDF08267B1E64291EF5C4B68E4863742364EF48B50F041439DB9FD5169CF3CE5A8C750
                                                                                        Function 00007FF6B3544660 Relevance: 7.7, APIs: 5, Instructions: 203COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B35446A1
                                                                                        • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B354461F,?,?,?,00007FF6B3542677), ref: 00007FF6B3544760
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6B354461F,?,?,?,00007FF6B3542677), ref: 00007FF6B35447E0
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
                                                                                        • String ID:
                                                                                        • API String ID: 2210144848-0
                                                                                        • Opcode ID: 9fb06e1996f996bc79b8b55f6337c57f5efcb509944be1cdc2186f6f6199362f
                                                                                        • Instruction ID: 60cabbf851da48ba9d3b5427a3a1273c3d8c6eb7ce0ad9b056611ba38127e0e4
                                                                                        • Opcode Fuzzy Hash: 9fb06e1996f996bc79b8b55f6337c57f5efcb509944be1cdc2186f6f6199362f
                                                                                        • Instruction Fuzzy Hash: 1C81D0A3F9C65289F7289F6988622BD6660BB45B84F444135DB0EF3699DF3CF462C310
                                                                                        Function 00007FF6B3534DA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalSection$EnterInitializeLeave__scrt_fastfail_set_fmode
                                                                                        • String ID:
                                                                                        • API String ID: 2340000568-0
                                                                                        • Opcode ID: 428f457f3a05cf5c3950f6fab0248020118986f0555ad68bc0a8ba1264565168
                                                                                        • Instruction ID: 725ec99c0e0efa591ecbf02fa05dff653e7f94a9d2e500f7e6d3617cd1db3fd6
                                                                                        • Opcode Fuzzy Hash: 428f457f3a05cf5c3950f6fab0248020118986f0555ad68bc0a8ba1264565168
                                                                                        • Instruction Fuzzy Hash: 9B31F253F0C64A86FB34B7B994831B962609F54790F411830EB5FEB697DE2CF8518222
                                                                                        Function 00007FF6B35449A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: _set_statfp
                                                                                        • String ID:
                                                                                        • API String ID: 1156100317-0
                                                                                        • Opcode ID: 02d32093b443671837808a3fa82feeb1329ce00184382959b0602c572b57d788
                                                                                        • Instruction ID: 668c9e2f79729b069dc1134b3c64f954cf96b56274b4a5207871369a969d3fa2
                                                                                        • Opcode Fuzzy Hash: 02d32093b443671837808a3fa82feeb1329ce00184382959b0602c572b57d788
                                                                                        • Instruction Fuzzy Hash: 9311BFA3FECA4342F75C112DE46337910426F58369F544230EB6EB77DE8E2CB8A25204
                                                                                        Function 00007FF6B35347D8 Relevance: 7.5, APIs: 5, Instructions: 30sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountCriticalEnterSectionTick$Sleep
                                                                                        • String ID:
                                                                                        • API String ID: 1544504822-0
                                                                                        • Opcode ID: 2fa53aa83a4ad3886b244f3a0e14fe5243ebdc2de25a0b016fd92ec8a543d21c
                                                                                        • Instruction ID: a7a132dd6ca5cea3eee146a1abf7371c604133bd9bb34e4600fa5ed5cf8e580e
                                                                                        • Opcode Fuzzy Hash: 2fa53aa83a4ad3886b244f3a0e14fe5243ebdc2de25a0b016fd92ec8a543d21c
                                                                                        • Instruction Fuzzy Hash: 29F03067B0C68283E7288F6AB54643DA364EF48B95B045534DB5FE2618DF3CE4969600
                                                                                        Function 00007FF6B353854C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: CallEncodePointerTranslator
                                                                                        • String ID: MOC$RCC
                                                                                        • API String ID: 3544855599-2084237596
                                                                                        • Opcode ID: 2a031a73668bbd159e53d14222a718dc37051844691ea52481b0e74d66d3976e
                                                                                        • Instruction ID: f08f3c0760b264fda6e71bc9da0ea3ac07abf2aad905570a1c30c1d6e72f5591
                                                                                        • Opcode Fuzzy Hash: 2a031a73668bbd159e53d14222a718dc37051844691ea52481b0e74d66d3976e
                                                                                        • Instruction Fuzzy Hash: C2918073B087958AE725CB69D8812ED7BB0F744788F10412AEB4EA7B55DF38E195CB00
                                                                                        Function 00007FF6B3538AC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: __except_validate_context_record
                                                                                        • String ID: csm$csm
                                                                                        • API String ID: 1467352782-3733052814
                                                                                        • Opcode ID: 7bf70d3cea94a261b945160879d4bae21b0ff4136163d0b82a41b4284f935b51
                                                                                        • Instruction ID: 80d6027d1c8621d5f1f287081e59a441855f2e0235210a20a1fc97813b18caac
                                                                                        • Opcode Fuzzy Hash: 7bf70d3cea94a261b945160879d4bae21b0ff4136163d0b82a41b4284f935b51
                                                                                        • Instruction Fuzzy Hash: B771B073B0D68286DB798B2994513B97BA0FB41B98F148135DF8EABA85CE3CE455C700
                                                                                        Function 00007FF6B3538F04 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: CreateFrameInfo__except_validate_context_record
                                                                                        • String ID: csm
                                                                                        • API String ID: 2558813199-1018135373
                                                                                        • Opcode ID: e6996dfaea7478863a0742ae78d009bdd939c062c4b5082ade191e7abdde7a24
                                                                                        • Instruction ID: 74b02fbfa70be1a735ff8a8ad54a515b003c265854ae27df2e1e4a39ea339614
                                                                                        • Opcode Fuzzy Hash: e6996dfaea7478863a0742ae78d009bdd939c062c4b5082ade191e7abdde7a24
                                                                                        • Instruction Fuzzy Hash: BB513C77B1C68186D730AB19E44226E77B8FB89B91F144234DB8E97B55CF38E4A1CB00
                                                                                        Function 00007FF6B353AF70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B353AFA2
                                                                                          • Part of subcall function 00007FF6B353EEEC: HeapFree.KERNEL32(?,?,01F7A02583480000,00007FF6B3541CB0,?,?,?,00007FF6B3541CF3,?,?,0000A04F561556C4,00007FF6B35421B8,?,?,00007FF6B353BCAE,00007FF6B35420EB), ref: 00007FF6B353EF02
                                                                                          • Part of subcall function 00007FF6B353EEEC: GetLastError.KERNEL32(?,?,01F7A02583480000,00007FF6B3541CB0,?,?,?,00007FF6B3541CF3,?,?,0000A04F561556C4,00007FF6B35421B8,?,?,00007FF6B353BCAE,00007FF6B35420EB), ref: 00007FF6B353EF14
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorFreeHeapLast_invalid_parameter_noinfo
                                                                                        • String ID: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe$SWUpdater.log
                                                                                        • API String ID: 2724796048-299348560
                                                                                        • Opcode ID: e4cbac263c5b6d9530d1922fa37896d1ecadf8da808b77419f0c840d5f08b4ea
                                                                                        • Instruction ID: 1f162da401d2e45ca74aee3c598127d8e7b27963e2e91a692183984948e4afc9
                                                                                        • Opcode Fuzzy Hash: e4cbac263c5b6d9530d1922fa37896d1ecadf8da808b77419f0c840d5f08b4ea
                                                                                        • Instruction Fuzzy Hash: 84413A37B0CA5286EB29DF29D4421F867A4AF44784B554036EB8EE7B95DF3DE4918300
                                                                                        Function 00007FF6B3544404 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorFileLastWrite
                                                                                        • String ID: U
                                                                                        • API String ID: 442123175-4171548499
                                                                                        • Opcode ID: 7605856e371207e76eb448a082655dbcfbf94769ca868ad3f6a9b2e88cd79327
                                                                                        • Instruction ID: 405cc7c0f485886239a84bb3cafce2157d7c7d9f03c8f2249b91db36d0b3a675
                                                                                        • Opcode Fuzzy Hash: 7605856e371207e76eb448a082655dbcfbf94769ca868ad3f6a9b2e88cd79327
                                                                                        • Instruction Fuzzy Hash: F341BF63B5CA8582DB208F29E4563AA67A0FB88784F844031EF4DD7B98DF3CE455CB40
                                                                                        Function 00007FF6B3542C44 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: _handle_errorf
                                                                                        • String ID: "$powf
                                                                                        • API String ID: 2315412904-603753351
                                                                                        • Opcode ID: e5c042fedd86e09985f8106f74016b6a6e29da37bd933d099ffcbec5012f991f
                                                                                        • Instruction ID: fb37fb72090341a53d1589d44aa62d0d001b3ef07be2c38c5141f2f84899c16b
                                                                                        • Opcode Fuzzy Hash: e5c042fedd86e09985f8106f74016b6a6e29da37bd933d099ffcbec5012f991f
                                                                                        • Instruction Fuzzy Hash: 89418473D2C680CAD370CF26E0857AABAA0F799348F111329F74952998CF7DC5619B00
                                                                                        Function 00007FF6B3542B20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: _handle_error
                                                                                        • String ID: "$pow
                                                                                        • API String ID: 1757819995-713443511
                                                                                        • Opcode ID: 37f818b7bbb6705ae683270610ee7ff71421bb80f9f4b9b23e0f54d6a79d9fdc
                                                                                        • Instruction ID: 223f9da526ea713e1b732d9c47d77d3ac7fcb30d05d40e9f071ff4902ab3c740
                                                                                        • Opcode Fuzzy Hash: 37f818b7bbb6705ae683270610ee7ff71421bb80f9f4b9b23e0f54d6a79d9fdc
                                                                                        • Instruction Fuzzy Hash: 0A31AE73E1CA8882D374CF14E04276ABAA0FBDA344F201325F78A56A58CFBDD0959F00
                                                                                        Function 00007FF6B353F320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: Stringtry_get_function
                                                                                        • String ID: LCMapStringEx
                                                                                        • API String ID: 2588686239-3893581201
                                                                                        • Opcode ID: 9ce1ffc00b70d7c3bfbd357397bae16e887ef19e4f94e2e9c903a8d135f276b1
                                                                                        • Instruction ID: cab02eed68fc6557867cee353a34fb93592f6917093bc0c270ae28f0b6911802
                                                                                        • Opcode Fuzzy Hash: 9ce1ffc00b70d7c3bfbd357397bae16e887ef19e4f94e2e9c903a8d135f276b1
                                                                                        • Instruction Fuzzy Hash: F111F736B0CB8186D7648B1AB4412AAB7A5FB89B90F544136EF8E93B19DF3CD5508B40
                                                                                        Function 00007FF6B353783C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B353609E), ref: 00007FF6B3537880
                                                                                        • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B353609E), ref: 00007FF6B35378C6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExceptionFileHeaderRaise
                                                                                        • String ID: csm
                                                                                        • API String ID: 2573137834-1018135373
                                                                                        • Opcode ID: fd58c0ec48a25f02d05cf2982483287a24e519e2e4fda1c6c388a382a8cd52ac
                                                                                        • Instruction ID: a3b44ca3c7e73a9184fb58ef6df031cfed741a73584059050bfe9a4957e89e4e
                                                                                        • Opcode Fuzzy Hash: fd58c0ec48a25f02d05cf2982483287a24e519e2e4fda1c6c388a382a8cd52ac
                                                                                        • Instruction Fuzzy Hash: FC114C37A0CB8182EB248F19E440269B7A9FB88B94F184230DF8D57768DF3CD551CB00
                                                                                        Function 00007FF6B353F2BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • try_get_function.LIBVCRUNTIME ref: 00007FF6B353F2ED
                                                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000000,00007FF6B353BEDC,?,?,?,?,?,?,?,?,00007FF6B353B717), ref: 00007FF6B353F307
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountCriticalInitializeSectionSpintry_get_function
                                                                                        • String ID: InitializeCriticalSectionEx
                                                                                        • API String ID: 539475747-3084827643
                                                                                        • Opcode ID: c2072e6e72fe8849faf4356e71b0fed31281932c4678123c2caaf772d80cbbaf
                                                                                        • Instruction ID: 215d073565ada6ad91fd02e3cfec7f3c61d3fd9300e147f45935fac30bc31f1f
                                                                                        • Opcode Fuzzy Hash: c2072e6e72fe8849faf4356e71b0fed31281932c4678123c2caaf772d80cbbaf
                                                                                        • Instruction Fuzzy Hash: 85F0B427B0C74181EB184B49F9014A82261AF48B80F445031DB1E63B5CCF3CE595C700
                                                                                        Function 00007FF6B353F268 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • try_get_function.LIBVCRUNTIME ref: 00007FF6B353F291
                                                                                        • TlsSetValue.KERNEL32(?,?,0000A04F561556C4,00007FF6B353EE0A,?,?,0000A04F561556C4,00007FF6B353A1A5,?,?,?,?,00007FF6B353FC32,?,?,00000000), ref: 00007FF6B353F2A8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000004.00000002.1742684092.00007FF6B3531000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF6B3530000, based on PE: true
                                                                                        • Associated: 00000004.00000002.1742666213.00007FF6B3530000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742702646.00007FF6B3547000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742721596.00007FF6B3559000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B355D000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        • Associated: 00000004.00000002.1742734148.00007FF6B3560000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_4_2_7ff6b3530000_SWUpdaterComRegisterShell64.jbxd
                                                                                        Similarity
                                                                                        • API ID: Valuetry_get_function
                                                                                        • String ID: FlsSetValue
                                                                                        • API String ID: 738293619-3750699315
                                                                                        • Opcode ID: 4534e87c6f0c1169fafc60dc7d244df26cdb92e060b95d38979f39cd3be05e35
                                                                                        • Instruction ID: a300a7757a8ca99778119648eafb21a48c87d40cad755dcdb8cffea4d49874d4
                                                                                        • Opcode Fuzzy Hash: 4534e87c6f0c1169fafc60dc7d244df26cdb92e060b95d38979f39cd3be05e35
                                                                                        • Instruction Fuzzy Hash: C9E06567B0C60292EB1C4B5DFC024F42222AF48780F584131EB2E9625DCE3CE5A5C310

                                                                                        Executed Functions

                                                                                        Function 00883EDB Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 111COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • SetForegroundWindow.USER32(00000000), ref: 00883F29
                                                                                        • ShellExecuteExW.SHELL32(?), ref: 00883F30
                                                                                        • AllowSetForegroundWindow.USER32(00000000), ref: 00883F91
                                                                                        • GetLastError.KERNEL32(?,0000003C,?,?,?,?,?,?,?,00884BB7,?,?), ref: 00883F99
                                                                                          • Part of subcall function 00883A3D: CreateWindowExW.USER32(00000080,STATIC,00000000,90000000,80000000,80000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00883A7E
                                                                                          • Part of subcall function 00883A3D: SetForegroundWindow.USER32(?), ref: 00883A9A
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,00884BB7,?,?), ref: 00883FE1
                                                                                        • DestroyWindow.USER32(?,?,?,?,?,?,?,00884BB7,?,?), ref: 00883FF1
                                                                                        • SetLastError.KERNEL32(00000000,?,?,?,?,?,?,00884BB7,?,?), ref: 00883FFE
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$ErrorForegroundLast$AllowCreateDestroyExecuteShell
                                                                                        • String ID: [Started process][%u]$[Started process][PID unknown]$runas
                                                                                        • API String ID: 529189794-1668918608
                                                                                        • Opcode ID: b5c83b635d98ad71b77de9576f39193e11e7e6b83e622387999e57f20a2923d8
                                                                                        • Instruction ID: 21dee6b4494dda55427e27b46ddb0659bacae2a94f467fc4af988bcb27113d07
                                                                                        • Opcode Fuzzy Hash: b5c83b635d98ad71b77de9576f39193e11e7e6b83e622387999e57f20a2923d8
                                                                                        • Instruction Fuzzy Hash: 9531E471E043159FDB18BFB998459BE7BF8FF05B10B14442EFA12E2241EE34DA018BA0
                                                                                        Function 00881586 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 0088159A
                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 008815A1
                                                                                        • CoInitializeEx.OLE32(00000000,00000004), ref: 008815B6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressHandleInitializeModuleProc
                                                                                        • String ID: SetDefaultDllDirectories$kernel32.dll
                                                                                        • API String ID: 3965314501-2102062458
                                                                                        • Opcode ID: 5e62f8335066a67668596b396e6be954b54613e5facae34190db6da17b0e5eb6
                                                                                        • Instruction ID: e75f3f94e064dd3c6946c8bc45b50cc2ff8dacb16f701deff728bbf2787641d2
                                                                                        • Opcode Fuzzy Hash: 5e62f8335066a67668596b396e6be954b54613e5facae34190db6da17b0e5eb6
                                                                                        • Instruction Fuzzy Hash: 3A0108315043119BD754FB78EC4AA5A7798FF80B60F04862AF995C7291EE309800C7A3
                                                                                        Function 0088D038 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 289 88d038-88d045 call 890578 292 88d067-88d073 call 88d07a ExitProcess 289->292 293 88d047-88d055 GetPEB 289->293 293->292 295 88d057-88d061 GetCurrentProcess TerminateProcess 293->295 295->292
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(?,?,0088D037,00000100,00000000,?,00000100,?,0088E21B), ref: 0088D05A
                                                                                        • TerminateProcess.KERNEL32(00000000,?,0088D037,00000100,00000000,?,00000100,?,0088E21B), ref: 0088D061
                                                                                        • ExitProcess.KERNEL32 ref: 0088D073
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                        • String ID:
                                                                                        • API String ID: 1703294689-0
                                                                                        • Opcode ID: 7c94604f29b84073ff4bc30f56b16324da4c1648ac2e07919ecb7dc9f1f8f238
                                                                                        • Instruction ID: 373e470ce8d94a1dc6bb7fd4df48b72a8b3ee0897775f5f7a5736f4274f85ef5
                                                                                        • Opcode Fuzzy Hash: 7c94604f29b84073ff4bc30f56b16324da4c1648ac2e07919ecb7dc9f1f8f238
                                                                                        • Instruction Fuzzy Hash: 12E0B672000B48AFCF217B58ED09A583B69FB40741F084416F909CA972CB36ED92DB95
                                                                                        Function 00882038 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 35 882038-88205e call 88186f call 88247a 40 882064-88208b call 881e78 35->40 41 8821a7-8821b5 call 881246 35->41 46 882091-882097 40->46 47 882192 40->47 49 88209d-8820a1 46->49 50 882151-882158 call 882266 46->50 48 882195-88219e 47->48 48->41 51 8821a0-8821a1 RegCloseKey 48->51 52 882138-88214f call 8821b6 49->52 53 8820a7-8820aa 49->53 58 88215d 50->58 51->41 52->58 56 88212a-882136 call 88222d 53->56 57 8820ac-8820af 53->57 56->58 61 8820b1-8820b4 57->61 62 8820f3-882117 call 8821b6 57->62 63 88215f-882166 58->63 65 8820c0-8820e6 SHQueryValueExW 61->65 66 8820b6-8820bb 61->66 62->63 75 882119-882128 call 8822fd 62->75 67 882168-882173 RegCloseKey 63->67 68 88218a-88218c 63->68 65->63 70 8820e8-8820f1 65->70 66->63 71 88217e-882187 67->71 72 882175-882178 67->72 68->48 74 88218e-882190 68->74 70->63 71->68 72->71 74->48 75->58
                                                                                        APIs
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKLM,00000000,00000000,?,00000000,00000000,00000000,80070003,00000000,LastCoreRun,00000000), ref: 0088251A
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_LOCAL_MACHINE), ref: 00882526
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKCU), ref: 00882532
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_CURRENT_USER), ref: 00882542
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKU), ref: 0088254E
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_USERS), ref: 0088255A
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKCR), ref: 00882566
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_CLASSES_ROOT), ref: 00882572
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKLM[64]), ref: 0088257E
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_LOCAL_MACHINE[64]), ref: 0088258A
                                                                                          • Part of subcall function 00881E78: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,00000000,80070003,?,?,?,00882087,00000000,?,?,HKLM\Software\Wavesor\SWUpdater\,00000000,00000000), ref: 00881EB1
                                                                                        • SHQueryValueExW.SHLWAPI(00000000,LastCoreRun,00000000,00000000,?,?,00000000,?,?,HKLM\Software\Wavesor\SWUpdater\,00000000,00000000), ref: 008820DC
                                                                                        • RegCloseKey.KERNELBASE(00000000,LastCoreRun,?,00000000,?,?,HKLM\Software\Wavesor\SWUpdater\,00000000,00000000), ref: 00882169
                                                                                        • RegCloseKey.ADVAPI32(00000000,00000000,?,?,HKLM\Software\Wavesor\SWUpdater\,00000000,00000000), ref: 008821A1
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrcmpi$Close$OpenQueryValue
                                                                                        • String ID: HKLM\Software\Wavesor\SWUpdater\$LastCoreRun
                                                                                        • API String ID: 645971292-1845064260
                                                                                        • Opcode ID: 6396d6aa266173ce5ca6de3770742f9c72664867b1fedc54b187b03d43713696
                                                                                        • Instruction ID: c94b8764475eb44645f203bc2339019a52223eacae95fb93aaa06b73a6b6a497
                                                                                        • Opcode Fuzzy Hash: 6396d6aa266173ce5ca6de3770742f9c72664867b1fedc54b187b03d43713696
                                                                                        • Instruction Fuzzy Hash: 0641937990010AABDF01EFA8C959AFEBBB9FF44354F204159A605E7251EF30EA05DB60
                                                                                        Function 008814A4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 78 8814a4-8814b6 call 881429 81 8814c8-881508 call 88791b call 8879dd call 88787f call 884b6e 78->81 82 8814b8 78->82 94 88150a 81->94 95 88150c-881513 call 881246 81->95 83 8814ba-8814bf 82->83 84 8814c1-8814c3 82->84 83->81 83->84 86 881577-88157b 84->86 94->95 98 881553-881557 95->98 99 881515-88152f call 8817f1 call 89cbe0 95->99 101 881559-88155c CloseHandle 98->101 102 881562-881575 call 881246 call 88797a 98->102 110 881531 99->110 111 881536-881549 call 881edd 99->111 101->102 102->86 110->111 113 88154e-881551 111->113 113->98
                                                                                        APIs
                                                                                          • Part of subcall function 00881429: __aulldiv.LIBCMT ref: 00881443
                                                                                        • __aulldiv.LIBCMT ref: 00881523
                                                                                        • CloseHandle.KERNEL32(00000000,?), ref: 0088155C
                                                                                        Strings
                                                                                        • HKCU\Software\Wavesor\SWUpdater\, xrefs: 00881531
                                                                                        • HKLM\Software\Wavesor\SWUpdater\, xrefs: 00881528
                                                                                        • LastCoreRun, xrefs: 00881542
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: __aulldiv$CloseHandle
                                                                                        • String ID: HKCU\Software\Wavesor\SWUpdater\$HKLM\Software\Wavesor\SWUpdater\$LastCoreRun
                                                                                        • API String ID: 3257685854-1484479183
                                                                                        • Opcode ID: 528ea3dade694061fb8e78ceae6a0c62912c974acceb879fda3ca331f0e14422
                                                                                        • Instruction ID: 1470c204cc3a4a45411b6e850f3266723cfd36a963eae499e525477f246b6aea
                                                                                        • Opcode Fuzzy Hash: 528ea3dade694061fb8e78ceae6a0c62912c974acceb879fda3ca331f0e14422
                                                                                        • Instruction Fuzzy Hash: 9721DA71A00119A7DF04F7A89C497EEB7BDFF80750F104069E516E3281DF349E068765
                                                                                        Function 00884F4D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64libraryloaderCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 114 884f4d-884f66 call 886a01 117 884f68-884f70 114->117 118 884fa9-884fb8 call 884f11 114->118 120 884f72-884f7f GetModuleHandleW 117->120 121 884fa4-884fa7 GetProcessId 117->121 126 884fba-884fd7 call 88a040 118->126 127 884fde 118->127 124 884f99-884fa2 call 886cc5 120->124 125 884f81-884f97 GetProcAddress 120->125 122 884fe0-884fe3 121->122 124->121 124->127 125->121 125->124 126->127 133 884fd9-884fdc 126->133 127->122 133->122
                                                                                        APIs
                                                                                          • Part of subcall function 00886A01: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003,?,?,00000000), ref: 00886A67
                                                                                          • Part of subcall function 00886A01: VerSetConditionMask.KERNEL32(00000000), ref: 00886A6B
                                                                                          • Part of subcall function 00886A01: VerSetConditionMask.KERNEL32(00000000), ref: 00886A6F
                                                                                          • Part of subcall function 00886A01: VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 00886A96
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,00883F50,?), ref: 00884F77
                                                                                        • GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00884F87
                                                                                        • GetProcessId.KERNELBASE(?,?,?,?,?,?,?,?,?,00883F50,?), ref: 00884FA5
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConditionMask$AddressHandleInfoModuleProcProcessVerifyVersion
                                                                                        • String ID: GetProcessId$kernel32.dll
                                                                                        • API String ID: 1983903259-399901964
                                                                                        • Opcode ID: 9d37bd6bc80953b4be19fb7e97a582be441f65d80ae7ada6b3213dd11e6049b5
                                                                                        • Instruction ID: c63b4f23c62d8b7bf801e35444c34440ba1c046d33362c177b28bfaaca3f811d
                                                                                        • Opcode Fuzzy Hash: 9d37bd6bc80953b4be19fb7e97a582be441f65d80ae7ada6b3213dd11e6049b5
                                                                                        • Instruction Fuzzy Hash: EF11A932E40636AA9724B7B55D05FAF3B6CFF41B55B105019FA01E7141EE64DD0187E1
                                                                                        Function 00881EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126registryCOMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 154 881edd-881f07 call 88186f call 88247a 159 882029-882037 call 881246 154->159 160 881f0d-881f38 call 881e0c 154->160 165 881f3e-881f44 160->165 166 882014 160->166 168 881f4a-881f4d 165->168 169 881fd1 165->169 167 882017-882020 166->167 167->159 170 882022-882023 RegCloseKey 167->170 171 881fcd-881fcf 168->171 172 881f4f-881f52 168->172 173 881fd3-881fda call 88238c 169->173 170->159 171->173 174 881fbe-881fcb 172->174 175 881f54-881f57 172->175 180 881fdf 173->180 177 881f7d-881f8f RegSetValueExW 174->177 178 881f59-881f5c 175->178 179 881faf-881fbc call 882363 175->179 181 881fe1-881fe8 177->181 182 881f91-881f9a 177->182 184 881f9c-881fad call 8823c8 178->184 185 881f5e-881f61 178->185 179->180 180->181 190 881fea-881ff5 RegCloseKey 181->190 191 88200c-88200e 181->191 182->181 184->180 188 881f6a-881f7b 185->188 189 881f63-881f68 185->189 188->177 189->181 194 882000-882009 190->194 195 881ff7-881ffa 190->195 191->167 192 882010-882012 191->192 192->167 194->191 195->194
                                                                                        APIs
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKLM,00000000,00000000,?,00000000,00000000,00000000,80070003,00000000,LastCoreRun,00000000), ref: 0088251A
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_LOCAL_MACHINE), ref: 00882526
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKCU), ref: 00882532
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_CURRENT_USER), ref: 00882542
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKU), ref: 0088254E
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_USERS), ref: 0088255A
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKCR), ref: 00882566
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_CLASSES_ROOT), ref: 00882572
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKLM[64]), ref: 0088257E
                                                                                          • Part of subcall function 0088247A: lstrcmpiW.KERNEL32(?,HKEY_LOCAL_MACHINE[64]), ref: 0088258A
                                                                                          • Part of subcall function 00881E0C: RegCreateKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,?,?,80070003,?,00002710,?,00881F34,00000000,?), ref: 00881E4C
                                                                                        • RegSetValueExW.KERNELBASE(00000000,?,00000000,00000003,?,?,00000000,?,?,?,?,?,?,HKLM\Software\Wavesor\SWUpdater\,00000000,?), ref: 00881F85
                                                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,?,?,?,?,?,?,HKLM\Software\Wavesor\SWUpdater\,00000000,?), ref: 00881FEB
                                                                                        • RegCloseKey.ADVAPI32(00000000,00000000,?,?,?,?,?,?,HKLM\Software\Wavesor\SWUpdater\,00000000,?), ref: 00882023
                                                                                        Strings
                                                                                        • HKLM\Software\Wavesor\SWUpdater\, xrefs: 00881EE9
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrcmpi$Close$CreateValue
                                                                                        • String ID: HKLM\Software\Wavesor\SWUpdater\
                                                                                        • API String ID: 2977736647-4267033738
                                                                                        • Opcode ID: 876bb1bc6bce76e238d850a28ded7baa43eb25d717700e366de1542cd202fc1f
                                                                                        • Instruction ID: e86f83e782e6eebcdd7f513f7c7d5d503698957ea0c23dd69ec47d79bd998f51
                                                                                        • Opcode Fuzzy Hash: 876bb1bc6bce76e238d850a28ded7baa43eb25d717700e366de1542cd202fc1f
                                                                                        • Instruction Fuzzy Hash: 8F41BC7190020AABDF15EBA9C859BBE7BB9FB40314F144019B601E7290DF349E02DB61
                                                                                        Function 00886E47 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 196 886e47-886e62 GetFileVersionInfoSizeW 197 886ed4 196->197 198 886e64-886e7d call 89a3d9 GetFileVersionInfoW 196->198 200 886ed6-886ed9 197->200 202 886e8a-886ea9 VerQueryValueW 198->202 203 886e7f-886e88 call 889ed8 198->203 205 886eab-886eae 202->205 206 886ec7-886ec9 call 889ed8 202->206 210 886ece-886ed3 203->210 205->206 208 886eb0-886ec5 205->208 206->210 208->200 210->197
                                                                                        APIs
                                                                                        • GetFileVersionInfoSizeW.KERNELBASE(?,?,?,00000000), ref: 00886E58
                                                                                        • GetFileVersionInfoW.KERNELBASE(?,?,00000000,00000000,?,00000000), ref: 00886E75
                                                                                        • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,00000000), ref: 00886EA1
                                                                                        Strings
                                                                                        • \VarFileInfo\Translation, xrefs: 00886E97
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileInfoVersion$QuerySizeValue
                                                                                        • String ID: \VarFileInfo\Translation
                                                                                        • API String ID: 2179348866-675650646
                                                                                        • Opcode ID: 89893a0526138ce5936a07b14d8b0e8da9bd58ed7b590281480c783522cf4de7
                                                                                        • Instruction ID: cad8277d8772b06cc93139f7f957050524100d76f92a449c4dc7c8ba03f95315
                                                                                        • Opcode Fuzzy Hash: 89893a0526138ce5936a07b14d8b0e8da9bd58ed7b590281480c783522cf4de7
                                                                                        • Instruction Fuzzy Hash: 56115175500208EFDB21AF69D8048BFBFF9FF94741B24442AE885D2610E7719950EB50
                                                                                        Function 00881429 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 211 881429-881454 call 8817f1 call 89cbe0 216 88145b-881477 call 882038 211->216 217 881456 211->217 220 881479-88147f 216->220 221 881481 216->221 217->216 222 881483-881488 220->222 221->222 223 88148a 222->223 224 881497-88149d 222->224 225 88148c-88148e 223->225 226 881490-881495 223->226 227 88149f-8814a3 224->227 225->224 225->226 226->227
                                                                                        APIs
                                                                                          • Part of subcall function 008817F1: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00881439), ref: 00881811
                                                                                        • __aulldiv.LIBCMT ref: 00881443
                                                                                        Strings
                                                                                        • HKCU\Software\Wavesor\SWUpdater\, xrefs: 00881456
                                                                                        • HKLM\Software\Wavesor\SWUpdater\, xrefs: 0088144D
                                                                                        • LastCoreRun, xrefs: 00881465
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Time$FileSystem__aulldiv
                                                                                        • String ID: HKCU\Software\Wavesor\SWUpdater\$HKLM\Software\Wavesor\SWUpdater\$LastCoreRun
                                                                                        • API String ID: 2838486344-1484479183
                                                                                        • Opcode ID: af063b76cebcf8ee22b91be2c032c2d1ccca7450fc0ed22d0ed02c235922257e
                                                                                        • Instruction ID: ab7c2c528422a61b295836c4ffd6b3d4bcdc96b10a741eb671f6a7568678d37b
                                                                                        • Opcode Fuzzy Hash: af063b76cebcf8ee22b91be2c032c2d1ccca7450fc0ed22d0ed02c235922257e
                                                                                        • Instruction Fuzzy Hash: 9501FC71F001246B9F14B6AD4C0996F7BAFFF81B50F104025F511E7240DE709D0687E8
                                                                                        Function 00883CD2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 228 883cd2-883ced 229 883cf9-883d2d call 8818f5 call 88a040 SHGetFolderPathW 228->229 230 883cef-883cf4 228->230 238 883d7a-883d96 call 892b12 call 8819d4 229->238 239 883d2f-883d35 229->239 231 883d99-883da6 call 8892de 230->231 251 883d98 238->251 241 883d3e-883d41 239->241 242 883d37-883d3c 239->242 245 883d69-883d6f 241->245 246 883d43 241->246 244 883d48-883d64 call 88400c call 881821 call 881246 242->244 244->245 247 883d71-883d74 245->247 248 883d76-883d78 245->248 246->244 247->251 248->251 251->231
                                                                                        APIs
                                                                                        • SHGetFolderPathW.SHELL32(00000000,00000028,00000000,00000000,?,00000000,00000028,00000000), ref: 00883D23
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: FolderPath
                                                                                        • String ID: LocalAppData$ProgramFiles
                                                                                        • API String ID: 1514166925-2363656367
                                                                                        • Opcode ID: b21aa959a9eace182fefa4461cbfd127d83e7f6291b1aa433e09860652aab9e8
                                                                                        • Instruction ID: 33fdb1dbdb3e7ac169ae6a5f20ca82b141bf1ba9baeab766cb58a198e886709e
                                                                                        • Opcode Fuzzy Hash: b21aa959a9eace182fefa4461cbfd127d83e7f6291b1aa433e09860652aab9e8
                                                                                        • Instruction Fuzzy Hash: 1F212771600218A7DB24FA69DC8DDBF73ACFF85B10F20406AE416D7242EE349F458761
                                                                                        Function 00883A3D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 257 883a3d-883a8b CreateWindowExW 258 883a8d-883a9a call 8838a0 SetForegroundWindow 257->258 259 883aa0-883aa5 257->259 258->259
                                                                                        APIs
                                                                                        • CreateWindowExW.USER32(00000080,STATIC,00000000,90000000,80000000,80000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00883A7E
                                                                                          • Part of subcall function 008838A0: GetWindowLongW.USER32(?,000000F0), ref: 008838BC
                                                                                          • Part of subcall function 008838A0: GetParent.USER32(?), ref: 008838CE
                                                                                          • Part of subcall function 008838A0: GetWindowRect.USER32(?,?), ref: 008838E8
                                                                                          • Part of subcall function 008838A0: GetWindowLongW.USER32(00000000,000000F0), ref: 008838F9
                                                                                          • Part of subcall function 008838A0: MonitorFromWindow.USER32(?,00000002), ref: 00883911
                                                                                          • Part of subcall function 008838A0: GetMonitorInfoW.USER32(00000000,?), ref: 00883927
                                                                                        • SetForegroundWindow.USER32(?), ref: 00883A9A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$LongMonitor$CreateForegroundFromInfoParentRect
                                                                                        • String ID: STATIC
                                                                                        • API String ID: 2875497296-1882779555
                                                                                        • Opcode ID: b479e276ce3fab7c3c224f4b30a37c7c008a2e48f51eddbad84fc6e3a4033ef7
                                                                                        • Instruction ID: 9b1b89a511cba8157aa6eaa4c187015c3568bc48a5e1237e62cf9e2b37b0c5ba
                                                                                        • Opcode Fuzzy Hash: b479e276ce3fab7c3c224f4b30a37c7c008a2e48f51eddbad84fc6e3a4033ef7
                                                                                        • Instruction Fuzzy Hash: 92F06273602220BFE7149BA9DE09DAB7FBCF7C6B50B08014DB802E3A10D660AD00C7B4
                                                                                        Function 00884509 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 262 884509-884525 263 88452b-884549 GetTokenInformation GetLastError 262->263 264 8845bd 262->264 263->264 266 88454b-884558 263->266 265 8845bf-8845d0 call 8892de 264->265 268 88455a-884566 call 882953 266->268 269 884571-88457d call 884451 266->269 268->269 276 884568-88456f call 899f90 268->276 275 88457f-884581 269->275 278 8845a8-8845aa 275->278 279 884583-88459a GetTokenInformation 275->279 276->275 282 8845b5-8845b7 278->282 279->278 281 88459c-8845a6 call 882cb8 279->281 281->282 284 8845b9-8845bb 282->284 285 8845ac-8845b4 call 88ca02 282->285 284->265 285->282
                                                                                        APIs
                                                                                        • GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000,00000000,00000000,008A8C00,00000000), ref: 0088453A
                                                                                        • GetLastError.KERNEL32 ref: 00884540
                                                                                        • GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000,00000000), ref: 00884592
                                                                                          • Part of subcall function 0088CA02: _free.LIBCMT ref: 0088CA15
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: InformationToken$ErrorLast_free
                                                                                        • String ID:
                                                                                        • API String ID: 3302994184-0
                                                                                        • Opcode ID: 2fa3d35d554ecb10f448a6bb9c9434554deea65fe07d4d11fdf04fe8e66f0126
                                                                                        • Instruction ID: 42f547b20ba33bd154d483ff55a01205674937eedc00e0ad13975de6dd20334b
                                                                                        • Opcode Fuzzy Hash: 2fa3d35d554ecb10f448a6bb9c9434554deea65fe07d4d11fdf04fe8e66f0126
                                                                                        • Instruction Fuzzy Hash: 5B218E32A0011AEFDF00FFA8D845AAEBBB8FF04354F255069E911E7251DB70AE05CB90
                                                                                        Function 00884B6E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 69COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 374 884b6e-884bb9 call 88a040 call 883edb 379 884bbb-884bd3 call 886cc5 374->379 380 884c06-884c0b 374->380 387 884c02-884c04 379->387 388 884bd5-884bff call 885b83 call 883a1e 379->388 382 884c0d-884c12 380->382 383 884c14-884c17 CloseHandle 380->383 385 884c1d 382->385 383->385 386 884c1f-884c23 385->386 387->386 388->387
                                                                                        APIs
                                                                                          • Part of subcall function 00883EDB: SetForegroundWindow.USER32(00000000), ref: 00883F29
                                                                                          • Part of subcall function 00883EDB: ShellExecuteExW.SHELL32(?), ref: 00883F30
                                                                                          • Part of subcall function 00883EDB: AllowSetForegroundWindow.USER32(00000000), ref: 00883F91
                                                                                          • Part of subcall function 00883EDB: DestroyWindow.USER32(?,?,?,?,?,?,?,00884BB7,?,?), ref: 00883FF1
                                                                                          • Part of subcall function 00883EDB: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,00884BB7,?,?), ref: 00883FFE
                                                                                          • Part of subcall function 00886CC5: GetLastError.KERNEL32(?,0088404A), ref: 00886CC6
                                                                                          • Part of subcall function 00886CC5: RaiseException.KERNEL32(00000000,00000001,00000000,00000000), ref: 00886CF8
                                                                                        • CloseHandle.KERNEL32(?,?,?), ref: 00884C17
                                                                                        Strings
                                                                                        • [Failed to ::ShellExecuteEx][%s][%s][0x%08x], xrefs: 00884BF4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$ErrorForegroundLast$AllowCloseDestroyExceptionExecuteHandleRaiseShell
                                                                                        • String ID: [Failed to ::ShellExecuteEx][%s][%s][0x%08x]
                                                                                        • API String ID: 3968947463-972892863
                                                                                        • Opcode ID: 5017377e830086ec019c44dcb786f07734f420814cc0be388aa719e8a328c1e3
                                                                                        • Instruction ID: 9dc3457ac68ed4236f33bb97c425750873f1a528f0d937e417bffa57558af977
                                                                                        • Opcode Fuzzy Hash: 5017377e830086ec019c44dcb786f07734f420814cc0be388aa719e8a328c1e3
                                                                                        • Instruction Fuzzy Hash: 0A11B1B1E01218ABDB14EFA9DC45EEEBBB8FF44724F10412AF516E7291D7744904CB61
                                                                                        Function 00883823 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                                                        Download Yara Rule

                                                                                        Control-flow Graph

                                                                                        • Executed
                                                                                        • Not Executed
                                                                                        control_flow_graph 393 883823-88382a 394 88382c-883830 393->394 395 883842-883846 393->395 396 88383e 394->396 397 883832-883838 UnloadUserProfile 394->397 398 883848-883851 FindCloseChangeNotification 395->398 399 883855-883866 call 889725 395->399 396->395 397->396 398->399
                                                                                        APIs
                                                                                        • UnloadUserProfile.USERENV(?,?,00000000,00883EC9,00000000,?,00000000), ref: 00883838
                                                                                        • FindCloseChangeNotification.KERNELBASE(?,00000000,00883EC9,00000000,?,00000000), ref: 0088384B
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ChangeCloseFindNotificationProfileUnloadUser
                                                                                        • String ID:
                                                                                        • API String ID: 122385185-0
                                                                                        • Opcode ID: 09b4a9cc3f4eb04273944c804ec1061d56395192df5a8fe9936b3ea93bb386f2
                                                                                        • Instruction ID: 6dfea0a4095d5a333810bc1eed69dd598ab91f88b517e3ee7bb64b505e32a2fc
                                                                                        • Opcode Fuzzy Hash: 09b4a9cc3f4eb04273944c804ec1061d56395192df5a8fe9936b3ea93bb386f2
                                                                                        • Instruction Fuzzy Hash: 88F0C932015B01DFE7366B15E909752B7E1FB00B26F14C82EE1AB518B0D7B5B894DB08
                                                                                        Function 008882A2 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • PathAppendW.SHLWAPI(?,00000000,00000000,00000000,00000028,?,00888B58,Wavesor Software\SWUpdater,00000000,?,008ADA14,00ED2C28,?,?,00887892), ref: 008882F1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AppendPath
                                                                                        • String ID:
                                                                                        • API String ID: 3286331749-0
                                                                                        • Opcode ID: 2b7659c291d3d1f9bc08e7f59c3f35663ad28a14a858e199291f3d97417369c9
                                                                                        • Instruction ID: 9e2f9a85b05dfb49ddd7d0710ec6cb02c7eae76964687012bd4bc26f7407beea
                                                                                        • Opcode Fuzzy Hash: 2b7659c291d3d1f9bc08e7f59c3f35663ad28a14a858e199291f3d97417369c9
                                                                                        • Instruction Fuzzy Hash: 5711E632A00424EBCB15FBACC9559ADB7A9FF84B20B654258F801E7381DF30AE02D781
                                                                                        Function 00883DFF Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetCurrentProcess.KERNEL32(?,00000000), ref: 00883E36
                                                                                          • Part of subcall function 008837E6: GetCurrentProcess.KERNEL32(00000000,?,00883E4A,00000008,00000000,?,00000000), ref: 008837F3
                                                                                          • Part of subcall function 008837E6: OpenProcessToken.ADVAPI32(?,00000000,?,00000000,?,00883E4A,00000008,00000000,?,00000000), ref: 00883801
                                                                                          • Part of subcall function 00886CC5: GetLastError.KERNEL32(?,0088404A), ref: 00886CC6
                                                                                          • Part of subcall function 00886CC5: RaiseException.KERNEL32(00000000,00000001,00000000,00000000), ref: 00886CF8
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Process$Current$ErrorExceptionLastOpenRaiseToken
                                                                                        • String ID:
                                                                                        • API String ID: 2658821620-0
                                                                                        • Opcode ID: 6ca57346ba676a2d709945606685155010ec7b39111259053e1518ec083d372c
                                                                                        • Instruction ID: 962b8763bd25329aba118fcb81240f0a99a8a9558c605771fbf8e578b8ba6660
                                                                                        • Opcode Fuzzy Hash: 6ca57346ba676a2d709945606685155010ec7b39111259053e1518ec083d372c
                                                                                        • Instruction Fuzzy Hash: 03214D71901218AADB14FFA8CC41BEDB778FB14710F4045AAE40AF7242DE706E89CB65
                                                                                        Function 00881E0C Relevance: 1.5, APIs: 1, Instructions: 46registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegCreateKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,?,?,80070003,?,00002710,?,00881F34,00000000,?), ref: 00881E4C
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Create
                                                                                        • String ID:
                                                                                        • API String ID: 2289755597-0
                                                                                        • Opcode ID: 9cfd7c264e35384d82bf229da441dfdeba846a82d6821d28d971c6b83e3749de
                                                                                        • Instruction ID: a48eef5feb6a2bfe66a1bd19fa348eacdf8f7810d6453f9d422b4f8d817e95f8
                                                                                        • Opcode Fuzzy Hash: 9cfd7c264e35384d82bf229da441dfdeba846a82d6821d28d971c6b83e3749de
                                                                                        • Instruction Fuzzy Hash: 6A014FB2A10115AFEB049B15CC44DBA76ADEBD8750F05812EBD55D7250DA70DD0197A0
                                                                                        Function 00881E78 Relevance: 1.5, APIs: 1, Instructions: 40registryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,00000000,80070003,?,?,?,00882087,00000000,?,?,HKLM\Software\Wavesor\SWUpdater\,00000000,00000000), ref: 00881EB1
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Open
                                                                                        • String ID:
                                                                                        • API String ID: 71445658-0
                                                                                        • Opcode ID: 8fc18e919c2e7444003bfe35c4daed7f41699cc0517ae44d9643f872b8b20f9a
                                                                                        • Instruction ID: 17205b286af76529c1564bc6bbdc301ec6fcbcd68530ecd94e26e438dd6fff37
                                                                                        • Opcode Fuzzy Hash: 8fc18e919c2e7444003bfe35c4daed7f41699cc0517ae44d9643f872b8b20f9a
                                                                                        • Instruction Fuzzy Hash: 2DF0C272A10114ABDB149F19CC44FB9B7E8FB54320F118229FD15D7390DB70ED018794
                                                                                        Function 008851F5 Relevance: 1.3, APIs: 1, Instructions: 53stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00884E42: PathRemoveExtensionW.SHLWAPI(00000000,?,00000000,00000000,?,00000000,00000000,?,00885209,?,?,00000000,00000000,00000000,?,0088593F), ref: 00884E6C
                                                                                          • Part of subcall function 00884D7E: VirtualQuery.KERNEL32(00884DA6,?,0000001C,00000000,?,?,?,00888B2A,008ADA14,00ED2C28,?,?,00887892,?,?), ref: 00884D9A
                                                                                        • lstrcmpiW.KERNELBASE(00000001,00000000,?,?,00000000,00000000,00000000,?,0088593F,008AA930,00000010,00885A38,?,00885B91,?,?), ref: 00885233
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExtensionPathQueryRemoveVirtuallstrcmpi
                                                                                        • String ID:
                                                                                        • API String ID: 1218796822-0
                                                                                        • Opcode ID: 227db6f9bc56e643099c2b5377208fea50d6b6ec63196137eaaefa09b9703757
                                                                                        • Instruction ID: b6ff40fc37aaeb0bae76d23bf5d5517c3c091f17a4a6fc38320d2c4cca86d403
                                                                                        • Opcode Fuzzy Hash: 227db6f9bc56e643099c2b5377208fea50d6b6ec63196137eaaefa09b9703757
                                                                                        • Instruction Fuzzy Hash: 21018F32700516ABEB18FB6DCC46CAEB76EFF90350718042DB501E7282EF60AD068762

                                                                                        Non-executed Functions

                                                                                        Function 0088548F Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 140COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetPrivateProfileIntW.KERNEL32(LoggingSettings,EnableLogging,00000001,00000000), ref: 008854C1
                                                                                        • GetPrivateProfileIntW.KERNEL32(LoggingSettings,ShowTime,00000001,00000000), ref: 008854DC
                                                                                        • GetPrivateProfileIntW.KERNEL32(LoggingSettings,LogToFile,00000000,00000000), ref: 008854F7
                                                                                        • GetPrivateProfileIntW.KERNEL32(LoggingSettings,LogToOutputDebug,00000000,00000000), ref: 00885512
                                                                                        • GetPrivateProfileIntW.KERNEL32(LoggingSettings,AppendToFile,00000001,00000000), ref: 0088552D
                                                                                        • GetPrivateProfileStringW.KERNEL32(LoggingSettings,LogFilePath,SWUpdater.log,?,00000104,00000000), ref: 00885573
                                                                                        • GetPrivateProfileIntW.KERNEL32(LoggingLevel,00000007,00000001,00000001), ref: 008855FF
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: PrivateProfile$String
                                                                                        • String ID: AppendToFile$EnableLogging$LogFilePath$LogToFile$LogToOutputDebug$LoggingLevel$LoggingSettings$SWUpdater.log$ShowTime
                                                                                        • API String ID: 83056003-4165658562
                                                                                        • Opcode ID: 05ccef02c44510461840d97b94552b7bf8985cbf2e6598c33a10f1731e589254
                                                                                        • Instruction ID: eae6efd303259dd4d3ee78894060a1f522ad20f40f044117788c49dfb41e81a8
                                                                                        • Opcode Fuzzy Hash: 05ccef02c44510461840d97b94552b7bf8985cbf2e6598c33a10f1731e589254
                                                                                        • Instruction Fuzzy Hash: BD419271641341EFEB00EF788889BAA7BE5FF55704F084199F921DA692DFB88944CB21
                                                                                        Function 0088770F Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemorystringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrlenW.KERNEL32(?,?,?,00887199), ref: 00887714
                                                                                        • OpenClipboard.USER32(00000000), ref: 0088771E
                                                                                        • EmptyClipboard.USER32 ref: 00887729
                                                                                        • GlobalAlloc.KERNEL32(00002002,00000000,?,?,00887199), ref: 0088773C
                                                                                        • GlobalLock.KERNEL32(00000000,?,?,00887199), ref: 00887745
                                                                                        • GlobalUnlock.KERNEL32(00000000,?,?,00887199), ref: 0088775B
                                                                                        • SetClipboardData.USER32(0000000D,00000000), ref: 00887764
                                                                                        • GlobalFree.KERNEL32(00000000), ref: 0088776F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Global$Clipboard$AllocDataEmptyFreeLockOpenUnlocklstrlen
                                                                                        • String ID:
                                                                                        • API String ID: 3280322382-0
                                                                                        • Opcode ID: 0dd89f8c4e697bdbbc51a3ce244adf4f46053fa386bc74374af76dbf154074fe
                                                                                        • Instruction ID: bce13ac62bf146b64f618bd3958491c5b4c42ae379cc129f1ddcffe7a9ab8319
                                                                                        • Opcode Fuzzy Hash: 0dd89f8c4e697bdbbc51a3ce244adf4f46053fa386bc74374af76dbf154074fe
                                                                                        • Instruction Fuzzy Hash: 87F04F71201315AFEA103BB1AC8DAAB7B2DFB85796B180026F506C5060EB64E801C779
                                                                                        Function 0089BC91 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • VirtualQuery.KERNEL32(?,?,0000001C), ref: 0089BCBA
                                                                                        • GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0089BCCE
                                                                                        • VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,0000001C), ref: 0089BD1E
                                                                                        • VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 0089BD33
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Virtual$AllocInfoProtectQuerySystem
                                                                                        • String ID:
                                                                                        • API String ID: 3562403962-0
                                                                                        • Opcode ID: b72f803faee0063e2f5a0adad253b47072440908bae156afbf51bdf59b3a4bc8
                                                                                        • Instruction ID: 223b885483c2c9f5c7071f6584abdc2d0e938f58a0d67147491f5272f85825ab
                                                                                        • Opcode Fuzzy Hash: b72f803faee0063e2f5a0adad253b47072440908bae156afbf51bdf59b3a4bc8
                                                                                        • Instruction Fuzzy Hash: C8217772E00219ABCF10EFE5DD85AEEB7B9FB44754F094465E916E7140DB30D900C7A5
                                                                                        Function 00883372 Relevance: 3.1, APIs: 2, Instructions: 90COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSecurityDescriptorDacl.ADVAPI32(?,?,00000000,?), ref: 008833A1
                                                                                        • SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 00883416
                                                                                          • Part of subcall function 00883451: GetSecurityDescriptorControl.ADVAPI32(00000000,?,?,00000000,00000000), ref: 00883475
                                                                                          • Part of subcall function 00883451: MakeAbsoluteSD.ADVAPI32(00000000,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?), ref: 008834BB
                                                                                          • Part of subcall function 00883451: GetLastError.KERNEL32 ref: 008834C1
                                                                                          • Part of subcall function 008836AE: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,?,008833B8), ref: 008836C4
                                                                                          • Part of subcall function 0088CA02: _free.LIBCMT ref: 0088CA15
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: DescriptorSecurity$Dacl$AbsoluteControlErrorInitializeLastMake_free
                                                                                        • String ID:
                                                                                        • API String ID: 1300528458-0
                                                                                        • Opcode ID: 5802cef6459420d9466b9b0595010345321307ef8c165f8959746c8a505186ea
                                                                                        • Instruction ID: d8fcd6cf24c866e0e1c4802d31a1ee1fc27bfd89daeae2c531ca61ccf5be6a73
                                                                                        • Opcode Fuzzy Hash: 5802cef6459420d9466b9b0595010345321307ef8c165f8959746c8a505186ea
                                                                                        • Instruction Fuzzy Hash: 1121A431700204ABDB25BB79DC46B6F7BA9FF50B50F248429F806DB241EE30DE008365
                                                                                        Function 0089A6BF Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0089A6C5
                                                                                        • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0089A6D3
                                                                                        • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0089A6E4
                                                                                        • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0089A6F5
                                                                                        • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0089A706
                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0089A717
                                                                                        • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0089A728
                                                                                        • GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0089A739
                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 0089A74A
                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0089A75B
                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0089A76C
                                                                                        • GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0089A77D
                                                                                        • GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0089A78E
                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0089A79F
                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0089A7B0
                                                                                        • GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0089A7C1
                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0089A7D2
                                                                                        • GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 0089A7E3
                                                                                        • GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 0089A7F4
                                                                                        • GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 0089A805
                                                                                        • GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 0089A816
                                                                                        • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0089A827
                                                                                        • GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 0089A838
                                                                                        • GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 0089A849
                                                                                        • GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 0089A85A
                                                                                        • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0089A86B
                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0089A87C
                                                                                        • GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 0089A88D
                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0089A89E
                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0089A8AF
                                                                                        • GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 0089A8C0
                                                                                        • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0089A8D1
                                                                                        • GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 0089A8E2
                                                                                        • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0089A8F3
                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 0089A904
                                                                                        • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 0089A915
                                                                                        • GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 0089A926
                                                                                        • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 0089A937
                                                                                        • GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 0089A948
                                                                                        • GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 0089A959
                                                                                        • GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 0089A96A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$HandleModule
                                                                                        • String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
                                                                                        • API String ID: 667068680-295688737
                                                                                        • Opcode ID: d854d6d1bf72754c9a229304b417594d4fff31ee7fe45e4e31af579b6610ef66
                                                                                        • Instruction ID: d69bdb316195b10f0a797c77fbe2afae70f0499a112415910226ba63164b1057
                                                                                        • Opcode Fuzzy Hash: d854d6d1bf72754c9a229304b417594d4fff31ee7fe45e4e31af579b6610ef66
                                                                                        • Instruction Fuzzy Hash: FF611771952720AFE7107FB8AD4DA653BE8FA1BB0170C483BF525D2A60E7BC40218F59
                                                                                        Function 0088247A Relevance: 31.6, APIs: 10, Strings: 11, Instructions: 123stringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • lstrcmpiW.KERNEL32(?,HKLM,00000000,00000000,?,00000000,00000000,00000000,80070003,00000000,LastCoreRun,00000000), ref: 0088251A
                                                                                        • lstrcmpiW.KERNEL32(?,HKEY_LOCAL_MACHINE), ref: 00882526
                                                                                        • lstrcmpiW.KERNEL32(?,HKCU), ref: 00882532
                                                                                        • lstrcmpiW.KERNEL32(?,HKEY_CURRENT_USER), ref: 00882542
                                                                                        • lstrcmpiW.KERNEL32(?,HKU), ref: 0088254E
                                                                                        • lstrcmpiW.KERNEL32(?,HKEY_USERS), ref: 0088255A
                                                                                        • lstrcmpiW.KERNEL32(?,HKCR), ref: 00882566
                                                                                        • lstrcmpiW.KERNEL32(?,HKEY_CLASSES_ROOT), ref: 00882572
                                                                                        • lstrcmpiW.KERNEL32(?,HKLM[64]), ref: 0088257E
                                                                                        • lstrcmpiW.KERNEL32(?,HKEY_LOCAL_MACHINE[64]), ref: 0088258A
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: lstrcmpi
                                                                                        • String ID: HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_LOCAL_MACHINE[64]$HKEY_USERS$HKLM$HKLM[64]$HKU$LastCoreRun
                                                                                        • API String ID: 1586166983-2072646691
                                                                                        • Opcode ID: b2b0a6dc0a317aaa273558d174e94cafa3847a58fb7ef926f3909551a4526bf9
                                                                                        • Instruction ID: b48fc0e9bc65a2ea06a8dd5234c89178530bed0c3be8c33eeda07101f4b16bf2
                                                                                        • Opcode Fuzzy Hash: b2b0a6dc0a317aaa273558d174e94cafa3847a58fb7ef926f3909551a4526bf9
                                                                                        • Instruction Fuzzy Hash: 9731C871740205AADB41BA689CA5DAE739CFF45744B140135F811E3281DF68DF028B76
                                                                                        Function 008838A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 155COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 008838BC
                                                                                        • GetParent.USER32(?), ref: 008838CE
                                                                                        • GetWindow.USER32(?,00000004), ref: 008838DA
                                                                                        • GetWindowRect.USER32(?,?), ref: 008838E8
                                                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 008838F9
                                                                                        • MonitorFromWindow.USER32(?,00000002), ref: 00883911
                                                                                        • GetMonitorInfoW.USER32(00000000,?), ref: 00883927
                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00883955
                                                                                        • SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015), ref: 00883A07
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Window$LongMonitorRect$FromInfoParent
                                                                                        • String ID: (
                                                                                        • API String ID: 1468510684-3887548279
                                                                                        • Opcode ID: b1f99f131f44a337a084577d809c1fd895809705983158a93b90f6e457436b36
                                                                                        • Instruction ID: 1736fa1845275528482f6f9052b722fae77121efd23add33d11e9d1d2f720b50
                                                                                        • Opcode Fuzzy Hash: b1f99f131f44a337a084577d809c1fd895809705983158a93b90f6e457436b36
                                                                                        • Instruction Fuzzy Hash: ED514D72900219AFDB10EFA8CD49AAEBBB9FB45710F194225E911F7290D7B0BD45CB50
                                                                                        Function 00889316 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • InitializeCriticalSectionAndSpinCount.KERNEL32(008ADB94,00000FA0,?,?,008892F4), ref: 00889322
                                                                                        • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,008892F4), ref: 0088932D
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,008892F4), ref: 0088933E
                                                                                        • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00889350
                                                                                        • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0088935E
                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,008892F4), ref: 00889381
                                                                                        • ___scrt_fastfail.LIBCMT ref: 00889392
                                                                                        • DeleteCriticalSection.KERNEL32(008ADB94,00000007,?,?,008892F4), ref: 0088939D
                                                                                        • CloseHandle.KERNEL32(00000000,?,?,008892F4), ref: 008893AD
                                                                                        Strings
                                                                                        • kernel32.dll, xrefs: 00889339
                                                                                        • WakeAllConditionVariable, xrefs: 00889356
                                                                                        • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00889328
                                                                                        • SleepConditionVariableCS, xrefs: 0088934A
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
                                                                                        • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                        • API String ID: 3578986977-3242537097
                                                                                        • Opcode ID: 7881909f389443fd42a6958c1914808240515fae4bc055688108f6903fb6e7b6
                                                                                        • Instruction ID: 36444a86f3859d4a5cba1fcaa5ee2693f4de98d7d5dba7f8cbd043f1a2271fa2
                                                                                        • Opcode Fuzzy Hash: 7881909f389443fd42a6958c1914808240515fae4bc055688108f6903fb6e7b6
                                                                                        • Instruction Fuzzy Hash: 3F012535A40B11ABE7203B74AC09A6A3A68FB52751B0D4112F956D37A0DB74D8028779
                                                                                        Function 0088626B Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 186COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,00000000), ref: 008862FE
                                                                                        • GetSecurityDescriptorControl.ADVAPI32(00000000,00000000,?,?,?,00000000), ref: 0088633C
                                                                                        • GetSecurityDescriptorOwner.ADVAPI32(00000000,?,?,?,00000000), ref: 0088635A
                                                                                        • GetSecurityDescriptorGroup.ADVAPI32(00000000,?,?,?,00000000), ref: 00886374
                                                                                        • GetSecurityDescriptorDacl.ADVAPI32(00000000,?,?,?,?,00000000), ref: 00886392
                                                                                        • GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,?,?,?,00000000), ref: 008863B6
                                                                                        • GetSecurityDescriptorControl.ADVAPI32(00000000,00000000,?,?,?,00000000), ref: 008863F4
                                                                                        • GetSecurityDescriptorOwner.ADVAPI32(00000000,?,?,?,00000000), ref: 00886412
                                                                                          • Part of subcall function 0088377E: GetSecurityDescriptorLength.ADVAPI32(?,?,?,?,?,?,8007000E,?,?,008833B8), ref: 00883700
                                                                                          • Part of subcall function 0088CA02: _free.LIBCMT ref: 0088CA15
                                                                                        • GetSecurityDescriptorGroup.ADVAPI32(00000000,?,?,?,00000000), ref: 0088642C
                                                                                        • GetSecurityDescriptorDacl.ADVAPI32(00000000,?,?,?,?,00000000), ref: 0088644A
                                                                                        • GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,?,?,?,00000000), ref: 0088646E
                                                                                        Strings
                                                                                        • _Wavesor_SWUpdater_logging_mutex_, xrefs: 00886275
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: DescriptorSecurity$ControlDaclGroupOwnerSacl$ErrorLastLength_free
                                                                                        • String ID: _Wavesor_SWUpdater_logging_mutex_
                                                                                        • API String ID: 1654333283-603278891
                                                                                        • Opcode ID: 23e42312873608d85f9c172c05369e2df6ba7004a49952096010210e5e5f498b
                                                                                        • Instruction ID: f44217ed1ff3ec219a657c9ca911116602f3297368ef5bb900caa4389514e484
                                                                                        • Opcode Fuzzy Hash: 23e42312873608d85f9c172c05369e2df6ba7004a49952096010210e5e5f498b
                                                                                        • Instruction Fuzzy Hash: CE61D7B280011DEBDF05EBE8DD45AEEB7B8FF08310F244166E511F2060EB359A59DB65
                                                                                        Function 00892FD8 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • ___free_lconv_mon.LIBCMT ref: 0089301C
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 00892718
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 0089272A
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 0089273C
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 0089274E
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 00892760
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 00892772
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 00892784
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 00892796
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 008927A8
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 008927BA
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 008927CC
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 008927DE
                                                                                          • Part of subcall function 008926FB: _free.LIBCMT ref: 008927F0
                                                                                        • _free.LIBCMT ref: 00893011
                                                                                          • Part of subcall function 0088FE72: HeapFree.KERNEL32(00000000,00000000,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?), ref: 0088FE88
                                                                                          • Part of subcall function 0088FE72: GetLastError.KERNEL32(?,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?,?), ref: 0088FE9A
                                                                                        • _free.LIBCMT ref: 00893033
                                                                                        • _free.LIBCMT ref: 00893048
                                                                                        • _free.LIBCMT ref: 00893053
                                                                                        • _free.LIBCMT ref: 00893075
                                                                                        • _free.LIBCMT ref: 00893088
                                                                                        • _free.LIBCMT ref: 00893096
                                                                                        • _free.LIBCMT ref: 008930A1
                                                                                        • _free.LIBCMT ref: 008930D9
                                                                                        • _free.LIBCMT ref: 008930E0
                                                                                        • _free.LIBCMT ref: 008930FD
                                                                                        • _free.LIBCMT ref: 00893115
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                        • String ID:
                                                                                        • API String ID: 161543041-0
                                                                                        • Opcode ID: 8131061ea2d7bdb075ab8ec4fc5d184975509faeadcdaacdaf6327e8795eaf1c
                                                                                        • Instruction ID: b1b2fb374723cb458950941e68abb5279a980333bcba9930379c5eb5603bade4
                                                                                        • Opcode Fuzzy Hash: 8131061ea2d7bdb075ab8ec4fc5d184975509faeadcdaacdaf6327e8795eaf1c
                                                                                        • Instruction Fuzzy Hash: AD313931600705AFEF21BA7DD845B5B77E9FF01310F188429E159DB1A2DB75EE808B21
                                                                                        Function 00884123 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 73libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryExW.KERNEL32(NetApi32.dll,00000000,00000800), ref: 00884147
                                                                                        • GetProcAddress.KERNEL32(00000000,NetGetAadJoinInformation), ref: 0088415F
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00884174
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00884188
                                                                                        • LoadLibraryExW.KERNEL32(NetApi32.dll,00000000,00000800), ref: 008841B0
                                                                                        • GetProcAddress.KERNEL32(00000000,NetFreeAadJoinInformation), ref: 008841C2
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 008841D0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$Free$AddressLoadProc
                                                                                        • String ID: NetApi32.dll$NetFreeAadJoinInformation$NetGetAadJoinInformation
                                                                                        • API String ID: 1386263645-2909723663
                                                                                        • Opcode ID: 14bed592b6bdb5bcab4614c1745a7d329780ba145ac0cf64840f97a24e46eb93
                                                                                        • Instruction ID: cb4d4058017fc725815cc9f83898b3be0bf425f1065ef3eaf19f8e2b2ead6d02
                                                                                        • Opcode Fuzzy Hash: 14bed592b6bdb5bcab4614c1745a7d329780ba145ac0cf64840f97a24e46eb93
                                                                                        • Instruction Fuzzy Hash: D7113836B01726B7E720B7758C49B6AB698FFA1721F144229E911E31D0CF749D0187A4
                                                                                        Function 0088BD1B Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsInExceptionSpec.LIBVCRUNTIME ref: 0088BE16
                                                                                        • type_info::operator==.LIBVCRUNTIME ref: 0088BE3D
                                                                                        • ___TypeMatch.LIBVCRUNTIME ref: 0088BF49
                                                                                        • IsInExceptionSpec.LIBVCRUNTIME ref: 0088C024
                                                                                        • _UnwindNestedFrames.LIBCMT ref: 0088C0AB
                                                                                        • CallUnexpected.LIBVCRUNTIME ref: 0088C0C6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                        • String ID: csm$csm$csm
                                                                                        • API String ID: 2123188842-393685449
                                                                                        • Opcode ID: f1b854939fa3fed41337bd4245052ee4137bd2da1172db487e13bf213f235667
                                                                                        • Instruction ID: 6a257483164e8c053bce1161bdf7a9623a9f4c4761084a11be0a6160ef2ffe02
                                                                                        • Opcode Fuzzy Hash: f1b854939fa3fed41337bd4245052ee4137bd2da1172db487e13bf213f235667
                                                                                        • Instruction Fuzzy Hash: DCC17D71800219EFCF29EF98C9819AEBBB5FF54310F00415AE811EB256D771EA51CBA2
                                                                                        Function 008867AA Relevance: 15.1, APIs: 10, Instructions: 138filestringsynchronizationCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 008867EB
                                                                                        • SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00886817
                                                                                        • lstrlenW.KERNEL32(?), ref: 00886834
                                                                                        • WriteFile.KERNEL32(?,?,00000000,00000000,00000000), ref: 0088684A
                                                                                        • WriteFile.KERNEL32(?,?,?,?,00000000,?), ref: 00886882
                                                                                        • lstrlenW.KERNEL32(?), ref: 0088689E
                                                                                        • WriteFile.KERNEL32(?,?,00000000,00000000,00000000), ref: 008868B4
                                                                                        • WriteFile.KERNEL32(?,?,?,?,00000000,?), ref: 008868EC
                                                                                        • WriteFile.KERNEL32(?,008A95B4,00000002,?,00000000), ref: 0088691A
                                                                                        • ReleaseMutex.KERNEL32(00000000), ref: 00886925
                                                                                          • Part of subcall function 008861BC: OutputDebugStringW.KERNEL32(00000000), ref: 008861FB
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: File$Write$Pointerlstrlen$DebugMutexOutputReleaseString
                                                                                        • String ID:
                                                                                        • API String ID: 2872164957-0
                                                                                        • Opcode ID: 62fe6220cc2063e8d6478239ae0c244436e291af7102479b202b3c43ee659881
                                                                                        • Instruction ID: 440a4c5e3d565c595858e84df1a6173857808886a7fb61e6204bb2f131b9a6ba
                                                                                        • Opcode Fuzzy Hash: 62fe6220cc2063e8d6478239ae0c244436e291af7102479b202b3c43ee659881
                                                                                        • Instruction Fuzzy Hash: 77416C71204346AFEB20FF24CC85B6AB7A9FF94304F04482DF595C61E1EB60AD19CB62
                                                                                        Function 008900D2 Relevance: 15.1, APIs: 10, Instructions: 69COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 008900E8
                                                                                          • Part of subcall function 0088FE72: HeapFree.KERNEL32(00000000,00000000,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?), ref: 0088FE88
                                                                                          • Part of subcall function 0088FE72: GetLastError.KERNEL32(?,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?,?), ref: 0088FE9A
                                                                                        • _free.LIBCMT ref: 008900F4
                                                                                        • _free.LIBCMT ref: 008900FF
                                                                                        • _free.LIBCMT ref: 0089010A
                                                                                        • _free.LIBCMT ref: 00890115
                                                                                        • _free.LIBCMT ref: 00890120
                                                                                        • _free.LIBCMT ref: 0089012B
                                                                                        • _free.LIBCMT ref: 00890136
                                                                                        • _free.LIBCMT ref: 00890141
                                                                                        • _free.LIBCMT ref: 0089014F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 4d68fe58354d2c099baa62356ca4ae64c39198d1fa32683f66cc140641df0091
                                                                                        • Instruction ID: 6e155bb2e1728155a2ec536277cf16f5a406922c2bbaf53310abe51ebf9a1505
                                                                                        • Opcode Fuzzy Hash: 4d68fe58354d2c099baa62356ca4ae64c39198d1fa32683f66cc140641df0091
                                                                                        • Instruction Fuzzy Hash: 06215276900108AFCB41EFA8C881DDE7BB9FF09380B0145A6B655DB132DA31EA548F91
                                                                                        Function 0088666E Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 118registrystringCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00020019,?,?,?), ref: 008866AB
                                                                                        • RegQueryValueExW.ADVAPI32(?,PendingFileRenameOperations,00000000,?,00000000,?), ref: 008866DA
                                                                                        • RegQueryValueExW.ADVAPI32(?,PendingFileRenameOperations,00000000,00000000,00000000,?), ref: 00886716
                                                                                        • lstrcmpW.KERNEL32(?,?), ref: 00886760
                                                                                        • lstrlenW.KERNEL32(?), ref: 0088676D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: QueryValue$Openlstrcmplstrlen
                                                                                        • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\??\
                                                                                        • API String ID: 2090349685-3703331852
                                                                                        • Opcode ID: 9bf38606e4f03653a584e600b7acbe6be7c6a5d03a2268480237f89a5cdbce4a
                                                                                        • Instruction ID: db6c04233f4bbcc43a2ddf16f32b96135096ae2b49e20214377a69caf850fc74
                                                                                        • Opcode Fuzzy Hash: 9bf38606e4f03653a584e600b7acbe6be7c6a5d03a2268480237f89a5cdbce4a
                                                                                        • Instruction Fuzzy Hash: 07418D71D0020CEBEB20BBA49C818EEB7BCFF04754B24022AE415E7152EB30AD16CB90
                                                                                        Function 00886B0C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetVersionExW.KERNEL32(0000011C), ref: 00886B4A
                                                                                        • LoadLibraryExW.KERNEL32(kernel32.dll,00000000,00000800), ref: 00886BD8
                                                                                        • GetProcAddress.KERNEL32(00000000,GetProductInfo), ref: 00886BEE
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00886C0E
                                                                                          • Part of subcall function 00886AC0: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,?,?,?,00886B85), ref: 00886AD7
                                                                                          • Part of subcall function 00886AC0: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00886AE3
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00886C83
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$AddressFreeProc$HandleLoadModuleVersion
                                                                                        • String ID: GetProductInfo$kernel32.dll
                                                                                        • API String ID: 684538289-182221857
                                                                                        • Opcode ID: df132176c69a5aacbfd96396c2b3e15f63519dcb109c747e5c2e37db3895a075
                                                                                        • Instruction ID: a844c0d58a8ee3d5f5bc0e8975c591f32feabc7c726be193c5390cf8fbd4e0e2
                                                                                        • Opcode Fuzzy Hash: df132176c69a5aacbfd96396c2b3e15f63519dcb109c747e5c2e37db3895a075
                                                                                        • Instruction Fuzzy Hash: 7E310B71900218DADB747B6C9D49BFD7776FB06724F24458AE081D6080FA39CEA08795
                                                                                        Function 0088A790 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0088A7C7
                                                                                        • ___except_validate_context_record.LIBVCRUNTIME ref: 0088A7CF
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0088A858
                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 0088A883
                                                                                        • _ValidateLocalCookies.LIBCMT ref: 0088A8D8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                        • String ID: csm
                                                                                        • API String ID: 1170836740-1018135373
                                                                                        • Opcode ID: 79751c4869c9eeb02cf3861477781920cf5c533ac17ab3a5442a47e1b08433b8
                                                                                        • Instruction ID: 29ed0d72b85cd95417fc099363b33ef1d0683e3812a817ec7fbc08b4e8e60f5e
                                                                                        • Opcode Fuzzy Hash: 79751c4869c9eeb02cf3861477781920cf5c533ac17ab3a5442a47e1b08433b8
                                                                                        • Instruction Fuzzy Hash: B9418434A002099FDF14FF69C884A9EBBB5FF45324F148066E815DB3D2D735A906CBA6
                                                                                        Function 00891570 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: api-ms-$ext-ms-
                                                                                        • API String ID: 0-537541572
                                                                                        • Opcode ID: efbe1047507fd346f86816eab388d268bb809759d02a152cd2b72f9ef29847e5
                                                                                        • Instruction ID: f080bc4e219cd466bb85e5e5bf56fe5b924b46e43e8bd480dc9ec0b254a69f00
                                                                                        • Opcode Fuzzy Hash: efbe1047507fd346f86816eab388d268bb809759d02a152cd2b72f9ef29847e5
                                                                                        • Instruction Fuzzy Hash: 8721D872E09317ABCF22BB649C49B1A7754FB61760F2E0521E917E7391D630DD0086E1
                                                                                        Function 0089289A Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00892862: _free.LIBCMT ref: 00892887
                                                                                        • _free.LIBCMT ref: 008928E8
                                                                                          • Part of subcall function 0088FE72: HeapFree.KERNEL32(00000000,00000000,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?), ref: 0088FE88
                                                                                          • Part of subcall function 0088FE72: GetLastError.KERNEL32(?,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?,?), ref: 0088FE9A
                                                                                        • _free.LIBCMT ref: 008928F3
                                                                                        • _free.LIBCMT ref: 008928FE
                                                                                        • _free.LIBCMT ref: 00892952
                                                                                        • _free.LIBCMT ref: 0089295D
                                                                                        • _free.LIBCMT ref: 00892968
                                                                                        • _free.LIBCMT ref: 00892973
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 2cab898ee018cdf585bb59d8ce888a2cc4eb99086ea307485425c8032a473b22
                                                                                        • Instruction ID: 1a79416f963bd988de59014d503014183c4638b429fc15c28ec756c24aba44af
                                                                                        • Opcode Fuzzy Hash: 2cab898ee018cdf585bb59d8ce888a2cc4eb99086ea307485425c8032a473b22
                                                                                        • Instruction Fuzzy Hash: 25112C71541B04BAE920BBB5CC0AFCB77DCFF10700F844C35B2AAEA063DB65A9059B52
                                                                                        Function 00887105 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60windowCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • wsprintfW.USER32 ref: 00887177
                                                                                        • MessageBoxW.USER32(00000000,?,Exception,00250012), ref: 008871AC
                                                                                        • ExitProcess.KERNEL32 ref: 008871C8
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ExitMessageProcesswsprintf
                                                                                        • String ID: Exception$Exception %x in %s %s %u%hs:%d$base\logging.cc
                                                                                        • API String ID: 1070390611-1730742759
                                                                                        • Opcode ID: ea4f9accf2f19edea9acbe1d905c2a835c67f24b01dcd087e4f35a29b8a3e0a0
                                                                                        • Instruction ID: 3e35446f9c885db36cce742f324b93e5f0480b146441ccd5e2dc6f6785bd8df0
                                                                                        • Opcode Fuzzy Hash: ea4f9accf2f19edea9acbe1d905c2a835c67f24b01dcd087e4f35a29b8a3e0a0
                                                                                        • Instruction Fuzzy Hash: FA110431A40119EADB50FF38CC89FA977B8FF05710F108094E095E20C0DE749A88CB94
                                                                                        Function 008840A6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadLibraryExW.KERNEL32(MDMRegistration.dll,00000000,00000800), ref: 008840C5
                                                                                        • GetProcAddress.KERNEL32(00000000,IsDeviceRegisteredWithManagement), ref: 008840D7
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 008840ED
                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00884101
                                                                                        Strings
                                                                                        • IsDeviceRegisteredWithManagement, xrefs: 008840D1
                                                                                        • MDMRegistration.dll, xrefs: 008840BD
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Library$Free$AddressLoadProc
                                                                                        • String ID: IsDeviceRegisteredWithManagement$MDMRegistration.dll
                                                                                        • API String ID: 1386263645-129496282
                                                                                        • Opcode ID: 272e5e99eadc0ded428b32fe438789569145327b20d7bdda189e6b16bf53fc16
                                                                                        • Instruction ID: 72b7fb737fd055de95fc13748616cd5de95215af93868d609031174357a7643b
                                                                                        • Opcode Fuzzy Hash: 272e5e99eadc0ded428b32fe438789569145327b20d7bdda189e6b16bf53fc16
                                                                                        • Instruction Fuzzy Hash: 90012B3A901316AB97106B74DC48DAB7B68FB62764B14122AF122D3580DA30CC45C760
                                                                                        Function 008865F8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OutputDebugStringW.KERNEL32(LOG_SYSTEM: trying to move log file to backup,00000000,?,?,?,?,008864C6), ref: 00886606
                                                                                        • MoveFileExW.KERNEL32(?,?,0000000B,?,?,?,?,008864C6), ref: 00886627
                                                                                          • Part of subcall function 00886CC5: GetLastError.KERNEL32(?,0088404A), ref: 00886CC6
                                                                                          • Part of subcall function 00886CC5: RaiseException.KERNEL32(00000000,00000001,00000000,00000000), ref: 00886CF8
                                                                                        • OutputDebugStringW.KERNEL32(LOG_SYSTEM: failed to move log file to backup,?,?,?,?,008864C6), ref: 0088663F
                                                                                          • Part of subcall function 0088666E: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00020019,?,?,?), ref: 008866AB
                                                                                          • Part of subcall function 0088666E: RegQueryValueExW.ADVAPI32(?,PendingFileRenameOperations,00000000,?,00000000,?), ref: 008866DA
                                                                                          • Part of subcall function 0088666E: RegQueryValueExW.ADVAPI32(?,PendingFileRenameOperations,00000000,00000000,00000000,?), ref: 00886716
                                                                                          • Part of subcall function 0088666E: lstrcmpW.KERNEL32(?,?), ref: 00886760
                                                                                          • Part of subcall function 0088666E: lstrlenW.KERNEL32(?), ref: 0088676D
                                                                                        Strings
                                                                                        • LOG_SYSTEM: trying to move log file to backup, xrefs: 008865FF
                                                                                        • LOG_SYSTEM: failed to move log file to backup, xrefs: 0088663A
                                                                                        • .bak, xrefs: 0088660F
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: DebugOutputQueryStringValue$ErrorExceptionFileLastMoveOpenRaiselstrcmplstrlen
                                                                                        • String ID: .bak$LOG_SYSTEM: failed to move log file to backup$LOG_SYSTEM: trying to move log file to backup
                                                                                        • API String ID: 2993329787-3505153176
                                                                                        • Opcode ID: 1099601d8d0ec1684928dfac5046504ee8bf59215d4533247312b2dd708c9220
                                                                                        • Instruction ID: 2c0c62467bf5911ba9842752417176c9d67515611ddaa3f057ff6a6b4e5505a7
                                                                                        • Opcode Fuzzy Hash: 1099601d8d0ec1684928dfac5046504ee8bf59215d4533247312b2dd708c9220
                                                                                        • Instruction Fuzzy Hash: 62F028353412009BDA20BB25EC4B8EB3B19FF96744B000015E402D3281FFB0AC16CBA9
                                                                                        Function 00884C47 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,00884CA4,?,?,?,008862F7,?,?,00000000), ref: 00884C68
                                                                                        • GetProcAddress.KERNEL32(00000000,CreateMutexExW), ref: 00884C7A
                                                                                        • GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00884C8B
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressProc$HandleModule
                                                                                        • String ID: CreateEventExW$CreateMutexExW$kernel32.dll
                                                                                        • API String ID: 667068680-2423819206
                                                                                        • Opcode ID: 8d619a4ceeed0a60c28fdc0eb275912c9cbdb05284c4b20c7a5a4a179d72594a
                                                                                        • Instruction ID: 2f02cf0da9beaadf33364ab1a0f7c8fe854524de187ee3e20d08d42fa71332cb
                                                                                        • Opcode Fuzzy Hash: 8d619a4ceeed0a60c28fdc0eb275912c9cbdb05284c4b20c7a5a4a179d72594a
                                                                                        • Instruction Fuzzy Hash: 0AE0D832500712EEF720FF34ED487143B76F766705F18081AE410D2A90EB7844018B20
                                                                                        Function 00894CED Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetConsoleCP.KERNEL32(008902A6,00000100,00000000), ref: 00894D35
                                                                                        • __fassign.LIBCMT ref: 00894F14
                                                                                        • __fassign.LIBCMT ref: 00894F31
                                                                                        • WriteFile.KERNEL32(?,00000028,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00894F79
                                                                                        • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00894FB9
                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00895065
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: FileWrite__fassign$ConsoleErrorLast
                                                                                        • String ID:
                                                                                        • API String ID: 4031098158-0
                                                                                        • Opcode ID: 785f049dec0378019aff159d8e967aa94148aea48ab75aaf1e87133b094ad026
                                                                                        • Instruction ID: e6433f854b8538eddede4a6f8a3e8b53a10edd2ff54aaa9a292e398de193d53a
                                                                                        • Opcode Fuzzy Hash: 785f049dec0378019aff159d8e967aa94148aea48ab75aaf1e87133b094ad026
                                                                                        • Instruction Fuzzy Hash: 6ED1A975D016589FDF15DFA8C8809EEBBB5FF48314F28016AE855FB242D631AA42CB60
                                                                                        Function 0088AB0D Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,?,0088AB04,0088AA9A,00889C85), ref: 0088AB1B
                                                                                        • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0088AB29
                                                                                        • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0088AB42
                                                                                        • SetLastError.KERNEL32(00000000,0088AB04,0088AA9A,00889C85), ref: 0088AB94
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLastValue___vcrt_
                                                                                        • String ID:
                                                                                        • API String ID: 3852720340-0
                                                                                        • Opcode ID: 93479aecf990752ca0a7b9da8eb4327f4d9657cbb7b6f59a2214eb4c9f37245e
                                                                                        • Instruction ID: b81b0b29d9ecd5b53eddd86df4c0e5123ae86e54e8e943199db426c50f285e9b
                                                                                        • Opcode Fuzzy Hash: 93479aecf990752ca0a7b9da8eb4327f4d9657cbb7b6f59a2214eb4c9f37245e
                                                                                        • Instruction Fuzzy Hash: 3D01D47321AB115EB62D3BB9BC85A2A2765FB027B5B24023BF611D19E0EE118C029342
                                                                                        Function 00886093 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetPrivateProfileIntW.KERNEL32(LoggingSettings,MaxLogFileSize,00989680,00000007), ref: 00886119
                                                                                        • GetPrivateProfileIntW.KERNEL32(LoggingSettings,LogFileWide,00000001,00000007), ref: 0088612D
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: PrivateProfile
                                                                                        • String ID: LogFileWide$LoggingSettings$MaxLogFileSize
                                                                                        • API String ID: 1469295129-2181087832
                                                                                        • Opcode ID: 4ac28a1e1750065f7524de98268c07ad0cb06b9e4971a221a50297fdfd365524
                                                                                        • Instruction ID: 041a0ddcd31570589ad5636fdc4bdc7c2998224cde086896bae6b1673be9c6f2
                                                                                        • Opcode Fuzzy Hash: 4ac28a1e1750065f7524de98268c07ad0cb06b9e4971a221a50297fdfd365524
                                                                                        • Instruction Fuzzy Hash: 4721AE71204200AEEF00EF68C8868A6BBE8FF55314708C46AFC56DF287EB74D515CBA1
                                                                                        Function 00885D1F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • Sleep.KERNEL32(00000032,?,00883A3B,?,?,?,00000007,?,?,00883FDD,?,[Started process][PID unknown],00000007), ref: 00885D6A
                                                                                        • OutputDebugStringA.KERNEL32(LOG_SYSTEM: Couldn't acquire lock - ,?,00883A3B,?,?,?,00000007,?,?,00883FDD,?,[Started process][PID unknown],00000007), ref: 00885D7B
                                                                                        • OutputDebugStringW.KERNEL32(?,?,00883A3B,?,?,?,00000007,?,?,00883FDD,?,[Started process][PID unknown],00000007), ref: 00885D88
                                                                                        • OutputDebugStringW.KERNEL32(008A92B8,?,00883A3B,?,?,?,00000007,?,?,00883FDD,?,[Started process][PID unknown],00000007), ref: 00885D8F
                                                                                        Strings
                                                                                        • LOG_SYSTEM: Couldn't acquire lock - , xrefs: 00885D76
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: DebugOutputString$Sleep
                                                                                        • String ID: LOG_SYSTEM: Couldn't acquire lock -
                                                                                        • API String ID: 3789842296-1219263422
                                                                                        • Opcode ID: d55816835b96df334d38de7749bc0a4682e2a267052c31907fe5e6f26caa069a
                                                                                        • Instruction ID: e7a2249c99ff52b7f07d68350583b8c68bb360d98cac0363b626a06f7e194a7d
                                                                                        • Opcode Fuzzy Hash: d55816835b96df334d38de7749bc0a4682e2a267052c31907fe5e6f26caa069a
                                                                                        • Instruction Fuzzy Hash: F811593120020AAFDF05EF58DC8ADEE7769FF55354B000069F902DB1A1DB70AE46CBA1
                                                                                        Function 00885281 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62timethreadCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLocalTime.KERNEL32(?,00000000,00000000,-00000010,?,00000000,?,?,00883FCC,00000007,00000001), ref: 008852AB
                                                                                        • GetCurrentThreadId.KERNEL32 ref: 008852E9
                                                                                        • GetCurrentProcessId.KERNEL32(?,00883FCC,00000007,00000001), ref: 008852F1
                                                                                        Strings
                                                                                        • [%02d/%02d/%02d %02d:%02d:%02d.%03d], xrefs: 008852DB
                                                                                        • [%s][%u:%u], xrefs: 008852FC
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Current$LocalProcessThreadTime
                                                                                        • String ID: [%02d/%02d/%02d %02d:%02d:%02d.%03d]$[%s][%u:%u]
                                                                                        • API String ID: 2750998906-1978067781
                                                                                        • Opcode ID: 084c1b7c486e4908bad4a0a5f14c0cc68e3d661ca766785852d1df1679140b37
                                                                                        • Instruction ID: ada17b93787e4817016e059ac6aa52b07fc4d01cbf9f39af57376cda94b27b85
                                                                                        • Opcode Fuzzy Hash: 084c1b7c486e4908bad4a0a5f14c0cc68e3d661ca766785852d1df1679140b37
                                                                                        • Instruction Fuzzy Hash: 27118EA2900219BADB50ABE9DC468FFB7FDFF4C701F004016FA15E2141DA388995C7B5
                                                                                        Function 0088AE20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,0088AEE1,?,?,008ADF44,00000000,?,0088B00C,00000004,InitializeCriticalSectionEx,0089DF30,InitializeCriticalSectionEx,00000000), ref: 0088AEB0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: FreeLibrary
                                                                                        • String ID: api-ms-
                                                                                        • API String ID: 3664257935-2084034818
                                                                                        • Opcode ID: 84c6962f2169ba713dd50753509d0698d89ec6ccb8cd53975e1659b43bd3f101
                                                                                        • Instruction ID: 4ac24acdef09961c0bfc2c769af74b3673e6e3496e8621c9a2caf253a26d493e
                                                                                        • Opcode Fuzzy Hash: 84c6962f2169ba713dd50753509d0698d89ec6ccb8cd53975e1659b43bd3f101
                                                                                        • Instruction Fuzzy Hash: C311A332E01725ABEB26BB689C45B5A7394FB11760F290922F911FB2D0D770ED0087D6
                                                                                        Function 008871CF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60registrylibraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00000000,00000000,?,008858A7,00000040,?,0088598D,008AA930,00000010,00885A38,?,00885B91,?), ref: 00887221
                                                                                        • GetProcAddress.KERNEL32(00000000,RtlCaptureStackBackTrace), ref: 00887231
                                                                                        • RegisterTraceGuidsW.ADVAPI32(008877F6,008A9734,00000000,00000001,008AD950,00000000,00000000,00000020,00000007,00000001), ref: 00887267
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressGuidsHandleModuleProcRegisterTrace
                                                                                        • String ID: RtlCaptureStackBackTrace$kernel32.dll
                                                                                        • API String ID: 3926896046-94782561
                                                                                        • Opcode ID: cde8de5f915250bebf0035c405fc8ebda4a311faa395df1a3a3c2d151f1c2118
                                                                                        • Instruction ID: dcc69ada1f695da25661f4cc6998fb23477d10819edffada338e7d98d49830ff
                                                                                        • Opcode Fuzzy Hash: cde8de5f915250bebf0035c405fc8ebda4a311faa395df1a3a3c2d151f1c2118
                                                                                        • Instruction Fuzzy Hash: 961160B1608300ABEB049F59DCC5A867BA8FB0A710F24406AFD09DF746D7B0D844CBA4
                                                                                        Function 008861BC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42synchronizationCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 0088626B: GetLastError.KERNEL32(?,?,00000000), ref: 008862FE
                                                                                          • Part of subcall function 0088626B: GetSecurityDescriptorControl.ADVAPI32(00000000,00000000,?,?,?,00000000), ref: 0088633C
                                                                                          • Part of subcall function 0088626B: GetSecurityDescriptorOwner.ADVAPI32(00000000,?,?,?,00000000), ref: 0088635A
                                                                                          • Part of subcall function 0088626B: GetSecurityDescriptorGroup.ADVAPI32(00000000,?,?,?,00000000), ref: 00886374
                                                                                          • Part of subcall function 0088626B: GetSecurityDescriptorDacl.ADVAPI32(00000000,?,?,?,?,00000000), ref: 00886392
                                                                                        • OutputDebugStringW.KERNEL32(00000000), ref: 008861FB
                                                                                          • Part of subcall function 0088648F: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000000,00000080,00000000), ref: 008864E7
                                                                                        • ReleaseMutex.KERNEL32(00000000,?,008867C3), ref: 00886237
                                                                                          • Part of subcall function 00886FE3: wvsprintfW.USER32(008AF5D4,00000001,00000007), ref: 00887075
                                                                                        • OutputDebugStringW.KERNEL32(00000000), ref: 00886224
                                                                                        Strings
                                                                                        • LOG_SYSTEM: [%s]: Could not acquire logging mutex %s, xrefs: 008861ED
                                                                                        • LOG_SYSTEM: [%s]: Could not create logging file %s, xrefs: 00886216
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: DescriptorSecurity$DebugOutputString$ControlCreateDaclErrorFileGroupLastMutexOwnerReleasewvsprintf
                                                                                        • String ID: LOG_SYSTEM: [%s]: Could not acquire logging mutex %s$LOG_SYSTEM: [%s]: Could not create logging file %s
                                                                                        • API String ID: 2958308531-2023621912
                                                                                        • Opcode ID: e885676d7123943570a332e6c0f3ffbab6807fdb39577a0daa24d8ff20ddabf1
                                                                                        • Instruction ID: a852fa34cd4108e2b73bdc97261a1ced1f81fd31b786473e2057149de82a5314
                                                                                        • Opcode Fuzzy Hash: e885676d7123943570a332e6c0f3ffbab6807fdb39577a0daa24d8ff20ddabf1
                                                                                        • Instruction Fuzzy Hash: 9A01D431400B41DEDF313F64E80C756BBA5FF11304F04498DE492819A2EBB594A9C756
                                                                                        Function 0088D07A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0088D06F,?,?,0088D037,00000100,00000000,?), ref: 0088D08F
                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0088D0A2
                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,0088D06F,?,?,0088D037,00000100,00000000,?), ref: 0088D0C5
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                        • API String ID: 4061214504-1276376045
                                                                                        • Opcode ID: f3aca775187324d8145ba4f2f45184f64cd084afff8462138112d858f09d4ef9
                                                                                        • Instruction ID: 0d2513b1d9abf41b0f2e4e9e46af8df47ca0db3ad4f6f36091a26a3890775c80
                                                                                        • Opcode Fuzzy Hash: f3aca775187324d8145ba4f2f45184f64cd084afff8462138112d858f09d4ef9
                                                                                        • Instruction Fuzzy Hash: 68F03031600719FBDB21BBA1DD0AB9EBF79FB01756F180065F805E22A0CB748E02DB95
                                                                                        Function 008835E9 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSecurityDescriptorControl.ADVAPI32(00000000,00000000,?), ref: 0088360B
                                                                                        • GetSecurityDescriptorGroup.ADVAPI32(00000000,?,00000000), ref: 00883647
                                                                                        • GetSecurityDescriptorDacl.ADVAPI32(00000000,?,?,00000000), ref: 00883665
                                                                                        • GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,?,00000000), ref: 00883689
                                                                                        • GetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 0088362D
                                                                                          • Part of subcall function 0088CA02: _free.LIBCMT ref: 0088CA15
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: DescriptorSecurity$ControlDaclGroupOwnerSacl_free
                                                                                        • String ID:
                                                                                        • API String ID: 62099665-0
                                                                                        • Opcode ID: 03e7369abb2fad38474c6bfcf29f52ecbb099aee3802d89a56305e783ff04dba
                                                                                        • Instruction ID: d2791393ec3b06c51102302e12c336b1f463fa839b729bb0810c1470d70ee503
                                                                                        • Opcode Fuzzy Hash: 03e7369abb2fad38474c6bfcf29f52ecbb099aee3802d89a56305e783ff04dba
                                                                                        • Instruction Fuzzy Hash: BE21FAB280060CFFDB15EB94DD4AAEFB7BDFB04701F108166E512E1460EB30AA55DB60
                                                                                        Function 008927F9 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 00892811
                                                                                          • Part of subcall function 0088FE72: HeapFree.KERNEL32(00000000,00000000,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?), ref: 0088FE88
                                                                                          • Part of subcall function 0088FE72: GetLastError.KERNEL32(?,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?,?), ref: 0088FE9A
                                                                                        • _free.LIBCMT ref: 00892823
                                                                                        • _free.LIBCMT ref: 00892835
                                                                                        • _free.LIBCMT ref: 00892847
                                                                                        • _free.LIBCMT ref: 00892859
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: 7f3abc56a51757abd2ad06039bda3272f4e25f60f827089970f13d939087eb73
                                                                                        • Instruction ID: eac9863b05a71084d732a0c6639ce1cce7b69f8ed405f0f1d9eed01b496b197a
                                                                                        • Opcode Fuzzy Hash: 7f3abc56a51757abd2ad06039bda3272f4e25f60f827089970f13d939087eb73
                                                                                        • Instruction Fuzzy Hash: EAF0B272504310B79A24FB5CE585C1777D9FA067107684829F149EBD73C774FC808B65
                                                                                        Function 00884D29 Relevance: 7.5, APIs: 5, Instructions: 27sleepCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • TryEnterCriticalSection.KERNEL32(?), ref: 00884D32
                                                                                        • GetTickCount.KERNEL32 ref: 00884D3C
                                                                                        • Sleep.KERNEL32(00000000), ref: 00884D47
                                                                                        • TryEnterCriticalSection.KERNEL32(?), ref: 00884D4E
                                                                                        • GetTickCount.KERNEL32 ref: 00884D58
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountCriticalEnterSectionTick$Sleep
                                                                                        • String ID:
                                                                                        • API String ID: 1544504822-0
                                                                                        • Opcode ID: 4f7f23a7ec6e07d8a20757879a580e1cc24e43b3ae38ee13a3ff223d3563d36e
                                                                                        • Instruction ID: 03bd8e481e4d6f61458fe8badd697ab3c78a633820978d36b8e5b83752543ca0
                                                                                        • Opcode Fuzzy Hash: 4f7f23a7ec6e07d8a20757879a580e1cc24e43b3ae38ee13a3ff223d3563d36e
                                                                                        • Instruction Fuzzy Hash: C9E06D33500305ABCB40BFA0DD49A9EBBACFF82745B045012F902C7108D739AA029BAD
                                                                                        Function 0088D14C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON
                                                                                        Download Yara Rule
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID:
                                                                                        • String ID: C:\Users\user\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterCore.exe
                                                                                        • API String ID: 0-3700613688
                                                                                        • Opcode ID: 9cda513a41c68b7a3356fa1b518f2f15e096e687230564704d988957874ee820
                                                                                        • Instruction ID: 466951b269dcd14d255fd8dcbed7ee660c2a265934982e257ac52c762395c6b6
                                                                                        • Opcode Fuzzy Hash: 9cda513a41c68b7a3356fa1b518f2f15e096e687230564704d988957874ee820
                                                                                        • Instruction Fuzzy Hash: 05315071A00318AFDB21EF99DC85DAEBBF9FF85710B144066E504D7291D7709A40CBA1
                                                                                        Function 0088169B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • LoadResource.KERNEL32(?,?,?,00000000,LastCoreRun,?,8007000E,?,-C000001E,00000001,?,008818CD,80004005,80070003,00000000), ref: 008816A7
                                                                                        • LockResource.KERNEL32(00000000,?,?,?,00000000,LastCoreRun,?,8007000E,?,-C000001E,00000001,?,008818CD,80004005,80070003,00000000), ref: 008816B2
                                                                                        • SizeofResource.KERNEL32(?,?,?,?,?,00000000,LastCoreRun,?,8007000E,?,-C000001E,00000001,?,008818CD,80004005,80070003), ref: 008816C0
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Resource$LoadLockSizeof
                                                                                        • String ID: LastCoreRun
                                                                                        • API String ID: 2853612939-4229261367
                                                                                        • Opcode ID: cc1220d8e03671536737cfc8c1fd4d5584453831bcc01ff2e551b1ce16ce224b
                                                                                        • Instruction ID: 41c3792753290abb297e22dcdd9dc16ed135630db1eb7ab76d7f2421297c79c3
                                                                                        • Opcode Fuzzy Hash: cc1220d8e03671536737cfc8c1fd4d5584453831bcc01ff2e551b1ce16ce224b
                                                                                        • Instruction Fuzzy Hash: C2F06232910226578F31BA599C4C867B75CFEA1795308452BFC85D3114FDB19C528794
                                                                                        Function 00886AC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,?,?,?,00886B85), ref: 00886AD7
                                                                                        • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00886AE3
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProc
                                                                                        • String ID: GetNativeSystemInfo$kernel32
                                                                                        • API String ID: 1646373207-3846845290
                                                                                        • Opcode ID: cd4367fdb0fe4549e3eeef7ec70f94853e7dee62742ca86eed5e8609a29c5d36
                                                                                        • Instruction ID: 25e6ed9a5ff8a823aec8cf1f43ca87ecdbcafaf1c52554db0faa02dd027a7157
                                                                                        • Opcode Fuzzy Hash: cd4367fdb0fe4549e3eeef7ec70f94853e7dee62742ca86eed5e8609a29c5d36
                                                                                        • Instruction Fuzzy Hash: D8E06D72E107049ADF10ABADA9098AA7BF9FB99714F244432E502F2991FA75E8048621
                                                                                        Function 00884F11 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetModuleHandleW.KERNEL32(ntdll.dll,00000000,00884FB6,?,?,?,?,?,?,?,?,00883F50,?), ref: 00884F22
                                                                                        • GetProcAddress.KERNEL32(00000000,NtQueryInformationProcess), ref: 00884F38
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AddressHandleModuleProc
                                                                                        • String ID: NtQueryInformationProcess$ntdll.dll
                                                                                        • API String ID: 1646373207-2906145389
                                                                                        • Opcode ID: cd8a20621785dfcea30ec3eb8f5f66a4d074e46c3baef046ccfc314043752697
                                                                                        • Instruction ID: b9ab8c8b2cfbdf9c4084be2a13af08b5588f47889a931118c2f32c2c72aac47f
                                                                                        • Opcode Fuzzy Hash: cd8a20621785dfcea30ec3eb8f5f66a4d074e46c3baef046ccfc314043752697
                                                                                        • Instruction Fuzzy Hash: 3AE012326447139BA751BFB9BC0865136D8FB16315715507AE691D2610FEB4C8108F64
                                                                                        Function 00885CE6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • OutputDebugStringA.KERNEL32(Unexpected exception in: omaha::Logging::InternalLogMessageMaskedVA), ref: 00885CEE
                                                                                        • OutputDebugStringW.KERNEL32(?), ref: 00885CFD
                                                                                        • OutputDebugStringW.KERNEL32(008A92B8), ref: 00885D04
                                                                                        Strings
                                                                                        • Unexpected exception in: omaha::Logging::InternalLogMessageMaskedVA, xrefs: 00885CE9
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: DebugOutputString
                                                                                        • String ID: Unexpected exception in: omaha::Logging::InternalLogMessageMaskedVA
                                                                                        • API String ID: 1166629820-3049550389
                                                                                        • Opcode ID: b9a5fc7971a98f2cb43c0ac0faf94b585674757cc2bf6168562071cca5d577fd
                                                                                        • Instruction ID: 57256746f918a050c2ffbb09d5385a4087e8e40824dcc7bea81775415e4e9a5e
                                                                                        • Opcode Fuzzy Hash: b9a5fc7971a98f2cb43c0ac0faf94b585674757cc2bf6168562071cca5d577fd
                                                                                        • Instruction Fuzzy Hash: 7BD0C233A44318DFCB10AF88EC066CDBB70FB46320F104117D932A369087341411CB64
                                                                                        Function 00893A76 Relevance: 6.3, APIs: 4, Instructions: 320COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: _strrchr
                                                                                        • String ID:
                                                                                        • API String ID: 3213747228-0
                                                                                        • Opcode ID: 5ea264f6af3e250a6890054c36e2ca268a912b1bc8af873d3eec01b830fd0f08
                                                                                        • Instruction ID: 45192be276aad147fe9812d54da2ea361cd3beb64b17609fefe13ab6a6c72178
                                                                                        • Opcode Fuzzy Hash: 5ea264f6af3e250a6890054c36e2ca268a912b1bc8af873d3eec01b830fd0f08
                                                                                        • Instruction Fuzzy Hash: 94B15432A006499FDF15EF28C891BAEBBE5FF55354F2C816AE855EB241D2348F01CB61
                                                                                        Function 0088BAC4 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AdjustPointer
                                                                                        • String ID:
                                                                                        • API String ID: 1740715915-0
                                                                                        • Opcode ID: 1715be1cf907e0c72757a2acb59ec5c638163621947c811854b32e6176f39b4f
                                                                                        • Instruction ID: 5b76ce135164706ada17100fcf346d31ad797ef02b0d720fd6cd733a7df844f7
                                                                                        • Opcode Fuzzy Hash: 1715be1cf907e0c72757a2acb59ec5c638163621947c811854b32e6176f39b4f
                                                                                        • Instruction Fuzzy Hash: 5A51F372A01206EFEB29BF58C881BBA77A5FF84320F14412DE846D7695E731EC81C791
                                                                                        Function 00883451 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetSecurityDescriptorControl.ADVAPI32(00000000,?,?,00000000,00000000), ref: 00883475
                                                                                        • MakeAbsoluteSD.ADVAPI32(00000000,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?), ref: 008834BB
                                                                                        • GetLastError.KERNEL32 ref: 008834C1
                                                                                        • MakeAbsoluteSD.ADVAPI32(00000000,00000000,?,00000000,?,00000000,?,?,00000000,?,00000000), ref: 00883585
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: AbsoluteMake$ControlDescriptorErrorLastSecurity
                                                                                        • String ID:
                                                                                        • API String ID: 3769124138-0
                                                                                        • Opcode ID: 985f953daa4a2d7dffe1ac4e523f0512350778f1ecf03a61593da46a2919240f
                                                                                        • Instruction ID: 916949d5cf441bb707b2ea348d8adb53584ca544ec61509775a831e27cb9809c
                                                                                        • Opcode Fuzzy Hash: 985f953daa4a2d7dffe1ac4e523f0512350778f1ecf03a61593da46a2919240f
                                                                                        • Instruction Fuzzy Hash: 4B5106B190121AEFDB15EB98D945AEEBBB9FF08B50F14406AF801E2154D7309F40DBA1
                                                                                        Function 008901EA Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(?,00000100,?,0088E702,00000100,00000000,?,?,0088E21B,?,00000000,00000100,000000FE), ref: 008901EF
                                                                                        • _free.LIBCMT ref: 0089024C
                                                                                        • _free.LIBCMT ref: 00890282
                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,0088E21B,?,00000000,00000100,000000FE), ref: 0089028D
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast_free
                                                                                        • String ID:
                                                                                        • API String ID: 2283115069-0
                                                                                        • Opcode ID: 38d3cd9c37288c3400d2b56d4ef6b079fbf7d191de57ae30d82c76f183a827e0
                                                                                        • Instruction ID: f95585509d6f197bb064c12c183a2bc1b8c9745cdce31882e9bd3f01e6da3f2d
                                                                                        • Opcode Fuzzy Hash: 38d3cd9c37288c3400d2b56d4ef6b079fbf7d191de57ae30d82c76f183a827e0
                                                                                        • Instruction Fuzzy Hash: AD11C63238870A7EEF5277FD5C89A3B2159FBD2375B2C0224F625D75E2DEA08C015A21
                                                                                        Function 00890341 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetLastError.KERNEL32(008AEA3C,008AEA54,008AEA3C,0088CCA8,008904A2,?,0088CCFF,008AEA3C,00000004,008A84A0,LastCoreRun,008A849C,?,0088D7CE,LastCoreRun,008A84A0), ref: 00890346
                                                                                        • _free.LIBCMT ref: 008903A3
                                                                                        • _free.LIBCMT ref: 008903D9
                                                                                        • SetLastError.KERNEL32(00000000,00000006,000000FF,?,0088CCFF,008AEA3C,00000004,008A84A0,LastCoreRun,008A849C,?,0088D7CE,LastCoreRun,008A84A0,00000004,008AEA54), ref: 008903E4
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ErrorLast_free
                                                                                        • String ID:
                                                                                        • API String ID: 2283115069-0
                                                                                        • Opcode ID: 4b544355e87412273cab3ab827143d413a76ad4e96ede8b27ed0c8d35ac33236
                                                                                        • Instruction ID: 903c7fd2783951fc8e31def1d2593c24d0b350c157e8f7b5114786e34bac8723
                                                                                        • Opcode Fuzzy Hash: 4b544355e87412273cab3ab827143d413a76ad4e96ede8b27ed0c8d35ac33236
                                                                                        • Instruction Fuzzy Hash: 2611A932348B067FDF1176BD9C86E2A2159FBD2775B2C0324F515D76E2DEA18C016A21
                                                                                        Function 00886A01 Relevance: 6.1, APIs: 4, Instructions: 62COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003,?,?,00000000), ref: 00886A67
                                                                                        • VerSetConditionMask.KERNEL32(00000000), ref: 00886A6B
                                                                                        • VerSetConditionMask.KERNEL32(00000000), ref: 00886A6F
                                                                                        • VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 00886A96
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConditionMask$InfoVerifyVersion
                                                                                        • String ID:
                                                                                        • API String ID: 2793162063-0
                                                                                        • Opcode ID: 11d98d05aeecbc63492eb4b139c563ea514392b85fc990d17ade285fda6f5bc5
                                                                                        • Instruction ID: 65116ba711b7b0ee0f22c5bd41fe20787d96647c80ae5d962557f6ddde2b825b
                                                                                        • Opcode Fuzzy Hash: 11d98d05aeecbc63492eb4b139c563ea514392b85fc990d17ade285fda6f5bc5
                                                                                        • Instruction Fuzzy Hash: 3A112871D41328BADB24DF65DC46BEBBBBCEF49B50F00405AB548E7281D6745B408BE4
                                                                                        Function 00897DB6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WriteConsoleW.KERNEL32(00000100,00000008,?,00000000,00000100,?,008976BC,00000100,00000001,00000100,00000100,?,008950C2,00000000,008902A6,00000100), ref: 00897DCD
                                                                                        • GetLastError.KERNEL32(?,008976BC,00000100,00000001,00000100,00000100,?,008950C2,00000000,008902A6,00000100,00000000,00000100,?,00895616,00000028), ref: 00897DD9
                                                                                          • Part of subcall function 00897D9F: CloseHandle.KERNEL32(FFFFFFFE,00897DE9,?,008976BC,00000100,00000001,00000100,00000100,?,008950C2,00000000,008902A6,00000100,00000000,00000100), ref: 00897DAF
                                                                                        • ___initconout.LIBCMT ref: 00897DE9
                                                                                          • Part of subcall function 00897D61: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00897D90,008976A9,00000100,?,008950C2,00000000,008902A6,00000100,00000000), ref: 00897D74
                                                                                        • WriteConsoleW.KERNEL32(00000100,00000008,?,00000000,?,008976BC,00000100,00000001,00000100,00000100,?,008950C2,00000000,008902A6,00000100,00000000), ref: 00897DFE
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                        • String ID:
                                                                                        • API String ID: 2744216297-0
                                                                                        • Opcode ID: 03a770d567ca1cabfc884e394a6b78d2fac614c45d6f7e0bc0731b8066521b15
                                                                                        • Instruction ID: 72bddd8bc425a609eb385f30ccf14c5bc62e11092f6b03db6c7caafa5ed5cf22
                                                                                        • Opcode Fuzzy Hash: 03a770d567ca1cabfc884e394a6b78d2fac614c45d6f7e0bc0731b8066521b15
                                                                                        • Instruction Fuzzy Hash: 17F09836514214BBCF227FA59C04A9D7E66FB097A1B084451FA19D6520DA3288209B95
                                                                                        Function 008877A9 Relevance: 6.0, APIs: 4, Instructions: 29COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetTraceLoggerHandle.ADVAPI32(?), ref: 008877B2
                                                                                        • GetLastError.KERNEL32 ref: 008877C6
                                                                                        • GetTraceEnableFlags.ADVAPI32(00000000), ref: 008877D0
                                                                                        • GetTraceEnableLevel.ADVAPI32(?,?), ref: 008877DF
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Trace$Enable$ErrorFlagsHandleLastLevelLogger
                                                                                        • String ID:
                                                                                        • API String ID: 101358600-0
                                                                                        • Opcode ID: 6c38491c8d4bc5e0685858e4616061b123d86fd82732b31a053444cd2167b4ef
                                                                                        • Instruction ID: d9e6401dc472c9eda020c39e7e8654aebc66ba3742a6bf0b5dd051975e67266e
                                                                                        • Opcode Fuzzy Hash: 6c38491c8d4bc5e0685858e4616061b123d86fd82732b31a053444cd2167b4ef
                                                                                        • Instruction Fuzzy Hash: 32F0D475504B04EF97247F75D908866BFF9FF5C751724892AF98AC2620EA31E800CB58
                                                                                        Function 00889486 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SleepConditionVariableCS.KERNELBASE(?,00889423,00000064), ref: 008894A9
                                                                                        • LeaveCriticalSection.KERNEL32(008ADB94,00000000,?,00889423,00000064,?,00881297,008AEA40,?,00000000,0088187B,80070003,00000000,?,00882051,HKLM\Software\Wavesor\SWUpdater\), ref: 008894B3
                                                                                        • WaitForSingleObjectEx.KERNEL32(00000000,00000000,?,00889423,00000064,?,00881297,008AEA40,?,00000000,0088187B,80070003,00000000,?,00882051,HKLM\Software\Wavesor\SWUpdater\), ref: 008894C4
                                                                                        • EnterCriticalSection.KERNEL32(008ADB94,?,00889423,00000064,?,00881297,008AEA40,?,00000000,0088187B,80070003,00000000,?,00882051,HKLM\Software\Wavesor\SWUpdater\,00000000), ref: 008894CB
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                        • String ID:
                                                                                        • API String ID: 3269011525-0
                                                                                        • Opcode ID: e152ebaa561e20eb8ef8064635ec515c2e1967d0abec7590697304655608b163
                                                                                        • Instruction ID: 8af4b20680d62c8f9f91b0aab52aa6f3714a23cc76308ac25f59cb87269f9684
                                                                                        • Opcode Fuzzy Hash: e152ebaa561e20eb8ef8064635ec515c2e1967d0abec7590697304655608b163
                                                                                        • Instruction Fuzzy Hash: 31E09236600B24ABDB013B91EC08E9D3F19FB06730B090011FA0AD3E60C76558138BED
                                                                                        Function 0088DA64 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • _free.LIBCMT ref: 0088DA6D
                                                                                          • Part of subcall function 0088FE72: HeapFree.KERNEL32(00000000,00000000,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?), ref: 0088FE88
                                                                                          • Part of subcall function 0088FE72: GetLastError.KERNEL32(?,?,0089288C,?,00000000,?,008AEA3C,?,008928B3,?,00000007,?,?,0089316F,?,?), ref: 0088FE9A
                                                                                        • _free.LIBCMT ref: 0088DA80
                                                                                        • _free.LIBCMT ref: 0088DA91
                                                                                        • _free.LIBCMT ref: 0088DAA2
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free$ErrorFreeHeapLast
                                                                                        • String ID:
                                                                                        • API String ID: 776569668-0
                                                                                        • Opcode ID: dd7560df820aa95d8e9a4b610954926820aacc11d990087f824bb2089af2603f
                                                                                        • Instruction ID: 9f5b0eeb3c6e42c2d481d5e7d3e7469be0f59c8ae9e554b0f303bbfde3f55587
                                                                                        • Opcode Fuzzy Hash: dd7560df820aa95d8e9a4b610954926820aacc11d990087f824bb2089af2603f
                                                                                        • Instruction Fuzzy Hash: 11E09271801920AABA227F28AD5644B3EA1FB767103450C1AF5185BA33C7750952DF92
                                                                                        Function 0088D745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: _free
                                                                                        • String ID: LastCoreRun
                                                                                        • API String ID: 269201875-4229261367
                                                                                        • Opcode ID: 9550514baacf5a3bb3d2f9bbffc61441d0581b6f8417d61a777fb4993e1e120f
                                                                                        • Instruction ID: bafa087448fdfd3c4a7226b2c51a82a4b721ff443705cc5bb5bea87423b4a0e3
                                                                                        • Opcode Fuzzy Hash: 9550514baacf5a3bb3d2f9bbffc61441d0581b6f8417d61a777fb4993e1e120f
                                                                                        • Instruction Fuzzy Hash: E041A036A00304AFDB24EF68C981A5DB7F6FF89714F1544A9E515EB391D630EE01CB91
                                                                                        Function 0088C0D1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0088C0F6
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: EncodePointer
                                                                                        • String ID: MOC$RCC
                                                                                        • API String ID: 2118026453-2084237596
                                                                                        • Opcode ID: 90bbc8e810bb4ee7c2544323d81d144e8874c02e37ca0f4611610fdbc158241d
                                                                                        • Instruction ID: 76f1577602041d9512b7c8b8587f03c9972f12e66d641b25c89dd00aa833a3e7
                                                                                        • Opcode Fuzzy Hash: 90bbc8e810bb4ee7c2544323d81d144e8874c02e37ca0f4611610fdbc158241d
                                                                                        • Instruction Fuzzy Hash: 3741A975900209AFDF15EF98CD85AEEBBB5FF48304F148059F904E7226D3359A50DBA1
                                                                                        Function 0088564D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,00000000,?,?,?,00885741,00000000,?,?,?,008857EC,00000000,?), ref: 00885685
                                                                                        • PathAppendW.SHLWAPI(00000000,Wavesor Software\SWUpdater\Log,?,?,?,00885741,00000000,?,?,?,008857EC,00000000,?,?,00000000), ref: 008856BC
                                                                                        Strings
                                                                                        • Wavesor Software\SWUpdater\Log, xrefs: 008856B6
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: Path$AppendFolder
                                                                                        • String ID: Wavesor Software\SWUpdater\Log
                                                                                        • API String ID: 29327785-1875203572
                                                                                        • Opcode ID: c50dd5eaadaa3999f392657b8e493b9b4e712346b6124c533647a6fc2442f9a5
                                                                                        • Instruction ID: 72aa6dcc37ec8afea172bbc24357bc3dd0a7c38162f7f9f6e1f3bd6bee45b958
                                                                                        • Opcode Fuzzy Hash: c50dd5eaadaa3999f392657b8e493b9b4e712346b6124c533647a6fc2442f9a5
                                                                                        • Instruction Fuzzy Hash: 9A113A71600119ABDF08FFA8CE56DADB369FF51324B640268B512E72D1EE30AF01DB55
                                                                                        Function 0088400C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • GetEnvironmentVariableW.KERNEL32(LocalAppData,00000000,00000000,00000000,?,00000028,00883D53), ref: 0088401D
                                                                                        • GetEnvironmentVariableW.KERNEL32(LocalAppData,00000000,00000000,00000000), ref: 00884034
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: EnvironmentVariable
                                                                                        • String ID: LocalAppData
                                                                                        • API String ID: 1431749950-1192612098
                                                                                        • Opcode ID: 6272e7300d2b4ca8525ca5a83121f13a2247a087c3f60b8cf61a4ee8dd99d29e
                                                                                        • Instruction ID: df3c60dc14831cb9eae293a77a03e2d61d71479aaa5536f20b74d61be3a587ac
                                                                                        • Opcode Fuzzy Hash: 6272e7300d2b4ca8525ca5a83121f13a2247a087c3f60b8cf61a4ee8dd99d29e
                                                                                        • Instruction Fuzzy Hash: FDE04F7234071037D621326D1C4AF6BE56EEFD5B65F24112BB212D2292DE548C024366
                                                                                        Function 00886F9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • IsDebuggerPresent.KERNEL32(?,?,00885CE3), ref: 00886FAA
                                                                                        • OutputDebugStringW.KERNEL32(**SehSendMinidump**,?,?,00885CE3), ref: 00886FB9
                                                                                        Strings
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: DebugDebuggerOutputPresentString
                                                                                        • String ID: **SehSendMinidump**
                                                                                        • API String ID: 4086329628-2587082360
                                                                                        • Opcode ID: 9312ec05a51bb00fc608f39c1e34143d6e814a9e6853cb5121d84eeb54da2bea
                                                                                        • Instruction ID: 6ebdd22cc0eecfe8b76c88b7d42cafa371ad840fbacc21e67fb20566ab0db2c9
                                                                                        • Opcode Fuzzy Hash: 9312ec05a51bb00fc608f39c1e34143d6e814a9e6853cb5121d84eeb54da2bea
                                                                                        • Instruction Fuzzy Hash: 94E0DF35708120AFE3183B65BC4DF663A68FF82702F29002EF613D6110EA60EC219B64
                                                                                        Function 00886934 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26synchronizationCOMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                        • WaitForSingleObject.KERNEL32(00000000,000001F4,?,008867D4), ref: 00886949
                                                                                        • OutputDebugStringW.KERNEL32(00000000), ref: 0088696E
                                                                                        Strings
                                                                                        • LOG_SYSTEM: [%s]: Could not acquire logging mutex %s, xrefs: 00886960
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: DebugObjectOutputSingleStringWait
                                                                                        • String ID: LOG_SYSTEM: [%s]: Could not acquire logging mutex %s
                                                                                        • API String ID: 3023325665-3861772780
                                                                                        • Opcode ID: 6afdc3c82cf518f857cadef20d1b83bc09cc6e5f973c242482266a0faf5231ad
                                                                                        • Instruction ID: ea925b82cdac90510ec29ec72be0a410baff1ca69b5c93df29e8111295d2eaaf
                                                                                        • Opcode Fuzzy Hash: 6afdc3c82cf518f857cadef20d1b83bc09cc6e5f973c242482266a0faf5231ad
                                                                                        • Instruction Fuzzy Hash: DAE092324047119FDF303E34AC09B967FB9FB01324F04891AE092C15D0EB70D46A9B51
                                                                                        Function 008891C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                        Download Yara Rule
                                                                                        APIs
                                                                                          • Part of subcall function 00881165: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,008891F5,?,?,?,008810ED), ref: 0088116A
                                                                                          • Part of subcall function 00881165: GetLastError.KERNEL32(?,008891F5,?,?,?,008810ED), ref: 00881174
                                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,008810ED), ref: 008891F9
                                                                                        • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,008810ED), ref: 00889208
                                                                                        Strings
                                                                                        • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00889203
                                                                                        Memory Dump Source
                                                                                        • Source File: 00000012.00000002.1872360193.0000000000881000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00880000, based on PE: true
                                                                                        • Associated: 00000012.00000002.1872335022.0000000000880000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872419615.000000000089D000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872465617.00000000008AD000.00000004.00000001.01000000.0000001A.sdmpDownload File
                                                                                        • Associated: 00000012.00000002.1872508162.00000000008B0000.00000002.00000001.01000000.0000001A.sdmpDownload File
                                                                                        Joe Sandbox IDA Plugin
                                                                                        • Snapshot File: hcaresult_18_2_880000_SWUpdaterCore.jbxd
                                                                                        Similarity
                                                                                        • API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
                                                                                        • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                        • API String ID: 450123788-631824599
                                                                                        • Opcode ID: 1a49a00720f52a882e7e45079fd635d13f09015a51b69b54bf140984ac857db6
                                                                                        • Instruction ID: a989feb45e2de75bbae6209110d299b41428c4566afec8a1e6cb5ae2203d4a4f
                                                                                        • Opcode Fuzzy Hash: 1a49a00720f52a882e7e45079fd635d13f09015a51b69b54bf140984ac857db6
                                                                                        • Instruction Fuzzy Hash: 77E06D74200750EFD760BF68E9087127BE4FF00704F08885EE8A6C2740EBB5E4498B62