Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1498345
MD5:928d7803f08676539035325d8697fc53
SHA1:cd0dc8cf27e83ce4f8aad5379cb5330d539f4893
SHA256:b577947677a4dacf20eeb42a1e250af220bd161e00bcd20695036bcc3f5ae5e5
Tags:exe
Infos:

Detection

Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for sample
Maps a DLL or memory area into another process
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 6192 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 928D7803F08676539035325D8697FC53)
    • msedge.exe (PID: 6568 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 6192 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=2020,i,9690704396746272970,7138892134863444414,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • firefox.exe (PID: 2004 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • firefox.exe (PID: 3736 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 1308 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 8140 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {417e413c-0ac2-4c75-986c-e5a7a571dbf5} 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 2191046bb10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 8332 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3740 -parentBuildID 20230927232528 -prefsHandle 2644 -prefMapHandle 2632 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0ed6fd-ea1d-4451-9064-cb3a34864dc1} 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 21922520010 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • msedge.exe (PID: 3444 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7528 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6328 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7792 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6616 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • identity_helper.exe (PID: 8600 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6432 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
    • identity_helper.exe (PID: 8620 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6432 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
    • msedge.exe (PID: 8272 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6564 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 8752 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 2896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2056,i,13833807712326710726,497949093223533568,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • msedge.exe (PID: 8620 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 8992 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2032,i,17075278910170813969,5314795059078489493,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: file.exeVirustotal: Detection: 14%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exeJoe Sandbox ML: detected
Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.222.236.120:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00F9DBBE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA68EE FindFirstFileW,FindClose,0_2_00FA68EE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00FA698F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00F9D076
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00F9D3A9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00FA9642
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00FA979D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00FA9B2B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00FA5C97
Source: firefox.exeMemory has grown: Private usage: 1MB later: 93MB
Source: global trafficTCP traffic: 192.168.2.4:49767 -> 1.1.1.1:53
Source: Joe Sandbox ViewIP Address: 13.107.246.64 13.107.246.64
Source: Joe Sandbox ViewIP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox ViewIP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox ViewIP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox ViewJA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.40
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.164
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.164
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.164
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: unknownTCP traffic detected without corresponding DNS query: 142.251.40.110
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FACE44 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_00FACE44
Source: global trafficHTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725071402&P2=404&P3=2&P4=FAfXQEP8oG6E2is%2fQUUmdF3pUAcCOnb68LmvcnOUGZCZUfz5r%2b3TFGrN8KD8XISvw1bMH6K%2bQDCpPvNg3dW9TA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 293Pjiwc74qJFstXUvBKqFSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global trafficHTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZG6HXcpbTsvDHyu&MD=dzM9PfNg HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZG6HXcpbTsvDHyu&MD=dzM9PfNg HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: firefox.exe, 00000004.00000003.1858634356.0000021921EED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.2115327225.000002191E705000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052325514.000002191E705000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860283184.000002191E705000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000004.00000003.2115327225.000002191E705000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052325514.000002191E705000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860283184.000002191E705000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: doff-text" data-l10n-args="{&quot;engine&quot;: &quot;Google&quot;}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{&quot;title&quot;:&quot;YouTube&quot;}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000004.00000003.1858634356.0000021921EED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000004.00000003.1804004332.0000021921E83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1804004332.0000021921EE5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: global trafficDNS traffic detected: DNS query: bzib.nelreports.net
Source: global trafficDNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global trafficDNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: detectportal.firefox.com
Source: global trafficDNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: example.org
Source: global trafficDNS traffic detected: DNS query: ipv4only.arpa
Source: global trafficDNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global trafficDNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global trafficDNS traffic detected: DNS query: services.addons.mozilla.org
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: firefox.exe, 00000004.00000003.1819572515.000002191FC80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 00000004.00000003.2115447573.000002191D276000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/
Source: firefox.exe, 00000004.00000003.2044819871.000002191E762000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 00000004.00000003.2049680628.0000021922625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 00000004.00000003.2115703224.000002191BDF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000004.00000003.1858289387.00000219224ED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000004.00000003.1859338915.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000004.00000003.2045249540.000002191D289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000004.00000003.1820731666.000002191D27F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000004.00000003.1768781872.0000021922983000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.comP
Source: firefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044531981.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044531981.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000004.00000003.2383177569.000002191BC3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://en.wikip
Source: firefox.exe, 00000004.00000003.1869305787.000002191BB26000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000004.00000003.1869018240.000002191BB81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BB81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 00000004.00000003.1869305787.000002191BB26000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000004.00000003.1869018240.000002191BB81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BB81000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000004.00000003.1869305787.000002191BB26000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000004.00000003.2465105947.0000021920DB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1805505572.0000021920D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1819572515.000002191FC5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1817636752.000002192264B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1811254364.00000219209DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044819871.000002191E762000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1768781872.0000021922936000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1766048335.0000021922DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1805505572.0000021920D5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2049893657.000002192259A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1870167824.0000021C0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1857084026.00000219229A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1810831929.0000021920DB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1857084026.00000219229F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860091118.000002191E76A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1727631583.0000021920DB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1815579369.0000021923724000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2330431716.0000021920D5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2466782095.00000219209EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1820500459.000002191E765000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 00000004.00000003.2049680628.0000021922625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000004.00000003.2335012515.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2335045997.000002191BC56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.agfamonotype.
Source: firefox.exe, 00000004.00000003.2384428720.0000021921B78000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
Source: firefox.exe, 00000004.00000003.2330356818.000002191BC36000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2331708595.000002191BC36000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2334306813.000002191BC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2330151395.000002191BC36000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2334193181.000002191BC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
Source: firefox.exe, 00000004.00000003.2331886174.000002191BC55000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2332174789.000002191BC55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
Source: firefox.exe, 00000004.00000003.2331679439.000002191BC55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
Source: firefox.exe, 00000004.00000003.2330356818.000002191BC36000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2330151395.000002191BC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designerss
Source: firefox.exe, 00000004.00000003.2331819200.000002191BC55000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designerssl
Source: firefox.exe, 00000004.00000003.2334081969.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2334165648.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2334133970.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2334049348.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2334278841.000002191BC56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersyLaM
Source: firefox.exe, 00000004.00000003.2331708595.000002191BC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com=
Source: firefox.exe, 00000004.00000003.2334193181.000002191BC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comFe
Source: firefox.exe, 00000004.00000003.2334306813.000002191BC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2334193181.000002191BC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comQ
Source: firefox.exe, 00000004.00000003.2331848405.000002191BC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comTF
Source: firefox.exe, 00000004.00000003.2330151395.000002191BC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comcom
Source: firefox.exe, 00000004.00000003.2331777250.000002191BC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comx
Source: firefox.exe, 00000004.00000003.2413794667.000002191BC29000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2415313209.000002191BC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2339732288.000002191BC31000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2339815213.000002191BC35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2417101704.000002191BC33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
Source: firefox.exe, 00000004.00000003.2415313209.000002191BC32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnC
Source: firefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000004.00000003.2409067761.000002191BC31000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2390193625.000002191BC32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2390933527.000002191BC32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: firefox.exe, 00000004.00000003.2390193625.000002191BC32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: firefox.exe, 00000004.00000003.2390193625.000002191BC32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: firefox.exe, 00000004.00000003.2335565689.000002191BC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.monotype.G
Source: firefox.exe, 00000004.00000003.2049680628.0000021922625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 00000004.00000003.2044410438.0000021920B71000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000004.00000003.1817504266.000002192268B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818716201.000002192044A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818624623.000002192046B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000004.00000003.1817666405.000002192263B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulj;
Source: firefox.exe, 00000004.00000003.2044594527.000002192046B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulp
Source: firefox.exe, 00000004.00000003.2330916899.000002191BC36000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2331123833.000002191BC36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
Source: firefox.exe, 00000004.00000003.2384428720.0000021921B78000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
Source: firefox.exe, 00000004.00000003.2384428720.0000021921B78000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
Source: mozilla-temp-41.4.drString found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 00000004.00000003.2409871011.000002191BC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
Source: firefox.exe, 00000004.00000003.2409871011.000002191BC31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cncs
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000004.00000003.1814573771.000002192375A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000004.00000003.1817140962.00000219226A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2042399264.00000219226A2000.00000004.00000800.00020000.00000000.sdmp, Session_13368940199950117.7.drString found in binary or memory: https://accounts.google.com
Source: Session_13368940199950117.7.dr, 000003.log5.7.drString found in binary or memory: https://accounts.google.com/
Source: History.7.dr, Favicons.7.drString found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/v3/signin/challeng
Source: firefox.exe, 00000010.00000002.2885878610.000001BDEB5AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?se
Source: firefox.exe, 0000000B.00000002.2886198705.000002336A96A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?seR
Source: Favicons.7.drString found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.co
Source: Session_13368940199950117.7.drString found in binary or memory: https://accounts.google.com/_/bscframe
Source: Favicons.7.drString found in binary or memory: https://accounts.google.com/favicon.ico
Source: file.exe, 00000000.00000002.1648266136.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1647148894.000000000109F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1647148894.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1648266136.000000000109F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000002.00000002.1650084091.0000028DCD6A2000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000002.00000003.1649213156.0000028DCD69D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000B.00000002.2886198705.000002336A96A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdMOZ_CO
Source: file.exe, 00000000.00000003.1647148894.000000000109F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1648266136.000000000109F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdMic
Source: file.exe, 00000000.00000003.1647148894.0000000001091000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1648266136.0000000001091000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdo
Source: Favicons.7.drString found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2Fv3%2Fs
Source: firefox.exe, 00000004.00000003.2019144272.000002191BDF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000004.00000003.1804004332.0000021921E83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1804004332.0000021921EE5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000004.00000003.2115703224.000002191BDF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000004.00000003.2115703224.000002191BDF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000004.00000003.2019017761.000002191C5C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115590472.000002191C5C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052606501.000002191C5C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://bard.google.com/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868475418.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868475418.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000004.00000003.1767342930.0000021921096000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mo
Source: Reporting and NEL.7.drString found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.7.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.7.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.7.drString found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.7.drString found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.7.drString found in binary or memory: https://chromewebstore.google.com/
Source: 647c75f7-7710-48fa-85e2-99a2bd50ac86.tmp.8.drString found in binary or memory: https://clients2.google.com
Source: manifest.json0.7.drString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717018795.000002192018A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868475418.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868475418.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/AccountsSignInUi
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/apps-themes
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers
Source: Reporting and NEL.7.drString found in binary or memory: https://csp.withgoogle.com/csp/report-to/static-on-bigtable
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044531981.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: manifest.json0.7.drString found in binary or memory: https://docs.google.com/
Source: firefox.exe, 00000004.00000003.2336798287.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336994405.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336850879.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2337076645.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336943589.000002191BC58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.micd
Source: firefox.exe, 00000004.00000003.2336798287.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336994405.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336850879.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2337076645.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336943589.000002191BC58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.mich
Source: firefox.exe, 00000004.00000003.2336798287.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336994405.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336850879.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2337076645.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336943589.000002191BC58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.microso
Source: firefox.exe, 00000004.00000003.2336798287.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336994405.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336850879.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2337076645.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336943589.000002191BC58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.microsob
Source: manifest.json0.7.drString found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.7.drString found in binary or memory: https://drive.google.com/
Source: firefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052026397.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859338915.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/
Source: Web Data.7.drString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.7.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.7.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000004.00000003.2459634434.000002191E019000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1723309022.000002191E033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044969378.000002191E2E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: 000003.log.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.7.dr, bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.7.dr, bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.7.dr, bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.7.dr, bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.7.dr, bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.7.dr, bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.7.dr, bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: firefox.exe, 00000004.00000003.2459634434.000002191E019000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1723309022.000002191E033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044969378.000002191E2E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000004.00000003.2052606501.000002191C5C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 00000004.00000003.2052606501.000002191C5C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: 647c75f7-7710-48fa-85e2-99a2bd50ac86.tmp.8.drString found in binary or memory: https://fonts.gstatic.com
Source: firefox.exe, 00000004.00000003.1861227460.000002191E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1864192252.000002191D235000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821249736.000002191D235000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://gaana.com/
Source: firefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000004.00000003.1817474423.000002192269A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com
Source: firefox.exe, 00000004.00000003.2042399264.00000219226DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1817140962.00000219226DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://ideas.mozilla.org/
Source: prefs-1.js.4.drString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000004.00000003.2019144272.000002191BDF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://install.mozilla.org
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: firefox.exe, 00000004.00000003.2115703224.000002191BDF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000004.00000003.2052606501.000002191C5C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000004.00000003.1767342930.0000021921096000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1772807172.0000021921D6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052606501.000002191C5C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000004.00000003.1814573771.000002192375A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: firefox.exe, 00000004.00000003.1815943338.0000021922DB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1814573771.000002192375A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1766048335.0000021922DB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://m.kugou.com/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://m.soundcloud.com/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://m.vk.com/
Source: firefox.exe, 00000004.00000003.2459634434.000002191E019000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1723309022.000002191E033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044969378.000002191E2E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: firefox.exe, 00000004.00000003.2459634434.000002191E019000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1723309022.000002191E033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044969378.000002191E2E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000004.00000003.2459634434.000002191E019000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1723309022.000002191E033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044969378.000002191E2E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: firefox.exe, 0000000B.00000002.2887159946.000002336AB72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB98E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000004.00000003.2019144272.000002191BDF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://music.amazon.com
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://music.apple.com
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://music.yandex.com
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://open.spotify.com
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: firefox.exe, 00000004.00000003.2459634434.000002191E019000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1723309022.000002191E033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044969378.000002191E2E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://outlook.live.com/mail/0/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://outlook.office.com/mail/0/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000004.00000003.2459634434.000002191E019000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1723309022.000002191E033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044969378.000002191E2E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000004.00000003.1869228558.000002191BB49000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000004.00000003.2115447573.000002191D276000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com
Source: firefox.exe, 00000004.00000003.2045249540.000002191D289000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/
Source: firefox.exe, 00000004.00000003.2045684870.000002191D282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-linux-x64.zip
Source: firefox.exe, 00000004.00000003.2045684870.000002191D282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-arm64.zip
Source: firefox.exe, 00000004.00000003.2045684870.000002191D282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip
Source: firefox.exe, 00000004.00000003.2045684870.000002191D282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-arm64.zip
Source: firefox.exe, 00000004.00000003.2044819871.000002191E762000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045684870.000002191D282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip
Source: firefox.exe, 00000004.00000003.2045684870.000002191D282000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x86.zip
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000004.00000003.2019144272.000002191BDF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000004.00000003.2044410438.0000021920B59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045249540.000002191D2CF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000004.00000003.2052026397.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859338915.0000021921D2F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000004.00000003.2052026397.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859338915.0000021921D2F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000004.00000003.1804004332.0000021921E83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1804004332.0000021921EE5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000004.00000003.1866880728.000002191BDF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000004.00000003.1858036473.00000219227F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2049450112.00000219227F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1817082939.00000219227E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1772268065.00000219227E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000004.00000003.2044819871.000002191E762000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044531981.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044531981.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://tidal.com/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000004.00000003.2019144272.000002191BDF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://vibe.naver.com/today
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://web.telegram.org/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://web.whatsapp.com
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868475418.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052026397.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717018795.000002192018A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859338915.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000004.00000003.1819572515.000002191FCD2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.deezer.com/
Source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drString found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868475418.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drString found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: content_new.js.7.dr, content.js.7.drString found in binary or memory: https://www.google.com/chrome
Source: firefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717018795.000002192018A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: Web Data.7.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052026397.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717018795.000002192018A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859338915.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.iheart.com/podcast/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.instagram.com
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.last.fm/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.messenger.com
Source: firefox.exe, 00000004.00000003.1820731666.000002191D29F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821249736.000002191D235000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000004.00000003.2116095600.000002191BB5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/9
Source: firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000004.00000003.1819572515.000002191FCD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1814573771.000002192375A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.office.com
Source: Top Sites.7.drString found in binary or memory: https://www.office.com/
Source: Top Sites.7.drString found in binary or memory: https://www.office.com/Office
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: firefox.exe, 00000004.00000003.1867391380.000002191BDDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.tiktok.com/
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://www.youtube.com
Source: firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115327225.000002191E705000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052325514.000002191E705000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860283184.000002191E705000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044531981.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drString found in binary or memory: https://y.music.163.com/m/
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49672 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49808
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49672
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49808 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknownHTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknownHTTPS traffic detected: 52.222.236.120:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknownHTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FAEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00FAEAFF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FAED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00FAED6A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FAEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00FAEAFF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_00F9AA57
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00FC9576

System Summary

barindex
Binary is likely a compiled AutoIt script file
Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1642305133.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_4890b73c-1
Source: file.exe, 00000000.00000000.1642305133.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_af5fa944-c
Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_68220739-6
Source: file.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_d7942f4e-3
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001BDEB859732 NtQuerySystemInformation,16_2_000001BDEB859732
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001BDEB8531B7 NtQuerySystemInformation,16_2_000001BDEB8531B7
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9D5EB: CreateFileW,DeviceIoControl,CloseHandle,0_2_00F9D5EB
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F91201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00F91201
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00F9E8F6
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F380600_2_00F38060
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA20460_2_00FA2046
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F982980_2_00F98298
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F6E4FF0_2_00F6E4FF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F6676B0_2_00F6676B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC48730_2_00FC4873
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F3CAF00_2_00F3CAF0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F5CAA00_2_00F5CAA0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F4CC390_2_00F4CC39
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F66DD90_2_00F66DD9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F391C00_2_00F391C0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F4B1190_2_00F4B119
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F513940_2_00F51394
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F517060_2_00F51706
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F5781B0_2_00F5781B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F519B00_2_00F519B0
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F4997D0_2_00F4997D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F379200_2_00F37920
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F57A4A0_2_00F57A4A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F57CA70_2_00F57CA7
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F51C770_2_00F51C77
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F69EEE0_2_00F69EEE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FBBE440_2_00FBBE44
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F51F320_2_00F51F32
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001BDEB85973216_2_000001BDEB859732
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001BDEB8531B716_2_000001BDEB8531B7
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001BDEB859E5C16_2_000001BDEB859E5C
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001BDEB85977216_2_000001BDEB859772
Source: C:\Users\user\Desktop\file.exeCode function: String function: 00F50A30 appears 46 times
Source: C:\Users\user\Desktop\file.exeCode function: String function: 00F4F9F2 appears 31 times
Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engineClassification label: mal68.evad.winEXE@72/333@27/18
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA37B5 GetLastError,FormatMessageW,0_2_00FA37B5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F910BF AdjustTokenPrivileges,CloseHandle,0_2_00F910BF
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F916C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00F916C3
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00FA51CD
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,0_2_00F9D4DC
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_00FA648E
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F342A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00F342A2
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66C945A4-19A8.pmaJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Local\Temp\firefoxJump to behavior
Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Login Data.7.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exeVirustotal: Detection: 14%
Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=2020,i,9690704396746272970,7138892134863444414,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {417e413c-0ac2-4c75-986c-e5a7a571dbf5} 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 2191046bb10 socket
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6328 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6616 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6432 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6432 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3740 -parentBuildID 20230927232528 -prefsHandle 2644 -prefMapHandle 2632 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0ed6fd-ea1d-4451-9064-cb3a34864dc1} 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 21922520010 rdd
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2056,i,13833807712326710726,497949093223533568,262144 /prefetch:3
Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2032,i,17075278910170813969,5314795059078489493,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6564 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=2020,i,9690704396746272970,7138892134863444414,262144 /prefetch:3Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {417e413c-0ac2-4c75-986c-e5a7a571dbf5} 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 2191046bb10 socketJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3740 -parentBuildID 20230927232528 -prefsHandle 2644 -prefMapHandle 2632 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0ed6fd-ea1d-4451-9064-cb3a34864dc1} 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 21922520010 rddJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:3Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6328 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6616 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6432 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6432 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6564 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2056,i,13833807712326710726,497949093223533568,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2032,i,17075278910170813969,5314795059078489493,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr
Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.dr
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00F342DE
Source: gmpopenh264.dll.tmp.4.drStatic PE information: section name: .rodata
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9C9FE push esi; ret 0_2_00F9CA01
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F50A76 push ecx; ret 0_2_00F50A89
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9CA33 push esi; ret 0_2_00F9CA36
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpJump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868Jump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F4F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00F4F98E
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00FC1C41
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Contains functionality to detect sleep reduction / modifications
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F3D85A0_2_00F3D85A
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001BDEB859732 rdtsc 16_2_000001BDEB859732
Source: C:\Users\user\Desktop\file.exeAPI coverage: 3.5 %
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00F9DBBE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA68EE FindFirstFileW,FindClose,0_2_00FA68EE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00FA698F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00F9D076
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00F9D3A9
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00FA9642
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00FA979D
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00FA9B2B
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00FA5C97
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00F342DE
Source: firefox.exe, 00000010.00000002.2890136051.000001BDEBE60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8~
Source: firefox.exe, 00000010.00000002.2890136051.000001BDEBE60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: firefox.exe, 0000000B.00000002.2886198705.000002336A96A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW3
Source: firefox.exe, 0000000B.00000002.2892662759.000002336AE00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>m
Source: firefox.exe, 00000010.00000002.2885878610.000001BDEB5AA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
Source: firefox.exe, 00000004.00000003.1867391380.000002191BDC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2891435338.000002336AD15000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000000B.00000002.2892662759.000002336AE00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllCmw
Source: firefox.exe, 00000010.00000002.2890136051.000001BDEBE60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWHz
Source: firefox.exe, 0000000B.00000002.2886198705.000002336A96A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
Source: firefox.exe, 0000000B.00000002.2892662759.000002336AE00000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 16_2_000001BDEB859732 rdtsc 16_2_000001BDEB859732
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FAEAA2 BlockInput,0_2_00FAEAA2
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F62622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00F62622
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00F342DE
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F54CE8 mov eax, dword ptr fs:[00000030h]0_2_00F54CE8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F90B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00F90B62
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F62622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00F62622
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F5083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00F5083F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F509D5 SetUnhandledExceptionFilter,0_2_00F509D5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F50C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00F50C21

HIPS / PFW / Operating System Protection Evasion

barindex
Maps a DLL or memory area into another process
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeSection loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonlyJump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F91201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00F91201
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F72BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00F72BA5
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9B226 SendInput,keybd_event,0_2_00F9B226
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FB22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,0_2_00FB22DA
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwdJump to behavior
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F90B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00F90B62
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F91663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00F91663
Source: file.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exeBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F50698 cpuid 0_2_00F50698
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_00FA8195
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F8D27A GetUserNameW,0_2_00F8D27A
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F6BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00F6BB6F
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00F342DE
Source: file.exeBinary or memory string: WIN_81
Source: file.exeBinary or memory string: WIN_XP
Source: file.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exeBinary or memory string: WIN_XPe
Source: file.exeBinary or memory string: WIN_VISTA
Source: file.exeBinary or memory string: WIN_7
Source: file.exeBinary or memory string: WIN_8
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FB1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_00FB1204
Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FB1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00FB1806

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure2
Valid Accounts		1
Native API		1
DLL Side-Loading		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		21
Input Capture		2
System Time Discovery		Remote Services1
Archive Collected Data		2
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault AccountsScheduled Task/Job2
Valid Accounts		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol21
Input Capture		11
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Registry Run Keys / Startup Folder		1
Extra Window Memory Injection		2
Obfuscated Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin Shares3
Clipboard Data		3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
Valid Accounts		1
DLL Side-Loading		NTDS15
System Information Discovery		Distributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
Access Token Manipulation		1
Extra Window Memory Injection		LSA Secrets131
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts112
Process Injection		1
Masquerading		Cached Domain Credentials3
Process Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
Registry Run Keys / Startup Folder		2
Valid Accounts		DCSync1
Application Window Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
Access Token Manipulation		Proc Filesystem1
System Owner/User Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt112
Process Injection		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1498345 Sample: file.exe Startdate: 24/08/2024 Architecture: WINDOWS Score: 68 48 services.addons.mozilla.org 2->48 50 prod.remote-settings.prod.webservices.mozgcp.net 2->50 52 10 other IPs or domains 2->52 70 Multi AV Scanner detection for submitted file 2->70 72 Binary is likely a compiled AutoIt script file 2->72 74 Machine Learning detection for sample 2->74 76 AI detected suspicious sample 2->76 8 file.exe 1 2->8         started        11 msedge.exe 106 521 2->11         started        14 firefox.exe 1 2->14         started        16 2 other processes 2->16 signatures3 process4 dnsIp5 78 Binary is likely a compiled AutoIt script file 8->78 80 Contains functionality to detect sleep reduction / modifications 8->80 18 msedge.exe 16 8->18         started        20 firefox.exe 1 8->20         started        66 192.168.2.4, 138, 443, 49672 unknown unknown 11->66 68 239.255.255.250 unknown Reserved 11->68 82 Maps a DLL or memory area into another process 11->82 22 msedge.exe 11->22         started        25 msedge.exe 11->25         started        27 msedge.exe 11->27         started        36 3 other processes 11->36 29 firefox.exe 3 90 14->29         started        32 msedge.exe 16->32         started        34 msedge.exe 16->34         started        signatures6 process7 dnsIp8 38 msedge.exe 18->38         started        54 13.107.246.40, 443, 49772, 49773 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 22->54 56 s-part-0036.t-0009.t-msedge.net 13.107.246.64, 443, 49764, 49765 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 22->56 62 13 other IPs or domains 22->62 58 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 49785, 49790, 49803 GOOGLEUS United States 29->58 60 prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216, 443, 49768, 49800 GOOGLEUS United States 29->60 64 4 other IPs or domains 29->64 44 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 29->44 dropped 46 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 29->46 dropped 40 firefox.exe 29->40         started        42 firefox.exe 29->42         started        file9 process10

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
file.exe15%VirustotalBrowse
file.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
example.org0%VirustotalBrowse
chrome.cloudflare-dns.com0%VirustotalBrowse
prod.classify-client.prod.webservices.mozgcp.net0%VirustotalBrowse
prod.balrog.prod.cloudops.mozgcp.net0%VirustotalBrowse
prod.detectportal.prod.cloudops.mozgcp.net0%VirustotalBrowse
services.addons.mozilla.org0%VirustotalBrowse
ipv4only.arpa0%VirustotalBrowse
clients2.googleusercontent.com0%VirustotalBrowse
sni1gl.wpc.nucdn.net0%VirustotalBrowse
firefox.settings.services.mozilla.com0%VirustotalBrowse
bzib.nelreports.net0%VirustotalBrowse
detectportal.firefox.com0%VirustotalBrowse
prod.remote-settings.prod.webservices.mozgcp.net0%VirustotalBrowse
googlehosted.l.googleusercontent.com0%VirustotalBrowse
s-part-0036.t-0009.t-msedge.net0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
http://detectportal.firefox.com/0%URL Reputationsafe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%0%URL Reputationsafe
http://www.mozilla.com00%URL Reputationsafe
http://www.mozilla.com00%URL Reputationsafe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.0%URL Reputationsafe
https://merino.services.mozilla.com/api/v1/suggest0%URL Reputationsafe
http://www.fontbureau.com/designers0%URL Reputationsafe
http://www.fontbureau.com/designers0%URL Reputationsafe
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect0%URL Reputationsafe
https://screenshots.firefox.com0%URL Reputationsafe
https://completion.amazon.com/search/complete?q=0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report0%URL Reputationsafe
https://ads.stickyadstv.com/firefox-etp0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab0%URL Reputationsafe
https://monitor.firefox.com/breach-details/0%URL Reputationsafe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM0%URL Reputationsafe
https://xhr.spec.whatwg.org/#sync-warning0%URL Reputationsafe
https://profiler.firefox.com/0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/addons/addon/0%URL Reputationsafe
http://www.zhongyicts.com.cn0%URL Reputationsafe
https://tracking-protection-issues.herokuapp.com/new0%URL Reputationsafe
http://exslt.org/sets0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report0%URL Reputationsafe
https://api.accounts.firefox.com/v10%URL Reputationsafe
http://exslt.org/common0%URL Reputationsafe
https://drive-daily-2.corp.google.com/0%URL Reputationsafe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/0%URL Reputationsafe
https://fpn.firefox.com0%URL Reputationsafe
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections0%URL Reputationsafe
https://drive-daily-1.corp.google.com/0%URL Reputationsafe
https://drive-daily-5.corp.google.com/0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield0%URL Reputationsafe
http://www.carterandcone.coml0%URL Reputationsafe
https://bzib.nelreports.net/api/report?cat=bingbusiness0%URL Reputationsafe
https://bugzilla.mo0%URL Reputationsafe
https://mitmdetection.services.mozilla.com/0%URL Reputationsafe
https://chromewebstore.google.com/0%URL Reputationsafe
https://drive-preprod.corp.google.com/0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/0%URL Reputationsafe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%0%URL Reputationsafe
https://duckduckgo.com/chrome_newtab0%Avira URL Cloudsafe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f0%URL Reputationsafe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-0%Avira URL Cloudsafe
https://monitor.firefox.com/user/breach-stats?includeResolved=true0%URL Reputationsafe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report0%URL Reputationsafe
https://duckduckgo.com/ac/?q=0%Avira URL Cloudsafe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-0%URL Reputationsafe
https://docs.google.com/0%Avira URL Cloudsafe
https://csp.withgoogle.com/csp/report-to/apps-themes0%Avira URL Cloudsafe
https://safebrowsing.google.com/safebrowsing/diagnostic?site=0%URL Reputationsafe
https://monitor.firefox.com/user/dashboard0%URL Reputationsafe
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID0%URL Reputationsafe
https://monitor.firefox.com/about0%URL Reputationsafe
https://account.bellmedia.c0%URL Reputationsafe
https://www.openh264.org/0%URL Reputationsafe
https://login.microsoftonline.com0%URL Reputationsafe
https://coverage.mozilla.org0%URL Reputationsafe
http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
https://blocked.cdn.mozilla.net/0%URL Reputationsafe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored0%URL Reputationsafe
http://developer.mozilla.org/en/docs/DOM:element.addEventListener0%URL Reputationsafe
https://profiler.firefox.com0%URL Reputationsafe
https://outlook.live.com/default.aspx?rru=compose&to=%s0%URL Reputationsafe
https://mozilla.cloudflare-dns.com/dns-query0%URL Reputationsafe
https://www.youtube.com0%Avira URL Cloudsafe
https://www.instagram.com0%Avira URL Cloudsafe
https://duckduckgo.com/ac/?q=0%VirustotalBrowse
https://www.amazon.com/exec/obidos/external-search/0%Avira URL Cloudsafe
https://www.amazon.com/exec/obidos/external-search/0%VirustotalBrowse
https://www.msn.com0%Avira URL Cloudsafe
https://www.instagram.com0%VirustotalBrowse
https://docs.google.com/0%VirustotalBrowse
https://www.youtube.com0%VirustotalBrowse
https://www.msn.com0%VirustotalBrowse
https://duckduckgo.com/chrome_newtab0%VirustotalBrowse
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge0%Avira URL Cloudsafe
https://csp.withgoogle.com/csp/report-to/apps-themes0%VirustotalBrowse
https://outlook.office.com/mail/compose?isExtension=true0%Avira URL Cloudsafe
https://github.com/mozilla-services/screenshots0%Avira URL Cloudsafe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-0%VirustotalBrowse
https://i.y.qq.com/n2/m/index.html0%Avira URL Cloudsafe
https://www.deezer.com/0%Avira URL Cloudsafe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc940%Avira URL Cloudsafe
https://web.telegram.org/0%Avira URL Cloudsafe
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge0%VirustotalBrowse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%Avira URL Cloudsafe
https://i.y.qq.com/n2/m/index.html0%VirustotalBrowse
https://outlook.office.com/mail/compose?isExtension=true0%VirustotalBrowse
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta0%Avira URL Cloudsafe
https://www.deezer.com/0%VirustotalBrowse
http://www.jiyu-kobo.co.jp/F0%Avira URL Cloudsafe
https://web.telegram.org/0%VirustotalBrowse
https://excel.new?from=EdgeM365Shoreline0%Avira URL Cloudsafe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%VirustotalBrowse
https://www.youtube.com/0%Avira URL Cloudsafe
https://www.google.com/favicon.ico0%Avira URL Cloudsafe
http://127.0.0.1:0%Avira URL Cloudsafe
http://detectportal.firefox.comP0%Avira URL Cloudsafe
https://excel.new?from=EdgeM365Shoreline0%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
example.org
93.184.215.14
truefalseunknown
chrome.cloudflare-dns.com
162.159.61.3
truefalseunknown
prod.classify-client.prod.webservices.mozgcp.net
35.190.72.216
truefalseunknown
prod.balrog.prod.cloudops.mozgcp.net
35.244.181.201
truefalseunknown
prod.detectportal.prod.cloudops.mozgcp.net
34.107.221.82
truefalseunknown
services.addons.mozilla.org
52.222.236.120
truefalseunknown
ipv4only.arpa
192.0.0.171
truefalseunknown
s-part-0036.t-0009.t-msedge.net
13.107.246.64
truefalseunknown
prod.remote-settings.prod.webservices.mozgcp.net
34.149.100.209
truefalseunknown
googlehosted.l.googleusercontent.com
142.250.184.193
truefalseunknown
sni1gl.wpc.nucdn.net
152.199.21.175
truefalseunknown
clients2.googleusercontent.com
unknown
unknownfalseunknown
bzib.nelreports.net
unknown
unknownfalseunknown
firefox.settings.services.mozilla.com
unknown
unknownfalseunknown
detectportal.firefox.com
unknown
unknownfalseunknown

Contacted URLs

NameMaliciousAntivirus DetectionReputation
https://www.google.com/favicon.icofalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://duckduckgo.com/chrome_newtabWeb Data.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://duckduckgo.com/ac/?q=Web Data.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://detectportal.firefox.com/firefox.exe, 00000004.00000003.1858289387.00000219224ED000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.mozilla.com0firefox.exe, 00000004.00000003.2049680628.0000021922625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868475418.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drfalse
  • URL Reputation: safe
unknown
https://merino.services.mozilla.com/api/v1/suggestfirefox.exe, 0000000B.00000002.2887159946.000002336AB72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB98E000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://csp.withgoogle.com/csp/report-to/apps-themesReporting and NEL.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.fontbureau.com/designersfirefox.exe, 00000004.00000003.2331886174.000002191BC55000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2332174789.000002191BC55000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protectfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://docs.google.com/manifest.json0.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://screenshots.firefox.comfirefox.exe, 00000004.00000003.2019144272.000002191BDF9000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.youtube.combf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://completion.amazon.com/search/complete?q=firefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717018795.000002192018A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-reportfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://ads.stickyadstv.com/firefox-etpfirefox.exe, 00000004.00000003.1804004332.0000021921E83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1804004332.0000021921EE5000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.instagram.combf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tabfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/breach-details/firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEMfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://xhr.spec.whatwg.org/#sync-warningfirefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044531981.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.amazon.com/exec/obidos/external-search/firefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052026397.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1717018795.000002192018A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859338915.0000021921D2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://profiler.firefox.com/firefox.exe, 00000004.00000003.1869228558.000002191BB49000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.msn.comfirefox.exe, 00000004.00000003.1819572515.000002191FCD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1814573771.000002192375A000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedgebf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://outlook.office.com/mail/compose?isExtension=truebf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/mozilla-services/screenshotsfirefox.exe, 00000004.00000003.1715286752.0000021920138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715921629.000002192016F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715120697.000002192011D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715583667.0000021920153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1715001724.000002191FC00000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/addon/firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.zhongyicts.com.cnfirefox.exe, 00000004.00000003.2409871011.000002191BC31000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://tracking-protection-issues.herokuapp.com/newfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://exslt.org/setsfirefox.exe, 00000004.00000003.1869305787.000002191BB26000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-reportfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://i.y.qq.com/n2/m/index.htmlbf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.deezer.com/bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868475418.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drfalse
  • Avira URL Cloud: safe
unknown
https://web.telegram.org/bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-reportfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://api.accounts.firefox.com/v1firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://exslt.org/commonfirefox.exe, 00000004.00000003.1869305787.000002191BB26000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-daily-2.corp.google.com/manifest.json0.7.drfalse
  • URL Reputation: safe
unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://fpn.firefox.comfirefox.exe, 00000004.00000003.1861227460.000002191E287000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1864192252.000002191D235000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821249736.000002191D235000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protectionsfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=Web Data.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&ctafirefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1868475418.000002191BBB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2887159946.000002336ABC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.2887617133.000001BDEB9DA000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.4.drfalse
  • Avira URL Cloud: safe
unknown
http://www.jiyu-kobo.co.jp/Ffirefox.exe, 00000004.00000003.2390193625.000002191BC32000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://drive-daily-1.corp.google.com/manifest.json0.7.drfalse
  • URL Reputation: safe
unknown
https://excel.new?from=EdgeM365Shorelinebf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.youtube.com/firefox.exe, 00000004.00000003.2018643430.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1821157406.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115327225.000002191E705000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2052325514.000002191E705000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045759193.000002191D24B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860283184.000002191E705000.00000004.00000800.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://drive-daily-5.corp.google.com/manifest.json0.7.drfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shieldfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.carterandcone.comlfirefox.exe, 00000004.00000003.2384428720.0000021921B78000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://bzib.nelreports.net/api/report?cat=bingbusinessReporting and NEL.7.drfalse
  • URL Reputation: safe
unknown
http://127.0.0.1:firefox.exe, 00000004.00000003.1819572515.000002191FC80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://bugzilla.mofirefox.exe, 00000004.00000003.1767342930.0000021921096000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://mitmdetection.services.mozilla.com/firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://detectportal.firefox.comPfirefox.exe, 00000004.00000003.1768781872.0000021922983000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.monotype.Gfirefox.exe, 00000004.00000003.2335565689.000002191BC31000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://chromewebstore.google.com/manifest.json.7.drfalse
  • URL Reputation: safe
unknown
https://drive-preprod.corp.google.com/manifest.json0.7.drfalse
  • URL Reputation: safe
unknown
https://chrome.google.com/webstore/manifest.json.7.drfalse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-ffirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://bard.google.com/bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • Avira URL Cloud: safe
unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_rfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=truefirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-reportfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.office.combf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • Avira URL Cloud: safe
unknown
https://outlook.live.com/mail/0/bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • Avira URL Cloud: safe
unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-firefox.exe, 00000004.00000003.2044410438.0000021920B59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2045249540.000002191D2CF000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.inbox.lv/rfc2368/?value=%sufirefox.exe, 00000004.00000003.2017958682.000002191E2D9000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/user/dashboardfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_IDfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://tidal.com/bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • Avira URL Cloud: safe
unknown
https://monitor.firefox.com/aboutfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://mozilla.org/MPL/2.0/.firefox.exe, 00000004.00000003.2465105947.0000021920DB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1805505572.0000021920D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1819572515.000002191FC5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1817636752.000002192264B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1811254364.00000219209DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044819871.000002191E762000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1768781872.0000021922936000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1766048335.0000021922DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1805505572.0000021920D5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2049893657.000002192259A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1870167824.0000021C0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1857084026.00000219229A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1810831929.0000021920DB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1857084026.00000219229F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1860091118.000002191E76A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1727631583.0000021920DB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1815579369.0000021923724000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2330431716.0000021920D5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2466782095.00000219209EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1820500459.000002191E765000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://account.bellmedia.cfirefox.exe, 00000004.00000003.1814573771.000002192375A000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.openh264.org/firefox.exe, 00000004.00000003.1867391380.000002191BDDA000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://www.zhongyicts.com.cncsfirefox.exe, 00000004.00000003.2409871011.000002191BC31000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://docs.microsobfirefox.exe, 00000004.00000003.2336798287.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336994405.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336850879.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2337076645.000002191BC56000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2336943589.000002191BC58000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://gaana.com/bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • Avira URL Cloud: safe
unknown
https://login.microsoftonline.comfirefox.exe, 00000004.00000003.1815943338.0000021922DB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1814573771.000002192375A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1766048335.0000021922DB5000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://coverage.mozilla.orgfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0firefox.exe, 00000004.00000003.2049680628.0000021922625000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2054179065.0000021921100000.00000004.00000800.00020000.00000000.sdmp, gmpopenh264.dll.tmp.4.drfalse
  • URL Reputation: safe
unknown
https://csp.withgoogle.com/csp/report-to/AccountsSignInUiReporting and NEL.7.drfalse
  • Avira URL Cloud: safe
unknown
https://outlook.live.com/mail/compose?isExtension=truebf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • Avira URL Cloud: safe
unknown
https://blocked.cdn.mozilla.net/firefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnoredfirefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044531981.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://developer.mozilla.org/en/docs/DOM:element.addEventListenerfirefox.exe, 00000004.00000003.1859764008.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044531981.00000219204BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1818583033.00000219204AD000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://exslt.org/dates-and-times$firefox.exe, 00000004.00000003.1869018240.000002191BB81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2115757322.000002191BB81000.00000004.00000800.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=truebf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • Avira URL Cloud: safe
unknown
https://profiler.firefox.comfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://outlook.live.com/default.aspx?rru=compose&to=%sfirefox.exe, 00000004.00000003.2459634434.000002191E019000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.1723309022.000002191E033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000004.00000003.2044969378.000002191E2E6000.00000004.00000800.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://latest.web.skype.com/?browsername=edge_canary_shorelinebf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • Avira URL Cloud: safe
unknown
https://word.new?from=EdgeM365Shorelinebf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp.7.drfalse
  • Avira URL Cloud: safe
unknown
https://mozilla.cloudflare-dns.com/dns-queryfirefox.exe, 0000000B.00000002.2890888216.000002336AC20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000010.00000002.2886090850.000001BDEB6B0000.00000002.08000000.00040000.00000000.sdmpfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
13.107.246.64
s-part-0036.t-0009.t-msedge.netUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
13.107.246.40
unknownUnited States
8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
152.195.19.97
unknownUnited States
15133EDGECASTUSfalse
142.251.40.106
unknownUnited States
15169GOOGLEUSfalse
104.70.121.146
unknownUnited States
20940AKAMAI-ASN1EUfalse
162.159.61.3
chrome.cloudflare-dns.comUnited States
13335CLOUDFLARENETUSfalse
142.251.40.110
unknownUnited States
15169GOOGLEUSfalse
52.222.236.120
services.addons.mozilla.orgUnited States
16509AMAZON-02USfalse
142.251.16.84
unknownUnited States
15169GOOGLEUSfalse
142.250.184.193
googlehosted.l.googleusercontent.comUnited States
15169GOOGLEUSfalse
34.149.100.209
prod.remote-settings.prod.webservices.mozgcp.netUnited States
2686ATGS-MMD-ASUSfalse
34.107.221.82
prod.detectportal.prod.cloudops.mozgcp.netUnited States
15169GOOGLEUSfalse
142.251.40.164
unknownUnited States
15169GOOGLEUSfalse
35.244.181.201
prod.balrog.prod.cloudops.mozgcp.netUnited States
15169GOOGLEUSfalse
239.255.255.250
unknownReserved
unknownunknownfalse
35.190.72.216
prod.classify-client.prod.webservices.mozgcp.netUnited States
15169GOOGLEUSfalse

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1498345
Start date and time:2024-08-24 04:29:08 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 6m 39s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:27
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:file.exe
Detection:MAL
Classification:mal68.evad.winEXE@72/333@27/18
EGA Information:
  • Successful, ratio: 66.7%
HCA Information:
  • Successful, ratio: 96%
  • Number of executed functions: 34
  • Number of non-executed functions: 293
Cookbook Comments:
  • Found application associated with file extension: .exe

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 13.107.42.16, 64.233.166.84, 13.107.21.239, 204.79.197.239, 142.250.185.78, 13.107.6.158, 2.19.126.145, 2.19.126.152, 142.250.186.163, 142.250.186.131, 2.23.209.130, 2.23.209.149, 2.23.209.187, 2.23.209.133, 2.23.209.182, 20.223.36.55, 88.221.110.91, 192.229.221.95, 199.232.214.172, 172.217.18.14, 2.22.61.59, 2.22.61.56, 142.250.186.142, 142.250.65.195, 142.251.41.3, 142.251.40.99
  • Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, ciscobinary.openh264.org, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, redirector.gvt1.com, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, detectportal.prod.mozaws.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msed
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size exceeded maximum capacity and may have missing disassembly code.
  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
  • Report size getting too big, too many NtCreateFile calls found.
  • Report size getting too big, too many NtOpenFile calls found.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.
  • Report size getting too big, too many NtWriteVirtualMemory calls found.
  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

TimeTypeDescription
03:30:06AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
03:30:15AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
13.107.246.64https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=Tara.LaClair%40Steptoe-Johnson.com&senderemailaddress=sszwarc%40MercBank.com&senderorganization=AwGAAAAAAnwAAAADAQAAAAB4L2sP04tHoRgQy9kdN5NPVT1tZXJjYmFuazAub25taWNyb3NvZnQuY29tLE9VPU1pY3Jvc29mdCBFeGNoYW5nZSBIb3N0ZWQgT3JnYW5pemF0aW9ucyxEQz1OQU1QUjE1QTAwMixEQz1QUk9ELERDPU9VVExPT0ssREM9Q09NiRJZGS9IYEeji1osys3BpUNOPUNvbmZpZ3VyYXRpb24sQ049bWVyY2JhbmswLm9ubWljcm9zb2Z0LmNvbSxDTj1Db25maWd1cmF0aW9uVW5pdHMsREM9TkFNUFIxNUEwMDIsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTQE%3d&messageid=%3cSA1PR15MB5013A9396562F78FDD94A844D7812%40SA1PR15MB5013.namprd15.prod.outlook.com%3e&cfmRecipient=SystemMailbox%7b6C0A1EFA-EC06-4AF8-8120-E8DF728D24A6%7d%40mercbank0.onmicrosoft.com&consumerEncryption=false&senderorgid=eda5640b-de2a-4a70-8a6e-b9b732c16c38&urldecoded=1&e4e_sdata=EpAebyUyhbp5qjBRCejClul%2bO0wRydv1eJUK4qhZNRr0%2bzDWWfXCtf65jmdkNdBUWfXHNGyyHkWBVsCBCGfBpV5cdtKksOzfyu%2fmYa0Ftd3xTjHmXXenRXgUA0PR3gh5sR2ve%2bXE8dZCafVion%2bI0xm7xM0WcwXEUpGBGC8um4aIRyLVcAtc7h%2bCF%2fGZB16AaYsprv6yVHs7DZ5VNxYzLxaXnrSeE5gRbw0Z1wjaZ%2fLsBubfjF6gF%2fTa7wyY1NzrCFy0ptnoii1J%2f8CwlNK1zNO7c1e1wINfHPNA0%2f3Sy7hhDnvOn0PqTNFKAsZ49Up0Css4iDSm2eE2BPpARvHUGQ%3d%3dGet hashmaliciousUnknownBrowse
    https://us.pbe.encryption.symantec.com/login.html?msgUserId=7b0b56a87350ebd5&enterprise=sigmafinancial&rrRegcode=69GdzP9T&locale=en_USGet hashmaliciousUnknownBrowse
      https://url.uk.m.mimecastprotect.com/s/P4YvCp88zsEr4xMcPfwuGVGsq?domain=file365-cloud.s3.eu-west-2.amazonaws.comGet hashmaliciousHTMLPhisherBrowse
        022 0.10.htmGet hashmaliciousHTMLPhisherBrowse
          https://security.microsoft.com/url?url=https%3A%2F%2Fa.squareupmessaging.com%2FCL0%2Fhttps%3A%252F%252Fsquareup.com%252Fappointments%252Fbook%252Freservations%252Flsjjxjouevoob0%2F1%2F010101914ec58572-8559cad8-4e4f-4de0-90ee-58c7f3d0b233-000000%2FTJW_gpOkBzAJNq0B-EkMC9Swd_KZL7e3XjDAcGAj_Eo%3D366Get hashmaliciousUnknownBrowse
            http://cr.thesafelink.co.uk/?rid=gyRJqbsGet hashmaliciousUnknownBrowse
              https://aka.ms/LearnAboutSenderIdentificationGet hashmaliciousUnknownBrowse
                DOC-91295804.pdfGet hashmaliciousHTMLPhisherBrowse
                  https://aka.ms/LearnAboutSenderIdentificationGet hashmaliciousUnknownBrowse
                    CDMS User Manual.pdfGet hashmaliciousUnknownBrowse
                      13.107.246.40Payment Transfer Receipt.shtmlGet hashmaliciousHTMLPhisherBrowse
                      • www.aib.gov.uk/
                      NEW ORDER.xlsGet hashmaliciousUnknownBrowse
                      • 2s.gg/3zs
                      PO_OCF 408.xlsGet hashmaliciousUnknownBrowse
                      • 2s.gg/42Q
                      06836722_218 Aluplast.docx.docGet hashmaliciousUnknownBrowse
                      • 2s.gg/3zk
                      Quotation.xlsGet hashmaliciousUnknownBrowse
                      • 2s.gg/3zM
                      152.195.19.97http://ustteam.com/Get hashmaliciousUnknownBrowse
                      • www.ust.com/

                      Domains

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      chrome.cloudflare-dns.comfile.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 162.159.61.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 172.64.41.3
                      file.exeGet hashmaliciousUnknownBrowse
                      • 172.64.41.3
                      example.orgfile.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 93.184.215.14
                      file.exeGet hashmaliciousUnknownBrowse
                      • 93.184.215.14
                      services.addons.mozilla.orgfile.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.80
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.80
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 52.222.236.48
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.48
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 18.65.39.31
                      file.exeGet hashmaliciousUnknownBrowse
                      • 18.65.39.4
                      file.exeGet hashmaliciousUnknownBrowse
                      • 18.65.39.85
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 18.65.39.31
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.80

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AKAMAI-ASN1EUfile.exeGet hashmaliciousUnknownBrowse
                      • 23.59.250.16
                      file.exeGet hashmaliciousUnknownBrowse
                      • 23.59.250.65
                      file.exeGet hashmaliciousUnknownBrowse
                      • 23.44.133.38
                      http://sp.zhabite.com/market/search/Get hashmaliciousUnknownBrowse
                      • 2.16.241.15
                      original (10).emlGet hashmaliciousUnknownBrowse
                      • 23.32.242.89
                      file.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                      • 23.197.127.21
                      GONZALES, ALFREDO 0012104586, 0010640472 b .pdfGet hashmaliciousUnknownBrowse
                      • 2.16.241.15
                      file.exeGet hashmaliciousUnknownBrowse
                      • 23.59.250.66
                      file.exeGet hashmaliciousUnknownBrowse
                      • 23.200.0.9
                      Bonelessness.exeGet hashmaliciousSimda StealerBrowse
                      • 172.234.222.143
                      MICROSOFT-CORP-MSN-AS-BLOCKUSfile.exeGet hashmaliciousUnknownBrowse
                      • 13.107.246.67
                      http://janecreativetileimp.wordpress.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      file.exeGet hashmaliciousUnknownBrowse
                      • 94.245.104.56
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 94.245.104.56
                      file.exeGet hashmaliciousUnknownBrowse
                      • 13.107.246.60
                      https://new-update-108047.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      https://att-customer-service-109909.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      https://7667lghjgfmank85387sg387sfyruk53k538gfm.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      https://cathymanns101.wixsite.com/my-site-1Get hashmaliciousHTMLPhisherBrowse
                      • 150.171.27.10
                      https://att-login-screen-108267.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      EDGECASTUSfile.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      http://janecreativetileimp.wordpress.com/Get hashmaliciousUnknownBrowse
                      • 93.184.221.165
                      file.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 152.195.19.97
                      file.exeGet hashmaliciousUnknownBrowse
                      • 152.195.19.97
                      https://view.officecloudenterprise.com/jwlswkeGet hashmaliciousUnknownBrowse
                      • 152.199.21.175
                      https://kscknbcferamacgqpsr.93399426.ca:8443/impact?impact=j..c...@b..**.com/Get hashmaliciousHTMLPhisherBrowse
                      • 152.199.21.175
                      https://zebdq.indylatinawrds.com:8443/impact?impact=j..*@c...*.com/Get hashmaliciousHTMLPhisherBrowse
                      • 152.199.21.175
                      https://vnzjf.indylatinawrds.com:8443/impact?impact=d..*@p....com/Get hashmaliciousHTMLPhisherBrowse
                      • 152.199.21.175
                      https://jfjnaitfmqdfpqbwiat.93399426.ca:8443/impact?impact=l..*@i....**.com/Get hashmaliciousHTMLPhisherBrowse
                      • 152.199.21.175
                      MICROSOFT-CORP-MSN-AS-BLOCKUSfile.exeGet hashmaliciousUnknownBrowse
                      • 13.107.246.67
                      http://janecreativetileimp.wordpress.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      file.exeGet hashmaliciousUnknownBrowse
                      • 94.245.104.56
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 94.245.104.56
                      file.exeGet hashmaliciousUnknownBrowse
                      • 13.107.246.60
                      https://new-update-108047.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      https://att-customer-service-109909.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      https://7667lghjgfmank85387sg387sfyruk53k538gfm.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10
                      https://cathymanns101.wixsite.com/my-site-1Get hashmaliciousHTMLPhisherBrowse
                      • 150.171.27.10
                      https://att-login-screen-108267.weeblysite.com/Get hashmaliciousUnknownBrowse
                      • 150.171.27.10

                      JA3 Fingerprints

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      28a2c9bd18a11de089ef85a160da29e4file.exeGet hashmaliciousUnknownBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      http://janecreativetileimp.wordpress.com/Get hashmaliciousUnknownBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      https://badcord.ct8.pl/paste?id=f661b88d-6112-11ef-a650-6cb311233542Get hashmaliciousUnknownBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      file.exeGet hashmaliciousUnknownBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      Secured Doc-[Rmz-67847].pdfGet hashmaliciousUnknownBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      file.exeGet hashmaliciousUnknownBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      https://view.officecloudenterprise.com/jwlswkeGet hashmaliciousUnknownBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      http://exdstinf.xyz/Get hashmaliciousHTMLPhisherBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      https://upholdoslogn.gitbook.io/usGet hashmaliciousUnknownBrowse
                      • 40.127.169.103
                      • 184.28.90.27
                      fb0aa01abe9d8e4037eb3473ca6e2dcafile.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209
                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209
                      file.exeGet hashmaliciousUnknownBrowse
                      • 52.222.236.120
                      • 35.244.181.201
                      • 34.149.100.209

                      Dropped Files

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpfile.exeGet hashmaliciousUnknownBrowse
                        file.exeGet hashmaliciousUnknownBrowse
                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                            file.exeGet hashmaliciousUnknownBrowse
                              file.exeGet hashmaliciousUnknownBrowse
                                file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                  file.exeGet hashmaliciousUnknownBrowse
                                    file.exeGet hashmaliciousUnknownBrowse
                                      file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                        file.exeGet hashmaliciousUnknownBrowse
                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)file.exeGet hashmaliciousUnknownBrowse
                                            file.exeGet hashmaliciousUnknownBrowse
                                              file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                file.exeGet hashmaliciousUnknownBrowse
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                    file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                      file.exeGet hashmaliciousUnknownBrowse
                                                        file.exeGet hashmaliciousUnknownBrowse
                                                          file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                            file.exeGet hashmaliciousUnknownBrowse

                                                              Created / dropped Files

                                                              C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_5fa06048-6320-40bf-8049-6cfd20ba46ac.json (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6439
                                                              Entropy (8bit):5.139220292070906
                                                              Encrypted:false
                                                              SSDEEP:192:/jMX8eRcbhbVbTbfbRbObtbyEzn/nSrDtTJdB:/YRcNhnzFSJ5nSrDhJdB
                                                              MD5:2B09F982F92C1387F80BDC43BDD652F9
                                                              SHA1:8A1CD13AE75FF5265DBF13E2F2F13573B13667B8
                                                              SHA-256:7368BED4B14B59949002C3C72D694BF8E76E2F5AC769682465A40ABB8A50B587
                                                              SHA-512:BD1E48B03CCA2C57987512F94B01C6E25AA617D7449DE98D61E4F28133600EE7FB97B2BB2C0F3468D332D496C894C2913718A49472B72335D786DF7833465D02
                                                              Malicious:false
                                                              Preview:{"type":"uninstall","id":"5fa06048-6320-40bf-8049-6cfd20ba46ac","creationDate":"2024-08-24T04:14:20.311Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                              C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_5fa06048-6320-40bf-8049-6cfd20ba46ac.json.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6439
                                                              Entropy (8bit):5.139220292070906
                                                              Encrypted:false
                                                              SSDEEP:192:/jMX8eRcbhbVbTbfbRbObtbyEzn/nSrDtTJdB:/YRcNhnzFSJ5nSrDhJdB
                                                              MD5:2B09F982F92C1387F80BDC43BDD652F9
                                                              SHA1:8A1CD13AE75FF5265DBF13E2F2F13573B13667B8
                                                              SHA-256:7368BED4B14B59949002C3C72D694BF8E76E2F5AC769682465A40ABB8A50B587
                                                              SHA-512:BD1E48B03CCA2C57987512F94B01C6E25AA617D7449DE98D61E4F28133600EE7FB97B2BB2C0F3468D332D496C894C2913718A49472B72335D786DF7833465D02
                                                              Malicious:false
                                                              Preview:{"type":"uninstall","id":"5fa06048-6320-40bf-8049-6cfd20ba46ac","creationDate":"2024-08-24T04:14:20.311Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b66e620-d907-41e5-885f-c00dd3102608.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):24014
                                                              Entropy (8bit):6.0490093310127655
                                                              Encrypted:false
                                                              SSDEEP:384:UtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwh31C7a94bpjX4Rm336kVvt6wp:kM7X2zt1jKYqHkZeM1lknbpjX4R836kd
                                                              MD5:BE70C994EA8B7482670FBCC987FD9283
                                                              SHA1:22D14A9725C177042C38468F01FF270220944A41
                                                              SHA-256:FA986056F7A4A27B1166F315EA4790A5CB77BD79787F6A9D469E79E108F88705
                                                              SHA-512:57BADDF4F19CEE1F6D04F6AF8CF3CB385319262AB912A2A873A357B131AF829DDB23260C8E6D954DCCB24D1A9ECE380AC3ADA629D2B63CB3E315793EB3F4F23E
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13368940198947288","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\52f4916b-e6af-4ad6-b5f1-ec3dd8581910.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:modified
                                                              Size (bytes):24014
                                                              Entropy (8bit):6.0490093310127655
                                                              Encrypted:false
                                                              SSDEEP:384:UtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwh31C7a94bpjX4Rm336kVvt6wp:kM7X2zt1jKYqHkZeM1lknbpjX4R836kd
                                                              MD5:BE70C994EA8B7482670FBCC987FD9283
                                                              SHA1:22D14A9725C177042C38468F01FF270220944A41
                                                              SHA-256:FA986056F7A4A27B1166F315EA4790A5CB77BD79787F6A9D469E79E108F88705
                                                              SHA-512:57BADDF4F19CEE1F6D04F6AF8CF3CB385319262AB912A2A873A357B131AF829DDB23260C8E6D954DCCB24D1A9ECE380AC3ADA629D2B63CB3E315793EB3F4F23E
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13368940198947288","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\559346a8-4e11-4481-891e-ab4eeb28b25a.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5f1b194b-2ceb-4ec8-ba4e-689f50673fa5.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):8255
                                                              Entropy (8bit):5.7958162834378575
                                                              Encrypted:false
                                                              SSDEEP:192:fsNAnaeiRU5Bjfkpd6qRAq1k8SPxVLZ7VTiQ:fsNAgWl8pd6q3QxVNZTiQ
                                                              MD5:A335392C891B8BDB0C57CDF2D41D65BF
                                                              SHA1:36FB63B6949C74B7D57494708198C3A70BE47391
                                                              SHA-256:4C1B5D5892F880747C67A4FD3C9D9CF5918F0AEB31F2287862D0ACDBFB1B843A
                                                              SHA-512:32668DCEBC4C336534E29EB70F23EB4FC624617846228BE67F36E676FBEB72A7457722809FBB5B477E109693958EF6B134B6E9D871A1E7E185597B8B34A0D78C
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6318a0d4-ad6f-4ac0-a18f-59d98e30a24d.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):22980
                                                              Entropy (8bit):6.047147927626507
                                                              Encrypted:false
                                                              SSDEEP:384:UtM7XKnG7EtlXrjYJUoLUJqHsdZsJHaVsNwh31Cq8p34Rm336kVvt6w4:kM7X2zt1jKYqHkZeM1lkq8p34R836kJC
                                                              MD5:E6E9D7A763BCCEB3C31650C85E6E1E23
                                                              SHA1:F7A5CA5F6AA3FC310978B272C1316913A833C7A3
                                                              SHA-256:E91CAFB580DBFC06B327506481DEC625D97346FCF5B3F6687939DB7CF713693C
                                                              SHA-512:C4A6D9C8DC52E178C7910433CF9E5AEDA00A5D00665E9DECDB7A5EF46CD76D01E57B336B879873CCF01C8FC9A331D50151DF96768CB8B14ABAA73A558BC83409
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13368940198947288","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6f7cc3bd-abec-4f34-a987-a14524f2c415.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:modified
                                                              Size (bytes):8090
                                                              Entropy (8bit):5.811546497936802
                                                              Encrypted:false
                                                              SSDEEP:192:asNAnaeiRUvsQUkpRd6qRAq1k8SPxVLZ7VTiq:asNAgKhvpRd6q3QxVNZTiq
                                                              MD5:C1F018337E8FA9B530EDB2426BE3CD94
                                                              SHA1:094B53A4C14CA274197BE85F6C76578D37C033DE
                                                              SHA-256:2F751DB7CBE0F802550316A407C14D21886F2A5A4A9F11D0E3751A721D96BC21
                                                              SHA-512:767AE923A0DAE8352074C143DF691A59EF017985FB579A522B0ABC61DEA7C7067DB6A45A671163D2C6FFF1F9B9E6A07EE7C36017F53D7CEE61F6EA91181E2344
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\90777bd3-5b92-47fb-b6b2-fc80270452e4.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):25108
                                                              Entropy (8bit):6.032144558662307
                                                              Encrypted:false
                                                              SSDEEP:768:kM7X2zt1jKYqHkZez1lkgc9z8p34R836kJt6j:kMSzvKYqs414m36ct6j
                                                              MD5:F3BA31B4B4A9947E807C3E62B50E2928
                                                              SHA1:181EA3785DB675A123E1D1FCB63BD431E6AE1C90
                                                              SHA-256:B91CFCDDA413DE26BCA5D248E639CE3C4134DD85D7726F7494F300E1B83C5606
                                                              SHA-512:F90063718E615796698B6C4BB6364E0615AF06D99A46DD281B10363ED17ED6FBC73FC804421433E514DC7B75EAA88ED83EC485840C40F1F74272B54C75702B56
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13368940198947288","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):107893
                                                              Entropy (8bit):4.640139867263744
                                                              Encrypted:false
                                                              SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
                                                              MD5:515BFDD0A8E03F491ED66894DAC7434B
                                                              SHA1:00534E56EA194556D8E48772D2463BB291B567AC
                                                              SHA-256:C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
                                                              SHA-512:649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
                                                              Malicious:false
                                                              Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\fcc69b10-7fcf-4c1f-8523-b5299aa5f6f0.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):107893
                                                              Entropy (8bit):4.640139867263744
                                                              Encrypted:false
                                                              SSDEEP:1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
                                                              MD5:515BFDD0A8E03F491ED66894DAC7434B
                                                              SHA1:00534E56EA194556D8E48772D2463BB291B567AC
                                                              SHA-256:C76D8691C06568DE0108BAD3E4C5596E5B6DB4AF6864E0C4B57F3EE2C909FA18
                                                              SHA-512:649D4F9FF7446C1DB4B16F6A4C9BEBF0A92A9E266898D653A11CBC44FCCDE8472D91758A624AA5D5A1B306DFA793E5F72370ED70514CB25312B76ACD605EA652
                                                              Malicious:false
                                                              Preview:{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3::
                                                              MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                              SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                              SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                              SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3::
                                                              MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                              SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                              SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                              SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66C945A4-19A8.pma

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.03962520644745095
                                                              Encrypted:false
                                                              SSDEEP:192:4U01utmqvDzKX7kJ8iD12absbZHtgbX5h8IYhoPfNEl/cRQMcLPR3n8y08Tcm2Rl:r0EtJlWCYh6gQ+p308T2RGOD
                                                              MD5:FDC5C88D12CB93AB3F028079C1700B84
                                                              SHA1:8592EB55B96D553586DE2EF6BE4D03C67DC07F8C
                                                              SHA-256:80B0CBEC6EDF26CD619CB94390270791E0AE60E01F39BDD5F4FABFF1FBC05A7C
                                                              SHA-512:B44F888E901997D25EF9989CFDCBD88EF33754931A2E2C84725FADF4F1F74183B05F38730F586063D07CBA352832E2BDFFB465BC55AB22C9E1BA2D00E07B6E81
                                                              Malicious:false
                                                              Preview:...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....e.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".skehgs20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U.>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66C945A5-D74.pma

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.46830637080849197
                                                              Encrypted:false
                                                              SSDEEP:6144:mo208XsiHmlOaH4TBih2qN0//+M0PAaH6:QFmlF2Gr
                                                              MD5:382BDAB5DAAD0862FCD44EEEC91BFDAC
                                                              SHA1:8AFF3A8C4B2C48DC4B4AF7F34FD2439F7D60F9F6
                                                              SHA-256:7954031847C143F2C91D44698CC3BED5D76369397DDD95188D1AE0901A562A53
                                                              SHA-512:08641D6302840C5DD5CCA44918AA31AA435BD6E119EB2A49928B2B8E1C1B01BA2E9D7241C474240BC9F2C90D9E7C64FCCD19DEB66819825DD6A295F81BA7F5A9
                                                              Malicious:false
                                                              Preview:...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....u.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".skehgs20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U?:K..>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggere

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66C945B7-2230.pma

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.04077363181034518
                                                              Encrypted:false
                                                              SSDEEP:192:b40EbtmqvDtKX7oJEa3XxxTxqZ/g+X1970R6EqhB7NguR21gQMV5Dn2n8y08TcmQ:s0EtLeK8YwFh5XSgZ5D208T2RGOD
                                                              MD5:45176B059924DC04C8980CC97F22494C
                                                              SHA1:BB7FF1FEA6C44EE2039BAB258FFB260AF8396485
                                                              SHA-256:BF80B311B98048EA0AE9075F9B84FA07CD6985EAB34B33117117A445D385856F
                                                              SHA-512:F3C3E27A983895E64C2FFA131FFB2368677C35296F5D02C7AD1090B22AD4F9986A95F2AD708BB8E6F635EE42700F3B1D7615042A9A0502A8E744B421FB86BF46
                                                              Malicious:false
                                                              Preview:...@..@...@.....C.].....@................b...Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".skehgs20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66C945BF-21AC.pma

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.03990780180938128
                                                              Encrypted:false
                                                              SSDEEP:192:HD0EbtmqvD3KX7CJEa3Xxx7uqZGXPtg34khtbNEk8kMO1gQpe9W65pQn8y08TcmQ:j0EtXe18xphlXKagweW+y08T2RGOD
                                                              MD5:526A533576CEA5923BDF91CEF4B91189
                                                              SHA1:1A6A2DC701B8B3F2AE8774681B8FC4F9913EE01E
                                                              SHA-256:677B5496900B527A0B4C4B063BF320699F4C0475AABE8E123003F0AB954215EF
                                                              SHA-512:E08C6FEF6B1B4E4085712A0E66B7E0CA644C8B9E0C476298E484AC2C4B85D4A753A1A18F2AC318435837A249AA30BF522A812A26941B38446359895708A0517E
                                                              Malicious:false
                                                              Preview:...@..@...@.....C.].....@................`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".skehgs20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.3553968406659012
                                                              Encrypted:false
                                                              SSDEEP:12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
                                                              MD5:CFAB81B800EDABACBF6CB61AA78D5258
                                                              SHA1:2730D4DA1BE7238D701DC84EB708A064B8D1CF27
                                                              SHA-256:452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
                                                              SHA-512:EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
                                                              Malicious:false
                                                              Preview:...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):280
                                                              Entropy (8bit):3.060980776278344
                                                              Encrypted:false
                                                              SSDEEP:3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
                                                              MD5:74B32A83C9311607EB525C6E23854EE0
                                                              SHA1:C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
                                                              SHA-256:06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
                                                              SHA-512:ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
                                                              Malicious:false
                                                              Preview:sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\30aa7312-98cf-49b8-99cb-d730e460caba.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:L:L
                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                              Malicious:false
                                                              Preview:.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4b15e553-f90f-4b4d-b138-25826e90a032.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):13517
                                                              Entropy (8bit):5.245667906554628
                                                              Encrypted:false
                                                              SSDEEP:192:sVbJ9pQTryZiuaba4uyYJYSWkawfjUAVW9gYW3x84pj+Fnj4QAH8f1f:sVbLAJu3JYSVfjUAV5pUj4Qag
                                                              MD5:4A849E7A4FB3CAFECE65AC8CEC070342
                                                              SHA1:57B50BD3DA076E626C9131A6B5DFA38BA4DCF1BA
                                                              SHA-256:2FB70F9E3101FE94495DDA53C08DF0FF6138111DBAE56FA40D76988E11D7333E
                                                              SHA-512:369C9B5546F3FCDC2254C11D445AC1EF637AD5526B550A4E1BF6821F7EB1FC97DB9DADF3A570922C776E9DBF7D3366A65254CCFF55BA617C887F4251EAD88B2E
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13368940198801444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6f7af064-2071-4583-9f3d-56d4f3fce177.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):34635
                                                              Entropy (8bit):5.560298993257091
                                                              Encrypted:false
                                                              SSDEEP:768:dRsIUMWPfLfOz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgM+AarwKGkJRDdKps8tuq:dRsIUMWPfLfOzu1jaPNAfKGwv+tl
                                                              MD5:B8541A40D809D91537A58AB2595C6474
                                                              SHA1:51A8B957DB84F1B4DB46673CE00B46B957E85390
                                                              SHA-256:E8E674122A6248C7F96D8B2FA9F4176BA257B0A6C6EFF5730CB2ECD950D881D0
                                                              SHA-512:86B6B09342C1635B9A0D80CD2E646A491B31451A7D1D978330E5F6348C5CBD480A3ED28786CFA8477B69982CAA338D192BAB8D2FD4F98AFC74C3CF9CC4BFFA0E
                                                              Malicious:false
                                                              Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13368940197445268","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13368940197445268","location":5,"ma

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\82fa7c2f-68d1-44f5-ad11-28005d66f868.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):13651
                                                              Entropy (8bit):5.244393945322232
                                                              Encrypted:false
                                                              SSDEEP:192:sVbJ9pQTryZiuaba4uyYJYSWkawfjUAVW9gYW3x84pj+Fnj4QAf8f1f:sVbLAJu3JYSVfjUAV5pUj4QGg
                                                              MD5:60238B6BB15EA6A96D091FF910020488
                                                              SHA1:1DCD992D03B5BD27051382AEBCD90282661D08A2
                                                              SHA-256:CABE473A8FC73CEF0C0C558D28BCDE4496E9C5CE54F518B71662A40A65FA31F1
                                                              SHA-512:856C535FD60019F317F68FF88E46A33411283D4699478ABD67C20B30131F06D9D4894761DB77DA0BBCED63C65C84F323DA22E7062933C0FBF30970BD238715A6
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13368940198801444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8ad72211-5527-40b8-8909-1815bed73f1a.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):13688
                                                              Entropy (8bit):5.243597050850137
                                                              Encrypted:false
                                                              SSDEEP:192:sVbJ9pQTryZiuaba4uyYJYSWkawfjUAVW9gYW3x84pj+Fnj4QAi8f1f:sVbLAJu3JYSVfjUAV5pUj4Q1g
                                                              MD5:0EA60FBE3B19F3C43D5A71B7B7BBFACE
                                                              SHA1:D727F1A40F05F075BA2A0763FD5A0051D6D347F7
                                                              SHA-256:19CD7C4C41EBE3C5B3F93A1977F40863F0AF10D12F8AA50D5113B8231E68AB4E
                                                              SHA-512:EB053117DABDB861EFAA13EE8CF20EEEF72C92AA8ABF806885E0F54FD1EBBBCB33975CC380CF05C98DA094E9C194689AE81743AE36981E3704BAD345484A23A8
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13368940198801444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:modified
                                                              Size (bytes):1695826
                                                              Entropy (8bit):5.041142995921204
                                                              Encrypted:false
                                                              SSDEEP:24576:9PfQUg6kAdRhiGzmYoAo2ENU0ifYeV3br2M:9PfZ/mS5
                                                              MD5:37708D4A18A4AC044D53176452BA1C26
                                                              SHA1:46BFB3D052F9E05924503ACECF6CF26E5DB7B2B9
                                                              SHA-256:2C1CE9456D435A6F3286DB28967FDAFEE0A7E14DD96058EB0BDAA806469BBC87
                                                              SHA-512:160ECA65F8B6636B644A4F94E91DC70D7D7749BF9392B39646828D40E53D3877BDEC00F924428AB680F5C1F0AB85B26B6E74459521EDD1757B8A51F344DCDA93
                                                              Malicious:false
                                                              Preview:...m.................DB_VERSION.1...Y.................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13368940204549085.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]<....................QUERY_TIMESTAMP:edge_hub_apps_manifest_gz4.7.*.13368940204557194.$QUERY:edge_hub_apps_manifest_gz4.7.*..[{"name":"edge_hub_apps_manifest_gz","url":"https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline","version":{"major":4,"minor":7,"patch":107},"hash":"Qoxdh2pZS19o99emYo77uFsfzxtXVDB75kV6eln53YE=","size":1682291}]=_.../..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivileged

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):293
                                                              Entropy (8bit):5.020434420018779
                                                              Encrypted:false
                                                              SSDEEP:6:NPXP0Mv1wkn23oH+Tcwt9Eh1ZB2KLlLPXP0gSvqM+q2Pwkn23oH+Tcwt9Eh1tIF2:NP81fYeb9Eh1ZFL1P8f+vYfYeb9Eh16g
                                                              MD5:C80D6CB9DB41511A449B22A646C2DCD7
                                                              SHA1:8EE08F22CBEB6EC3E76BD352D55EF972A247A1F3
                                                              SHA-256:5EB393FA505EDE59257D51D045A2F799128276FF3A0B1F405A7A8D2BAACF601A
                                                              SHA-512:A0B373A5281D8DD35679E5165B23BC79D235E2606542B604CF09A39417F5E1AD92D564E9A14E7CE32C3BE84951E42EE94D2157D6786B1F6F6E262C89C565CA48
                                                              Malicious:false
                                                              Preview:2024/08/23-22:30:03.000 20ac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/23-22:30:03.847 20ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):12288
                                                              Entropy (8bit):0.3202460253800455
                                                              Encrypted:false
                                                              SSDEEP:6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
                                                              MD5:40B18EC43DB334E7B3F6295C7626F28D
                                                              SHA1:0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
                                                              SHA-256:85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
                                                              SHA-512:8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):28672
                                                              Entropy (8bit):0.465512706061812
                                                              Encrypted:false
                                                              SSDEEP:24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBNjK:TouQq3qh7z3bY2LNW9WMcUvBY
                                                              MD5:01B52D3654E428154308F9F6E580C77D
                                                              SHA1:2ED6C03A8181F0CF69A971819D31AA3D707474F5
                                                              SHA-256:C771809464F0457154E0EAA3D053B50415449D882A5F551B425F71385A06010C
                                                              SHA-512:6CC48CD74CA2050D3887B46026E6C469B89494AC1846F74991AAE49BFE5D58D425A5A3402CB698219FF453B6CFE1F55AF569A4D2A4FA6C2AECB15795AE3626EF
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.01057775872642915
                                                              Encrypted:false
                                                              SSDEEP:3:MsFl:/F
                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                              Malicious:false
                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):270336
                                                              Entropy (8bit):8.280239615765425E-4
                                                              Encrypted:false
                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.011852361981932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsHlDll:/H
                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.012340643231932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsGl3ll:/y
                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                              Category:dropped
                                                              Size (bytes):262512
                                                              Entropy (8bit):9.553120663130604E-4
                                                              Encrypted:false
                                                              SSDEEP:3:LsNlK2+l:Ls3J+l
                                                              MD5:1C01015E38047337FB7894B45CAABA19
                                                              SHA1:9C0751F13CB487C16FEB8B05529666898162E059
                                                              SHA-256:92173AC353D23F05A0FE996BA6CD6488C009E895795F660B83110F9F29191B88
                                                              SHA-512:2C43209F855235CA5197A624CFC5B14020B10FA37DBAD00FE2987A5BA17F1399F550FB4864F63D21C06ADFF04FDCF708E4FA0E46CD024AEC5F65AD6EC380A15C
                                                              Malicious:false
                                                              Preview:.............................................~/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):33
                                                              Entropy (8bit):3.5394429593752084
                                                              Encrypted:false
                                                              SSDEEP:3:iWstvhYNrkUn:iptAd
                                                              MD5:F27314DD366903BBC6141EAE524B0FDE
                                                              SHA1:4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
                                                              SHA-256:68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
                                                              SHA-512:07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
                                                              Malicious:false
                                                              Preview:...m.................DB_VERSION.1

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):305
                                                              Entropy (8bit):5.2391957399547024
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPqucHM1wkn23oH+TcwtnG2tbB2KLlLPXPqkMq2Pwkn23oH+TcwtnG2tMsIFUv:NPnSrfYebn9VFL1PWvYfYebn9GFUv
                                                              MD5:D564ECBAFA907147C5EF4FB4868ECB83
                                                              SHA1:6F4D52B43F47CBFEC57EDBADADC04B22DD1499DE
                                                              SHA-256:8126F0E48148AF3585C22E41F8A75C574E5CD81CA7CC5B73A7E10FAA1E2179CB
                                                              SHA-512:AAABE8FC41D5662275E8686D805382FF46FD8A55E3E565C09FAB136B6BC2AD62E9D5D3919E8594E40454E341939A7B93C76B72B246BE814E8FBB03851FE11988
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:57.503 1d44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/23-22:29:57.619 1d44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
                                                              Category:dropped
                                                              Size (bytes):32768
                                                              Entropy (8bit):0.494709561094235
                                                              Encrypted:false
                                                              SSDEEP:24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
                                                              MD5:CF7760533536E2AF66EA68BC3561B74D
                                                              SHA1:E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
                                                              SHA-256:E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
                                                              SHA-512:38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):0.6130331344798325
                                                              Encrypted:false
                                                              SSDEEP:24:TLqpR+DDNzWjJ0npnyXKUO8+jjnZG0pxCXmL:Te8D4jJ/6Up+fn4Mf
                                                              MD5:BA2893237161194015D3086BB4C091AC
                                                              SHA1:5450D8DF954C701CD7C9D5C2A92501F15AD4F8A2
                                                              SHA-256:68291F535A1E1C63D3F622A022CC152AB8D330DD824C9D034CD4B94B67EA04D1
                                                              SHA-512:61B1F158D0B4AEC0C9D48646F0DBE2CF08C8C80ADC9EEB037588CED68CB569E012E0A6AB3C44EA699A1891CBCB23909929F3F957649FDE8256EA778163144065
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):375520
                                                              Entropy (8bit):5.354133667353917
                                                              Encrypted:false
                                                              SSDEEP:6144:9A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:9FdMyq49tEndBuHltBfdK5WNbsVEziPU
                                                              MD5:E45FF0BFA9143B38515E35A6C5D95FFF
                                                              SHA1:7E956465B05179AFD306C4055C4BE72F41BCC3A0
                                                              SHA-256:B030AF01416C0E6A17AAAD298779671D5EE8D6845A15171C8EBCD29FDF897AD2
                                                              SHA-512:C8606377A247EE41FF9D5D6D9CD9A2F7E93A92E899D64FE773F4BF9C6288FDE9CE4D9CF850FD882E681E9977DF48D4BC32344D37F0699263F07CFD8207FD11FA
                                                              Malicious:false
                                                              Preview:...m.................DB_VERSION.1..&.q...............&QUERY_TIMESTAMP:domains_config_gz2.*.*.13368940204420148..QUERY:domains_config_gz2.*.*..[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):309
                                                              Entropy (8bit):5.149349426050078
                                                              Encrypted:false
                                                              SSDEEP:6:NPXP04hA4M1wkn23oH+Tcwtk2WwnvB2KLlLPXP0eq2Pwkn23oH+Tcwtk2WwnvIF2:NP8SHrfYebkxwnvFL1P8evYfYebkxwnp
                                                              MD5:8718DCCE27F60D12DA43DD31453B83B0
                                                              SHA1:B0E6973AC1C0C4963804D512793E2C5F5EA90BA6
                                                              SHA-256:C46FD96AEE98E1FEACE5F214763ACA14C0F28100BE70CCBC0C8D727099CA6B48
                                                              SHA-512:38F9D94456B2F7CE12F58766B088F7C07723E2CEFD7255018F937D6AAA3F4DA566DC4AA12A89D8DF82A272D945BD589F05DDB560D6BD77F198E5AFF1179FA9E8
                                                              Malicious:false
                                                              Preview:2024/08/23-22:30:02.947 20d4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/08/23-22:30:03.739 20d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:modified
                                                              Size (bytes):358860
                                                              Entropy (8bit):5.324612766450692
                                                              Encrypted:false
                                                              SSDEEP:6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RG:C1gAg1zfvO
                                                              MD5:A90D7220020041E279B9AAD7CA8BD2EB
                                                              SHA1:B1CB4B0FC834D8C325E46C2749BD86EFD0BF385F
                                                              SHA-256:8DDA6679B52D7E25D38A324AB2C6BED2C7EBB11724B16F98066D18539C8E1A8A
                                                              SHA-512:B1546A0518ED59EDD522132E47AF07A8FF3033CC7B8AF9ABE0756B9C1FA5FC52EBDC9A0EA3C69E2E4CAE7D9DD3C0A6792FA25F8D961F5F004BBA26A11BD6E7C9
                                                              Malicious:false
                                                              Preview:{"aee_config":{"ar":{"price_regex":{"ae":"(((ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)))","dz":"(((dzd|da|\\x{062F}\\x{062C})\\s*\\d{1,3})|(\\d{1,3}\\s*(dzd|da|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}|egp)\\s*\\d{1,3})|(\\d{1,3}\\s*(e\\x{00a3}|egp)))","ma":"(((mad|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(mad|dhs|dh)))","sa":"((\\d{1,3}\\s*(sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633}))|((sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633})\\s*\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})|(\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):209
                                                              Entropy (8bit):1.8784775129881184
                                                              Encrypted:false
                                                              SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                              MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                              SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                              SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                              SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                              Malicious:false
                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):281
                                                              Entropy (8bit):5.196460761572182
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPqHHM1wkn23oH+Tcwt8aVdg2KLlLPXPqkMq2Pwkn23oH+Tcwt8aPrqIFUv:NP0rfYeb0L1P5MvYfYebL3FUv
                                                              MD5:51021F6B433C2498AD1B5A488227ADE0
                                                              SHA1:38B9E223C5FF73498C26E4F64DDF4D4208468FF5
                                                              SHA-256:F63CEEEB53B151487C84642E0C127CFB4A2E03176478BC1A366BE4F706153B7D
                                                              SHA-512:8A0BA49E78167DB5F77A5C32DAA9E3156512C8F99D9458E95E4FF46D4C97BCCC1C9A13109E59EDC833695F8F4AA7DFB125B721DA2BA47E752868E1802A691D4B
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:57.721 1d44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/23-22:29:57.794 1d44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):209
                                                              Entropy (8bit):1.8784775129881184
                                                              Encrypted:false
                                                              SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
                                                              MD5:478D49D9CCB25AC14589F834EA70FB9E
                                                              SHA1:5D30E87D66E279F8815AFFE4C691AAF1D577A21E
                                                              SHA-256:BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
                                                              SHA-512:FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
                                                              Malicious:false
                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):285
                                                              Entropy (8bit):5.186232627569576
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPqeHM1wkn23oH+Tcwt86FB2KLlLPXPqqq2Pwkn23oH+Tcwt865IFUv:NPLrfYeb/FFL1PRvYfYeb/WFUv
                                                              MD5:4BF77C011823DF5FEEE109AF522125BD
                                                              SHA1:6D304D8310DD0ED03D8C74548BF54E6B41E05C95
                                                              SHA-256:D9BD0AB5B0893990EF29B04852BE57319E9E7F4F73DF9681768826CD9C497DB8
                                                              SHA-512:C7608683DDB78F47916F82553D530539CBD2352FC0F91D04D1A60B118CC015639B8308B4CB92017E82C08E4FB0C84005135B7014BF148E7059187322C939ED39
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:57.799 1d44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/23-22:29:57.904 1d44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):1197
                                                              Entropy (8bit):1.8784775129881184
                                                              Encrypted:false
                                                              SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                              MD5:A2A3B1383E3AAC2430F44FC7BF3E447E
                                                              SHA1:B807210A1205126A107A5FE25F070D2879407AA4
                                                              SHA-256:90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
                                                              SHA-512:396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
                                                              Malicious:false
                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):322
                                                              Entropy (8bit):5.2089436904045945
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPkRdQ+q2Pwkn23oH+Tcwt8NIFUt88PXPkRdgZmw+8PXPkR2LQVkwOwkn23oHt:NPcc+vYfYebpFUt88Pcc/+8PcDV5JfYN
                                                              MD5:F68DEB4B5916A9F5EF9CE62FD07B795B
                                                              SHA1:968B314A1E58647F20E3A28B361AE2258B78542C
                                                              SHA-256:FF8E6BA9108F62C1F8F2C95691FC033C25B40C166C7AC7094381E348D568399F
                                                              SHA-512:88B4B4E399402054A5ED772F884A7CAB9D88191901DAF21809EE69411F3437330C875B4C84F20EE1DB3283351F8BD3CD349717975EA77964FBD3F8D28D9AB188
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:59.116 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/23-22:29:59.116 1cdc Recovering log #3.2024/08/23-22:29:59.117 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):322
                                                              Entropy (8bit):5.2089436904045945
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPkRdQ+q2Pwkn23oH+Tcwt8NIFUt88PXPkRdgZmw+8PXPkR2LQVkwOwkn23oHt:NPcc+vYfYebpFUt88Pcc/+8PcDV5JfYN
                                                              MD5:F68DEB4B5916A9F5EF9CE62FD07B795B
                                                              SHA1:968B314A1E58647F20E3A28B361AE2258B78542C
                                                              SHA-256:FF8E6BA9108F62C1F8F2C95691FC033C25B40C166C7AC7094381E348D568399F
                                                              SHA-512:88B4B4E399402054A5ED772F884A7CAB9D88191901DAF21809EE69411F3437330C875B4C84F20EE1DB3283351F8BD3CD349717975EA77964FBD3F8D28D9AB188
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:59.116 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/23-22:29:59.116 1cdc Recovering log #3.2024/08/23-22:29:59.117 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):4096
                                                              Entropy (8bit):0.3169096321222068
                                                              Encrypted:false
                                                              SSDEEP:3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
                                                              MD5:2554AD7847B0D04963FDAE908DB81074
                                                              SHA1:F84ABD8D05D7B0DFB693485614ECF5204989B74A
                                                              SHA-256:F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
                                                              SHA-512:13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                              Category:dropped
                                                              Size (bytes):32768
                                                              Entropy (8bit):0.40981274649195937
                                                              Encrypted:false
                                                              SSDEEP:24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
                                                              MD5:1A7F642FD4F71A656BE75B26B2D9ED79
                                                              SHA1:51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
                                                              SHA-256:B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
                                                              SHA-512:FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):429
                                                              Entropy (8bit):5.809210454117189
                                                              Encrypted:false
                                                              SSDEEP:6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
                                                              MD5:5D1D9020CCEFD76CA661902E0C229087
                                                              SHA1:DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
                                                              SHA-256:B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
                                                              SHA-512:5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
                                                              Malicious:false
                                                              Preview:{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):2.4468347262422325
                                                              Encrypted:false
                                                              SSDEEP:96:0BCyvkYNGUB9elS9nsH4/AztcnuuoKwxYNGUv:mNvkNkxsHXzCnPo1xNG
                                                              MD5:64F11E2F9915F6611CB6545651E3C9F0
                                                              SHA1:881A61F8948A5235237225AB1F160665D7EB6CA0
                                                              SHA-256:0A4831CFAD10DC4A390A97AEBDF54077FFF48464DAFF1B491571B82CA79EBD9D
                                                              SHA-512:AF93E2AE656F02A447411F14C0AF3CAE87D42CEE0056ACBA92EECCB34BCCD490E1835A4283C7ABCABEC275E07E1774E48A3B0DE59C09207EF8938539B4913E5A
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 4
                                                              Category:dropped
                                                              Size (bytes):159744
                                                              Entropy (8bit):0.6465669977428335
                                                              Encrypted:false
                                                              SSDEEP:96:vYNGU/MMU+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjNCBYNGU:vNAO+GPXBBE3upb0HtTTDxVjUN
                                                              MD5:6F958080F08A5D8A331F7A6F7C584A77
                                                              SHA1:8D0496E9ED0789E1CE50FAF4C38F12B60C5A6275
                                                              SHA-256:46C89F3D2421A1445554BF28A455322C7B1F4B6C15477F74A0942D90EFA3BA1D
                                                              SHA-512:C479EC218032A76138AA2018D5F6ECC2565B784B70F347D62FB545634EE621AEA7E42BF67F9AF22B204485FA6865D6DD7C456A683AA11590E65AE76FE537E81F
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8720
                                                              Entropy (8bit):0.32872990409968056
                                                              Encrypted:false
                                                              SSDEEP:6:KHA/J3+t76Y4QZZofU99pO0BYMlubqR4EZY4QZvGv:KghHQws9LdNluOBQZGv
                                                              MD5:7CCC7E397C314223FB24BDAA8B3B7F96
                                                              SHA1:E514F88D8FB38415FB9B52DF0B5BE37ADE7FB153
                                                              SHA-256:F5AF29112838B51BA199459E671DE8E3546AE350C459542B60C2CC2DB18986D9
                                                              SHA-512:260D7A749FCC22FD73694C79A0A8098A50441BC5596BFDE6F1F4B9B10C32E7CB0BD1630D20D22B2A0ACFC51C48D9DA83DF306FB8E1B0D497224EE3F4EB7CAB56
                                                              Malicious:false
                                                              Preview:..............(:...'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):115717
                                                              Entropy (8bit):5.183660917461099
                                                              Encrypted:false
                                                              SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                              MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                              SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                              SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                              SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                              Malicious:false
                                                              Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                              Category:dropped
                                                              Size (bytes):45056
                                                              Entropy (8bit):3.5489235518640725
                                                              Encrypted:false
                                                              SSDEEP:384:zj9P02ccSQkQer/hzgam6IfP/Kbtn773pL4RKToaAu:zdRvSe2/8vP/m72RKcC
                                                              MD5:B07A8C79F25E0D0273F420CE52772128
                                                              SHA1:361AFAAC1547902D6DA5567642B9AF18400BF924
                                                              SHA-256:C93B1DE70711B5D5E0D249A3232F59CAADFE6D62212E65F69829AFE608FD3FD1
                                                              SHA-512:D253B384D1954150592E0A3CF037AC0C5C00C72DF035D44D177E4CDCD26DC398592C949FA4C08FA8AC9825FE4C371B7CC32691D1D66C80F09694580C9528D882
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):406
                                                              Entropy (8bit):5.217717240062463
                                                              Encrypted:false
                                                              SSDEEP:12:NP8kTq+vYfYeb8rcHEZrELFUt88P8kk/+8P8kEV5JfYeb8rcHEZrEZSJ:NP8k/YfYeb8nZrExg88P8kyP8kuJfYe2
                                                              MD5:FA70953CAAFB6C1B48F65C336D0ECC37
                                                              SHA1:361EDCD168189FC8B4DD35D1371EE5A9602704A6
                                                              SHA-256:CB611138D9F5C375D74AFC223CE5949947DAD2E7A0509A22F961377567F44549
                                                              SHA-512:5DFA323D86C3442F50DE3564EB03A9EB4AB196A0B3E481B702F024F7910D79E04F9CD0CF3170B5AB98E3D4D916979BE00F079AE346D93B928FFFB0CD192F8224
                                                              Malicious:false
                                                              Preview:2024/08/23-22:30:02.616 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/23-22:30:02.618 1cdc Recovering log #3.2024/08/23-22:30:02.618 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):406
                                                              Entropy (8bit):5.217717240062463
                                                              Encrypted:false
                                                              SSDEEP:12:NP8kTq+vYfYeb8rcHEZrELFUt88P8kk/+8P8kEV5JfYeb8rcHEZrEZSJ:NP8k/YfYeb8nZrExg88P8kyP8kuJfYe2
                                                              MD5:FA70953CAAFB6C1B48F65C336D0ECC37
                                                              SHA1:361EDCD168189FC8B4DD35D1371EE5A9602704A6
                                                              SHA-256:CB611138D9F5C375D74AFC223CE5949947DAD2E7A0509A22F961377567F44549
                                                              SHA-512:5DFA323D86C3442F50DE3564EB03A9EB4AB196A0B3E481B702F024F7910D79E04F9CD0CF3170B5AB98E3D4D916979BE00F079AE346D93B928FFFB0CD192F8224
                                                              Malicious:false
                                                              Preview:2024/08/23-22:30:02.616 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/23-22:30:02.618 1cdc Recovering log #3.2024/08/23-22:30:02.618 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):334
                                                              Entropy (8bit):5.184239615378605
                                                              Encrypted:false
                                                              SSDEEP:6:NPXP+U1Vq2Pwkn23oH+Tcwt8a2jMGIFUt88PXPKtYgZmw+8PXPK1IkwOwkn23oHr:NPWU/vYfYeb8EFUt88PiX/+8P35JfYek
                                                              MD5:D140FC7C94AD7FD8031BDC5157D016C5
                                                              SHA1:161B3BA43DFCF7C665EF8D7D061B11D762AF3947
                                                              SHA-256:261A6DF79E2F28202667F5915D5634AFA5069B7B226C76CEF829428E72285D13
                                                              SHA-512:22A10D71DDC6F32F75B3C8BC445F387FEA9A9A0916BAE58A4E5D7BBB21838B94AD5D5CB36CC6C48BC901ABC03DAF11DE8E5BAD1B127C048B7E0FCCFA8CB9812F
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:58.661 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/23-22:29:58.665 1de0 Recovering log #3.2024/08/23-22:29:58.668 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):334
                                                              Entropy (8bit):5.184239615378605
                                                              Encrypted:false
                                                              SSDEEP:6:NPXP+U1Vq2Pwkn23oH+Tcwt8a2jMGIFUt88PXPKtYgZmw+8PXPK1IkwOwkn23oHr:NPWU/vYfYeb8EFUt88PiX/+8P35JfYek
                                                              MD5:D140FC7C94AD7FD8031BDC5157D016C5
                                                              SHA1:161B3BA43DFCF7C665EF8D7D061B11D762AF3947
                                                              SHA-256:261A6DF79E2F28202667F5915D5634AFA5069B7B226C76CEF829428E72285D13
                                                              SHA-512:22A10D71DDC6F32F75B3C8BC445F387FEA9A9A0916BAE58A4E5D7BBB21838B94AD5D5CB36CC6C48BC901ABC03DAF11DE8E5BAD1B127C048B7E0FCCFA8CB9812F
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:58.661 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/23-22:29:58.665 1de0 Recovering log #3.2024/08/23-22:29:58.668 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
                                                              Category:dropped
                                                              Size (bytes):57344
                                                              Entropy (8bit):0.863060653641558
                                                              Encrypted:false
                                                              SSDEEP:96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
                                                              MD5:C681C90B3AAD7F7E4AF8664DE16971DF
                                                              SHA1:9F72588CEA6569261291B19E06043A1EFC3653BC
                                                              SHA-256:ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
                                                              SHA-512:4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                              Category:dropped
                                                              Size (bytes):45056
                                                              Entropy (8bit):0.40293591932113104
                                                              Encrypted:false
                                                              SSDEEP:24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
                                                              MD5:ADC0CFB8A1A20DE2C4AB738B413CBEA4
                                                              SHA1:238EF489E5FDC6EBB36F09D415FB353350E7097B
                                                              SHA-256:7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
                                                              SHA-512:38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\108f8c4f-c26a-43d8-9463-bae343199ce8.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):111
                                                              Entropy (8bit):4.718418993774295
                                                              Encrypted:false
                                                              SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                              MD5:285252A2F6327D41EAB203DC2F402C67
                                                              SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                              SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                              SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\306a0905-3d3a-486e-87d5-757410e914f6.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4b890e90-6c8d-45e3-9d5d-d7758e4b49ad.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\647c75f7-7710-48fa-85e2-99a2bd50ac86.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2271
                                                              Entropy (8bit):5.262769038621296
                                                              Encrypted:false
                                                              SSDEEP:48:YXsd8sUgs3C5sCfcdsnrsxgnsH+HEspAYsaj+HdCbZ:FQv6To742I4E1
                                                              MD5:0CDD9285882DE6D9A2310442735E7096
                                                              SHA1:C3AEDECE6FD7EAAD34EB0E4AFFCB40448C45A385
                                                              SHA-256:281597B3EA7F465429B737BFF04F5D9B43DDE54EDF7CA02DE5EEFE65E863341A
                                                              SHA-512:99902989B191F444F2D056133C98CB0B0B05CD795A4C6304C4254A898653E172DB8962BAFD0E943C4DC05D1F737FB185C1DEA1CD7890AFD4256A89DDBD001FB1
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371532200947877","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371532203430302","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369033803430461","port":443,"protocol_str":"quic"}],"anonymization":["FAAAABAAAABodHRwczovL2JpbmcuY29t",false],"server":"https://www.bing.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13371532203637116","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpn

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e6d3242-f24f-42cb-8215-9bd50de120dc.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):355
                                                              Entropy (8bit):5.4703101415581825
                                                              Encrypted:false
                                                              SSDEEP:6:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sXQcTlBv31dB8wXwlmUUAnIMp5YRTToCpw:YWyX5Sg9vt+UAnIQchR7N+UAnI/1TJ1Q
                                                              MD5:480FB17AAD8E69F5F8C435FD1A7F0D55
                                                              SHA1:313DC7C9C864ED7B1953AF8A0B674FA28046BF9F
                                                              SHA-256:893B09CDDDFFB9002A947E62C7231A0F2EF76845CA44C85FF0C8E55569FD5B83
                                                              SHA-512:50CED80EB02863679A4716D1ACDDDD9D3D58C95E234787F5E8AAD2D3E98B88534DD4223AF8EB6F1244D1ADD898F2A70EE6EB1EA90124E5A1D4F5C406F52F1A36
                                                              Malicious:false
                                                              Preview:{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702},{"expiry":1756002608.612735,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1724466608.612739}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9a1e4274-9531-4d80-a78b-7cdbb0f21419.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 9
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):1.0809061581611155
                                                              Encrypted:false
                                                              SSDEEP:48:T2dKLopF+SawLUO1Xj8Bm2poVHixZUMc8mmOFyPr:ige+Aum2WVHG1r
                                                              MD5:A2161AD41B9ADC7829B5AE0C8C2C9D90
                                                              SHA1:A29F240F3EE087682C29853A96E9CEBE2545B293
                                                              SHA-256:9D18AA935649F4EC9CE95F7A6DED12856A01BE79B3D8B0EC4FCA79D2DDE1C3A2
                                                              SHA-512:4108A8DFD153A016945986683C87CBD9561BBCAB1D10B9BE53C64D909460CD27414DD3E1F407D31C5C741F0AEABC023D039D6BD6C27ABA1609F0BFAE552AFDA9
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):61
                                                              Entropy (8bit):3.926136109079379
                                                              Encrypted:false
                                                              SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                              MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                              SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                              SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                              SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2bffa.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):61
                                                              Entropy (8bit):3.926136109079379
                                                              Encrypted:false
                                                              SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                              MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                              SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                              SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                              SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3aaa8.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):61
                                                              Entropy (8bit):3.926136109079379
                                                              Encrypted:false
                                                              SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                              MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                              SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                              SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                              SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
                                                              Category:dropped
                                                              Size (bytes):36864
                                                              Entropy (8bit):1.3305982793842561
                                                              Encrypted:false
                                                              SSDEEP:96:uIEumQv8m1ccnvS6MDo2dQF2YQ9UZa1dsRVkI:uIEumQv8m1ccnvS65282rUZaHgd
                                                              MD5:BE4655E709D7FC70456CBED256562AC3
                                                              SHA1:3943495DE8AA819F37DE642F0F9537C7BAE58C3F
                                                              SHA-256:759452B799B4FD9FF8A9B14AA7BAE49A829598F27F137E05202FFC5084DEA0DF
                                                              SHA-512:F3A48023B59B5CD118A3DC8A4480465BA78BFDB128BB3BCD7DF03053D62B85AAAA07B17B7DEAFC2EF1D082A3813F637286578C97570C7DAAAC8E30DF250D38AE
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF29d5f.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2b0c8.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2b481.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):40
                                                              Entropy (8bit):4.1275671571169275
                                                              Encrypted:false
                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                              Malicious:false
                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):203
                                                              Entropy (8bit):5.4042796420747425
                                                              Encrypted:false
                                                              SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                              MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                              SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                              SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                              SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                              Malicious:false
                                                              Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2bfcb.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):203
                                                              Entropy (8bit):5.4042796420747425
                                                              Encrypted:false
                                                              SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                              MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                              SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                              SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                              SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                              Malicious:false
                                                              Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3c6ac.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):203
                                                              Entropy (8bit):5.4042796420747425
                                                              Encrypted:false
                                                              SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                              MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                              SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                              SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                              SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                              Malicious:false
                                                              Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                              Category:dropped
                                                              Size (bytes):36864
                                                              Entropy (8bit):0.36515621748816035
                                                              Encrypted:false
                                                              SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                              MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                              SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                              SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                              SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c6ae667b-9060-4dd2-89ea-451bf55025d8.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0dfda39-ef11-43e2-9e00-75f003ba96e1.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):355
                                                              Entropy (8bit):5.461132463999638
                                                              Encrypted:false
                                                              SSDEEP:6:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sXQclBv31dB8wXwlmUUAnIMp5YRTTG2qSQ:YWyX5Sg9vt+UAnIQclR7N+UAnI/1TGsQ
                                                              MD5:3D5E2B44EFBCBAEFC60FB5748BAFCFA5
                                                              SHA1:A37ACF705463CDB1C802BAC79A6BC7A52FD23321
                                                              SHA-256:2C4E0D545E558EF6733192C19BBD0FB1892C22D9541095B20B31B42E119B6F0B
                                                              SHA-512:863FB064A3BD8AD78B4644601E1C05755DCC7AB4FFEF7B7CBC332BEAFE51161B496FE10967674615A1534214BD35420F799E6CE6319A1BFD696A148A595DD78A
                                                              Malicious:false
                                                              Preview:{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702},{"expiry":1756002669.040722,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1724466669.040728}],"version":2}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f26ad782-920d-4af4-b7b5-2c71600536fb.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):40
                                                              Entropy (8bit):4.1275671571169275
                                                              Encrypted:false
                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                              Malicious:false
                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):0.5744102022039023
                                                              Encrypted:false
                                                              SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isCHIrdNG7fdjxHIXOFSY:TLiOUOq0afDdWec9sJKG7zo7J5fc
                                                              MD5:8B7CCBAE5FB8F1D3FDB331AED0833FB0
                                                              SHA1:7924CE8D7CF818F1132F1C8A047FBEEF13F18877
                                                              SHA-256:8029C4EAA75734867C5970AB41422A7F551EBFDF65E152C09F8A4038B17080C8
                                                              SHA-512:23B07F98E037ECC9BAAB37EA93264503B936CA180F4873D19944D186F3529926CBDC7A0962E7A51EADC8CEB2CA85D94BFC3C431D0068B8320C45BF24C0DDB163
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):12316
                                                              Entropy (8bit):5.072360783215825
                                                              Encrypted:false
                                                              SSDEEP:192:sVbJ9pQTryZigaba4uyYJYSaYW3x84pj+Fnj4QAH8f1f:sVbLA3u3JYSupUj4Qag
                                                              MD5:63A5CCA7D2AAC53D7C453B63258BB5B0
                                                              SHA1:E9057D18BDA39F579899F5D693823C046E45B1CD
                                                              SHA-256:3A1860A1E486D913AB8C47E0964C9A904DE3FDBD298D472CFF98768F7786B3C4
                                                              SHA-512:3EE98F562ECCD82448025EA80072D97B4528420E38AD9D56EE51CB0B8F456E5708CB425C971E326BECB28D91B14FE485A642EBBC84087D4BA408A6B66AA852E8
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13368940198801444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2d92f.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):12316
                                                              Entropy (8bit):5.072360783215825
                                                              Encrypted:false
                                                              SSDEEP:192:sVbJ9pQTryZigaba4uyYJYSaYW3x84pj+Fnj4QAH8f1f:sVbLA3u3JYSupUj4Qag
                                                              MD5:63A5CCA7D2AAC53D7C453B63258BB5B0
                                                              SHA1:E9057D18BDA39F579899F5D693823C046E45B1CD
                                                              SHA-256:3A1860A1E486D913AB8C47E0964C9A904DE3FDBD298D472CFF98768F7786B3C4
                                                              SHA-512:3EE98F562ECCD82448025EA80072D97B4528420E38AD9D56EE51CB0B8F456E5708CB425C971E326BECB28D91B14FE485A642EBBC84087D4BA408A6B66AA852E8
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13368940198801444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF32423.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):12316
                                                              Entropy (8bit):5.072360783215825
                                                              Encrypted:false
                                                              SSDEEP:192:sVbJ9pQTryZigaba4uyYJYSaYW3x84pj+Fnj4QAH8f1f:sVbLA3u3JYSupUj4Qag
                                                              MD5:63A5CCA7D2AAC53D7C453B63258BB5B0
                                                              SHA1:E9057D18BDA39F579899F5D693823C046E45B1CD
                                                              SHA-256:3A1860A1E486D913AB8C47E0964C9A904DE3FDBD298D472CFF98768F7786B3C4
                                                              SHA-512:3EE98F562ECCD82448025EA80072D97B4528420E38AD9D56EE51CB0B8F456E5708CB425C971E326BECB28D91B14FE485A642EBBC84087D4BA408A6B66AA852E8
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13368940198801444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF39963.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):12316
                                                              Entropy (8bit):5.072360783215825
                                                              Encrypted:false
                                                              SSDEEP:192:sVbJ9pQTryZigaba4uyYJYSaYW3x84pj+Fnj4QAH8f1f:sVbLA3u3JYSupUj4Qag
                                                              MD5:63A5CCA7D2AAC53D7C453B63258BB5B0
                                                              SHA1:E9057D18BDA39F579899F5D693823C046E45B1CD
                                                              SHA-256:3A1860A1E486D913AB8C47E0964C9A904DE3FDBD298D472CFF98768F7786B3C4
                                                              SHA-512:3EE98F562ECCD82448025EA80072D97B4528420E38AD9D56EE51CB0B8F456E5708CB425C971E326BECB28D91B14FE485A642EBBC84087D4BA408A6B66AA852E8
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13368940198801444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):33
                                                              Entropy (8bit):4.051821770808046
                                                              Encrypted:false
                                                              SSDEEP:3:YVXADAEvTLSJ:Y9AcEvHSJ
                                                              MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                                              SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                                              SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                                              SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                                              Malicious:false
                                                              Preview:{"preferred_apps":[],"version":1}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):34635
                                                              Entropy (8bit):5.560298993257091
                                                              Encrypted:false
                                                              SSDEEP:768:dRsIUMWPfLfOz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgM+AarwKGkJRDdKps8tuq:dRsIUMWPfLfOzu1jaPNAfKGwv+tl
                                                              MD5:B8541A40D809D91537A58AB2595C6474
                                                              SHA1:51A8B957DB84F1B4DB46673CE00B46B957E85390
                                                              SHA-256:E8E674122A6248C7F96D8B2FA9F4176BA257B0A6C6EFF5730CB2ECD950D881D0
                                                              SHA-512:86B6B09342C1635B9A0D80CD2E646A491B31451A7D1D978330E5F6348C5CBD480A3ED28786CFA8477B69982CAA338D192BAB8D2FD4F98AFC74C3CF9CC4BFFA0E
                                                              Malicious:false
                                                              Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13368940197445268","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13368940197445268","location":5,"ma

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2d7d8.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):34635
                                                              Entropy (8bit):5.560298993257091
                                                              Encrypted:false
                                                              SSDEEP:768:dRsIUMWPfLfOz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgM+AarwKGkJRDdKps8tuq:dRsIUMWPfLfOzu1jaPNAfKGwv+tl
                                                              MD5:B8541A40D809D91537A58AB2595C6474
                                                              SHA1:51A8B957DB84F1B4DB46673CE00B46B957E85390
                                                              SHA-256:E8E674122A6248C7F96D8B2FA9F4176BA257B0A6C6EFF5730CB2ECD950D881D0
                                                              SHA-512:86B6B09342C1635B9A0D80CD2E646A491B31451A7D1D978330E5F6348C5CBD480A3ED28786CFA8477B69982CAA338D192BAB8D2FD4F98AFC74C3CF9CC4BFFA0E
                                                              Malicious:false
                                                              Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13368940197445268","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13368940197445268","location":5,"ma

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):364
                                                              Entropy (8bit):4.033282950836162
                                                              Encrypted:false
                                                              SSDEEP:6:S85aEFljljljljljljljlaDgUX2BGqkxpw+CA5EEE:S+a8ljljljljljljljUgwqcS+CA
                                                              MD5:FF0DA3324B5F5AE0E6CF8235A1B28E7C
                                                              SHA1:13D11D8EB779836881C58F4FC5E29D58309FDE29
                                                              SHA-256:75789CE06204CB76099EFA9604D7327FE44850D93EA0FAD41E62944EFF0CAD73
                                                              SHA-512:DFB9C20BADC7BB51CB139A9715FADC4DD909709FB139026B2C9547457B95C2AE82DEBBEFDEE690F4D09B8DB77FE9170ADAEADFB289AD71DEF947D78EF98FD1BA
                                                              Malicious:false
                                                              Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f...................j................next-map-id.1.Knamespace-fdfada11_8f89_48a2_b1dc_d9930c7ad750-https://accounts.google.com/.0V.e................V.e................V.e................V.e................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):322
                                                              Entropy (8bit):5.1194080331813
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPk1NSVq2Pwkn23oH+TcwtrQMxIFUt88PXPkLAgZmw+8PXPkSYDIkwOwkn23oM:NPc14vYfYebCFUt88Pc1/+8PcSYc5Jfn
                                                              MD5:9ED8B21935277A949406BB71B7146634
                                                              SHA1:500344D76FB69F81F10204A624A27A7A0F531325
                                                              SHA-256:F7ACBCF8D6471C300AB6A0D511AF715569224A18E152421D19E9862D7FEDD7C2
                                                              SHA-512:41E518D3BA6E38FBE6C481E7DEEE3E7623D0413B39781875F77280A2A25683D9E1A0900DAA4455BAB8C60B17508261ACF46B62DD89ED8E1B99305B3F85B745F5
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:59.035 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/23-22:29:59.095 1de0 Recovering log #3.2024/08/23-22:29:59.098 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):322
                                                              Entropy (8bit):5.1194080331813
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPk1NSVq2Pwkn23oH+TcwtrQMxIFUt88PXPkLAgZmw+8PXPkSYDIkwOwkn23oM:NPc14vYfYebCFUt88Pc1/+8PcSYc5Jfn
                                                              MD5:9ED8B21935277A949406BB71B7146634
                                                              SHA1:500344D76FB69F81F10204A624A27A7A0F531325
                                                              SHA-256:F7ACBCF8D6471C300AB6A0D511AF715569224A18E152421D19E9862D7FEDD7C2
                                                              SHA-512:41E518D3BA6E38FBE6C481E7DEEE3E7623D0413B39781875F77280A2A25683D9E1A0900DAA4455BAB8C60B17508261ACF46B62DD89ED8E1B99305B3F85B745F5
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:59.035 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/23-22:29:59.095 1de0 Recovering log #3.2024/08/23-22:29:59.098 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13368940199950117

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):7469
                                                              Entropy (8bit):4.033299941388081
                                                              Encrypted:false
                                                              SSDEEP:192:3sSVNA3P3c9lNq3P3cRNle4K2KC3P3cDT:cL3c9e3cV3cD
                                                              MD5:339FB54745D889DC0059B989363A0050
                                                              SHA1:B1FB6B3253330EAF98F4C5DAD6128E70DCC52468
                                                              SHA-256:828C61F4DBDD5EEC3FB5508129A9C9F1472A76AD3F4EA32D63E4E9387518A835
                                                              SHA-512:FCD6BA78DCCAA2E68B2B853C70713EE86ED359D0988666331BE6E18BDF055E8CDA006299687C5B8C93100F39B853906EF307AC5D0EA22CB03DC7BA6B8719E8F7
                                                              Malicious:false
                                                              Preview:SNSS.........v+.............v+......"..v+.............v+.........v+.........v+.........v+....!....v+.................................v+..v+1..,.....v+$...fdfada11_8f89_48a2_b1dc_d9930c7ad750.....v+.........v+.....-...........v+.....v+.........................v+....................5..0.....v+&...{1A5CCF63-1000-409F-B5C1-AFEC7F75D4D9}.......v+.........v+............................v+.............v+....>...https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd&ifkv=Ab5oB3q_Qtn8KzmibOTZnJEUA-N4ORrF3B6ePfh1Vy6270kQ8I3YGNBFNi0E5rLTMyJosEQND6TmeA&service=accountsettings&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2046870911%3A1724466602364875&ddm=0......S.i.g.n. .i.n. .-. .G.o.o.g.l.e. .A.c.c.o.u.n.t.s...L...H...!...@.....................................................................................................<.d ....<.d ..................................P...................................................>...h

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):0.44194574462308833
                                                              Encrypted:false
                                                              SSDEEP:12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
                                                              MD5:B35F740AA7FFEA282E525838EABFE0A6
                                                              SHA1:A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
                                                              SHA-256:5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
                                                              SHA-512:05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):350
                                                              Entropy (8bit):5.172389942193368
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPBN+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88PXPfWZmw+8PXP6VkwOwkn23oH+Tcz:NPT+vYfYebIhHh2FUt88PnW/+8PSV5J8
                                                              MD5:EC5EAEC0105C1B8CF0BABA81BCB8F7BB
                                                              SHA1:493450FE0E25E6D14297C2F27D1167B5585F5669
                                                              SHA-256:C9B84F35CC73E2C516B9994448025E1BC1D8965E6B13D41A4A40A04CF89A4B6B
                                                              SHA-512:8AA31CA40AE8A7A6116C0D33990A90643FF86EDB4D962354C2E9FFC2DC394F104739048B14D2C6F13836397A44AA5C0E28EBA5E2610D9E1DCDA3BE012C110B4E
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:58.193 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/23-22:29:58.194 1d3c Recovering log #3.2024/08/23-22:29:58.194 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):350
                                                              Entropy (8bit):5.172389942193368
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPBN+q2Pwkn23oH+Tcwt7Uh2ghZIFUt88PXPfWZmw+8PXP6VkwOwkn23oH+Tcz:NPT+vYfYebIhHh2FUt88PnW/+8PSV5J8
                                                              MD5:EC5EAEC0105C1B8CF0BABA81BCB8F7BB
                                                              SHA1:493450FE0E25E6D14297C2F27D1167B5585F5669
                                                              SHA-256:C9B84F35CC73E2C516B9994448025E1BC1D8965E6B13D41A4A40A04CF89A4B6B
                                                              SHA-512:8AA31CA40AE8A7A6116C0D33990A90643FF86EDB4D962354C2E9FFC2DC394F104739048B14D2C6F13836397A44AA5C0E28EBA5E2610D9E1DCDA3BE012C110B4E
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:58.193 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/23-22:29:58.194 1d3c Recovering log #3.2024/08/23-22:29:58.194 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.01057775872642915
                                                              Encrypted:false
                                                              SSDEEP:3:MsFl:/F
                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                              Malicious:false
                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):270336
                                                              Entropy (8bit):8.280239615765425E-4
                                                              Encrypted:false
                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.011852361981932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsHlDll:/H
                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.012340643231932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsGl3ll:/y
                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                              Category:dropped
                                                              Size (bytes):524656
                                                              Entropy (8bit):5.027445846313988E-4
                                                              Encrypted:false
                                                              SSDEEP:3:LsulkNYq:Lsh2q
                                                              MD5:A4E5098B033F4CA5942DEFFC8E42098D
                                                              SHA1:D35609EB3498329A7DF5887873AD2643E7D19033
                                                              SHA-256:DAF097969FCE1EC31828DE2517D3ABC98AFBE5CFBAE86FA41EF09BA133D8A270
                                                              SHA-512:C9458395739A93B91D8568DC926F70C097442F0BDB9F3977536DBE38DAA58CFCA520532709DD3B4449CC16A609366C7E2CFD3FEE505D7EB08D14F660C3265DF5
                                                              Malicious:false
                                                              Preview:........................................o....~/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.01057775872642915
                                                              Encrypted:false
                                                              SSDEEP:3:MsFl:/F
                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                              Malicious:false
                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):270336
                                                              Entropy (8bit):0.0012471779557650352
                                                              Encrypted:false
                                                              SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.011852361981932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsHlDll:/H
                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.012340643231932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsGl3ll:/y
                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                              Category:dropped
                                                              Size (bytes):262512
                                                              Entropy (8bit):9.553120663130604E-4
                                                              Encrypted:false
                                                              SSDEEP:3:LsNlEb:Ls3y
                                                              MD5:2E433679099D88AEFDCF9C482C860FBE
                                                              SHA1:77326C62D77CF436B7B3057B350E68EE10E21D03
                                                              SHA-256:5C6DA182CEE7A13FF46003D42B75470A837B6322925C20026A7AD883779F009E
                                                              SHA-512:9081C17E68C96B0E3B9069DEB4BC2C696F16DC3D2594F39959DEF39B3AAEE8B0E670832D78F41243588FB78ACE82453F19585206DD75BC1D9F987A5090237427
                                                              Malicious:false
                                                              Preview:........................................Hy...~/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):270336
                                                              Entropy (8bit):0.0012471779557650352
                                                              Encrypted:false
                                                              SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                              MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                              SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                              SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                              SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):432
                                                              Entropy (8bit):5.221059347478103
                                                              Encrypted:false
                                                              SSDEEP:12:NPcGvYfYebvqBQFUt88Pc//+8PcTc5JfYebvqBvJ:NPcEYfYebvZg88PcFPcTGJfYebvk
                                                              MD5:25D5F3BD8AA785B8EA54F0F408E88872
                                                              SHA1:B5D06D9F7F84C229C37CCB394D181ADA56148609
                                                              SHA-256:C3600E8723AF62EB366C4CBFFFAD9450973AF94325E572CE55DA44A7F19A9A0C
                                                              SHA-512:0FA275A48D03F98FAD0A336B8F32DA00E3A9479514B802E2405782F2BDEBF51BBEE2590C5074631234F409677BF11B2BCEDB3BCD6EB38D47756FAE95F999EE7F
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:59.129 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/23-22:29:59.129 1e00 Recovering log #3.2024/08/23-22:29:59.133 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):432
                                                              Entropy (8bit):5.221059347478103
                                                              Encrypted:false
                                                              SSDEEP:12:NPcGvYfYebvqBQFUt88Pc//+8PcTc5JfYebvqBvJ:NPcEYfYebvZg88PcFPcTGJfYebvk
                                                              MD5:25D5F3BD8AA785B8EA54F0F408E88872
                                                              SHA1:B5D06D9F7F84C229C37CCB394D181ADA56148609
                                                              SHA-256:C3600E8723AF62EB366C4CBFFFAD9450973AF94325E572CE55DA44A7F19A9A0C
                                                              SHA-512:0FA275A48D03F98FAD0A336B8F32DA00E3A9479514B802E2405782F2BDEBF51BBEE2590C5074631234F409677BF11B2BCEDB3BCD6EB38D47756FAE95F999EE7F
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:59.129 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/23-22:29:59.129 1e00 Recovering log #3.2024/08/23-22:29:59.133 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3d5ef16c-9bfd-47de-a784-98c4f8043763.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):40
                                                              Entropy (8bit):4.1275671571169275
                                                              Encrypted:false
                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                              Malicious:false
                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\487dfd8f-7dba-42ea-97e9-41ce29f08b8e.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):193
                                                              Entropy (8bit):4.864047146590611
                                                              Encrypted:false
                                                              SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                              MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                              SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                              SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                              SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3b7a9.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):193
                                                              Entropy (8bit):4.864047146590611
                                                              Encrypted:false
                                                              SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                              MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                              SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                              SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                              SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                              Category:dropped
                                                              Size (bytes):36864
                                                              Entropy (8bit):0.555790634850688
                                                              Encrypted:false
                                                              SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                              MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                              SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                              SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                              SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2b0c8.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2b481.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):40
                                                              Entropy (8bit):4.1275671571169275
                                                              Encrypted:false
                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                              Malicious:false
                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                              Category:dropped
                                                              Size (bytes):36864
                                                              Entropy (8bit):0.36515621748816035
                                                              Encrypted:false
                                                              SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                              MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                              SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                              SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                              SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a1c36aeb-27d9-4694-9c38-a1d8688ffd00.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d33c580d-0440-441b-bfdd-786c9cc0b731.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2
                                                              Entropy (8bit):1.0
                                                              Encrypted:false
                                                              SSDEEP:3:H:H
                                                              MD5:D751713988987E9331980363E24189CE
                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                              Malicious:false
                                                              Preview:[]

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fef5025e-51ca-48a8-b911-5870d82896fe.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):111
                                                              Entropy (8bit):4.718418993774295
                                                              Encrypted:false
                                                              SSDEEP:3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
                                                              MD5:285252A2F6327D41EAB203DC2F402C67
                                                              SHA1:ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
                                                              SHA-256:5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
                                                              SHA-512:11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
                                                              Malicious:false
                                                              Preview:{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):80
                                                              Entropy (8bit):3.4921535629071894
                                                              Encrypted:false
                                                              SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                              MD5:69449520FD9C139C534E2970342C6BD8
                                                              SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                              SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                              SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                              Malicious:false
                                                              Preview:*...#................version.1..namespace-..&f.................&f...............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):420
                                                              Entropy (8bit):5.223974785701692
                                                              Encrypted:false
                                                              SSDEEP:12:NPVOhvYfYebvqBZFUt88PC/+8PRD5JfYebvqBaJ:NPVONYfYebvyg88PAPbJfYebvL
                                                              MD5:EF40DD7C72A08484EAC86AC4B4FCEA77
                                                              SHA1:BE2B9EDEDC18B1284EDBAD207289A2329B17B43D
                                                              SHA-256:689F17AE6772C50B9805495EE162C43919DA1C988784E08063109F3609058D3E
                                                              SHA-512:CC1ADFDBB1699B0260E3DBE8D1654D4C5D6A27539F86B0FD2BF93BA818E265BD3FD09F498B154222EE45ACFC95C34316E53E6D027A08F8A67596D1E53223849A
                                                              Malicious:false
                                                              Preview:2024/08/23-22:30:17.511 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/23-22:30:17.512 1de0 Recovering log #3.2024/08/23-22:30:17.515 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):420
                                                              Entropy (8bit):5.223974785701692
                                                              Encrypted:false
                                                              SSDEEP:12:NPVOhvYfYebvqBZFUt88PC/+8PRD5JfYebvqBaJ:NPVONYfYebvyg88PAPbJfYebvL
                                                              MD5:EF40DD7C72A08484EAC86AC4B4FCEA77
                                                              SHA1:BE2B9EDEDC18B1284EDBAD207289A2329B17B43D
                                                              SHA-256:689F17AE6772C50B9805495EE162C43919DA1C988784E08063109F3609058D3E
                                                              SHA-512:CC1ADFDBB1699B0260E3DBE8D1654D4C5D6A27539F86B0FD2BF93BA818E265BD3FD09F498B154222EE45ACFC95C34316E53E6D027A08F8A67596D1E53223849A
                                                              Malicious:false
                                                              Preview:2024/08/23-22:30:17.511 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/23-22:30:17.512 1de0 Recovering log #3.2024/08/23-22:30:17.515 1de0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):326
                                                              Entropy (8bit):5.215685640405222
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPkq2Pwkn23oH+TcwtpIFUt88PXPOdFuZmw+8PXPOdFCkwOwkn23oH+Tcwta/o:NP8vYfYebmFUt88PWdFu/+8PWdFC5JfT
                                                              MD5:1B8A49A5F92C51E1BE66873C8A14A719
                                                              SHA1:FB7DE6A771332E39AB647C7E71726C6F5432BCE4
                                                              SHA-256:14F77477112C47E6BB3A6E342525E7BBF5089E506D1B7F587DF09391C373BD1F
                                                              SHA-512:248D059844EA72890FAAD4A3B2F93F00B2DE4EC837CB6A25F5350D23744915E5DA4ADB7871A91E4985A8C1D474CD9DEA3446B9D08997BA24EFF7C83A26573BC9
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:58.177 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/23-22:29:58.188 1d20 Recovering log #3.2024/08/23-22:29:58.188 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):326
                                                              Entropy (8bit):5.215685640405222
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPkq2Pwkn23oH+TcwtpIFUt88PXPOdFuZmw+8PXPOdFCkwOwkn23oH+Tcwta/o:NP8vYfYebmFUt88PWdFu/+8PWdFC5JfT
                                                              MD5:1B8A49A5F92C51E1BE66873C8A14A719
                                                              SHA1:FB7DE6A771332E39AB647C7E71726C6F5432BCE4
                                                              SHA-256:14F77477112C47E6BB3A6E342525E7BBF5089E506D1B7F587DF09391C373BD1F
                                                              SHA-512:248D059844EA72890FAAD4A3B2F93F00B2DE4EC837CB6A25F5350D23744915E5DA4ADB7871A91E4985A8C1D474CD9DEA3446B9D08997BA24EFF7C83A26573BC9
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:58.177 1d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/23-22:29:58.188 1d20 Recovering log #3.2024/08/23-22:29:58.188 1d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                                                              Category:dropped
                                                              Size (bytes):28672
                                                              Entropy (8bit):0.26707851465859517
                                                              Encrypted:false
                                                              SSDEEP:12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
                                                              MD5:04F8B790DF73BD7CD01238F4681C3F44
                                                              SHA1:DF12D0A21935FC01B36A24BF72AB9640FEBB2077
                                                              SHA-256:96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
                                                              SHA-512:0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):131072
                                                              Entropy (8bit):0.005426458244512447
                                                              Encrypted:false
                                                              SSDEEP:3:ImtVx//l/tyE/lFEXy///l:IiVt/qEtFEy/Xl
                                                              MD5:445ABB8F7ADBF6B4CD3BDD2A8E0604F5
                                                              SHA1:D863765D60AB99C4FF699AEBAA1647763D6B996D
                                                              SHA-256:0FD175B70386FB2C085F7254791B04D4110DC6602F13629F04E22277221993AC
                                                              SHA-512:CE1351A8ADDD5EEDD047EE1086133C0E5E98D1FDE4E29D63BA42DAD216DACD81D735981BA1B1F902A26F5B06DADAABA813A65CF64240373BC78E31D8EC0EDFF4
                                                              Malicious:false
                                                              Preview:VLnk.....?.........u.6Q.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
                                                              Category:dropped
                                                              Size (bytes):184320
                                                              Entropy (8bit):1.0674975423102242
                                                              Encrypted:false
                                                              SSDEEP:192:QSqzWMMUfTtnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYIpn6:QrzWMffBnzkkqtXnTK+hNH+5EVumt
                                                              MD5:628F1FC92BF44F62DB171564895E0DF6
                                                              SHA1:5A33BB245721CFCC41E1DADAD5AF8D1B6797C828
                                                              SHA-256:2EFDCAA86EE1930196DE18D6F833C7404833476795DD915446E64522DEC6C7A7
                                                              SHA-512:B361C7BC65A07BB6CBB485B359072E14AEC83BAA60CA56529112B20CD2A0F1BD8C426CC345C345FBC685A2120724BD074B140EE6121AB99301A734518911598E
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
                                                              Category:dropped
                                                              Size (bytes):14336
                                                              Entropy (8bit):1.4184778260639854
                                                              Encrypted:false
                                                              SSDEEP:48:uOK3tjkSdj5IUltGhp22iSBgj2Ry3NGU8sgCw2Ry3NGU8oxj/:PtSjGhp22iS3YNGU/YNGUT
                                                              MD5:15B71EEC2BD0C7C8D733B8035EED7336
                                                              SHA1:5DEA34924177A1B1422E8E90B403765DD26A0F49
                                                              SHA-256:215FB8C696CF67B9664318CAA11A36DA14FB719017E65AC839F66679CE4943E6
                                                              SHA-512:3535F4C45962B56DAA7CF4847B81E79551C60069BCB4E2F6D458533D8F3589D4A4E5F24C456481E3DE85604A4986B5E8F675CC0DADB57E22A12C0192AB6E1466
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):40960
                                                              Entropy (8bit):0.41235120905181716
                                                              Encrypted:false
                                                              SSDEEP:48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
                                                              MD5:981F351994975A68A0DD3ECE5E889FD0
                                                              SHA1:080D3386290A14A68FCE07709A572AF98097C52D
                                                              SHA-256:3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
                                                              SHA-512:C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):11755
                                                              Entropy (8bit):5.190465908239046
                                                              Encrypted:false
                                                              SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                              MD5:07301A857C41B5854E6F84CA00B81EA0
                                                              SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                              SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                              SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                              Malicious:false
                                                              Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b1d4de9c-e35d-447a-a831-dd24349bf02e.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):39694
                                                              Entropy (8bit):5.562606117984141
                                                              Encrypted:false
                                                              SSDEEP:768:dRsIQB7pLGLv6MWPfLfBz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXb7M+AarwKGO5Y:dRsIQ3cv6MWPfLfBzu1jaOb7NAfKGL+K
                                                              MD5:6A02D8351727AD5068A5FAD9BB8F63DA
                                                              SHA1:9AF8C7E68A8E3FD45B4B05660C156633D2DC9093
                                                              SHA-256:3908747803C75F71DF4FE42FC8D0D15FC1977163D8F9BAA10CE07CE8660F5A05
                                                              SHA-512:18250422AFFE809C67662C23F45FDF0BAF0C6E27CA0270F474C01F35190120F6AF3905FD88B0240C4B1AB5970275F324B5BC102AE28CD75799937491962E3FB4
                                                              Malicious:false
                                                              Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13368940197445268","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13368940197445268","location":5,"ma

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bf07d9ad-71ca-4898-bcb2-58cdc5aaba5f.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):115717
                                                              Entropy (8bit):5.183660917461099
                                                              Encrypted:false
                                                              SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                              MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                              SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                              SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                              SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                              Malicious:false
                                                              Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cf1421cb-7140-43cf-a0ec-4927f4afdd83.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):12316
                                                              Entropy (8bit):5.072360783215825
                                                              Encrypted:false
                                                              SSDEEP:192:sVbJ9pQTryZigaba4uyYJYSaYW3x84pj+Fnj4QAH8f1f:sVbLA3u3JYSupUj4Qag
                                                              MD5:63A5CCA7D2AAC53D7C453B63258BB5B0
                                                              SHA1:E9057D18BDA39F579899F5D693823C046E45B1CD
                                                              SHA-256:3A1860A1E486D913AB8C47E0964C9A904DE3FDBD298D472CFF98768F7786B3C4
                                                              SHA-512:3EE98F562ECCD82448025EA80072D97B4528420E38AD9D56EE51CB0B8F456E5708CB425C971E326BECB28D91B14FE485A642EBBC84087D4BA408A6B66AA852E8
                                                              Malicious:false
                                                              Preview:{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13368940198801444","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                              Category:dropped
                                                              Size (bytes):28672
                                                              Entropy (8bit):0.3410017321959524
                                                              Encrypted:false
                                                              SSDEEP:12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
                                                              MD5:98643AF1CA5C0FE03CE8C687189CE56B
                                                              SHA1:ECADBA79A364D72354C658FD6EA3D5CF938F686B
                                                              SHA-256:4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
                                                              SHA-512:68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dd225db9-a7a3-4e57-94dc-2b52fff6e6d3.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:L:L
                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                              Malicious:false
                                                              Preview:.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.35226517389931394
                                                              Encrypted:false
                                                              SSDEEP:12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
                                                              MD5:D2CCDC36225684AAE8FA563AFEDB14E7
                                                              SHA1:3759649035F23004A4C30A14C5F0B54191BEBF80
                                                              SHA-256:080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
                                                              SHA-512:1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):32768
                                                              Entropy (8bit):0.09778410579514832
                                                              Encrypted:false
                                                              SSDEEP:6:G9l/q/6/J5A/l/q/6/J519XHl/Vl/Unkl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/VlG:Ctqi/3gtqi/33FnnnnnnnnnnnnnnpEo
                                                              MD5:475D520C37432A31E51066EE866A9707
                                                              SHA1:BE8B38025A312678CA349FD9CEEA0A321F6022DA
                                                              SHA-256:BF8A9E25273A58A71D20BE03D98C60F5CF9D0F6B176249CF28D2F207D35315CE
                                                              SHA-512:D18BA84ED3C30281DF3DB699ABAD3790F51322610DBDA4DD2BB3156098A42A39C381B06834E84BA4D589613AA841C03F2BE09B90720D368C5B13AA710C015B75
                                                              Malicious:false
                                                              Preview:..-.............H....... ~..k3Y."...]..Ux.P...\...-.............H....... ~..k3Y."...]..Ux.P...\.........D...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite Write-Ahead Log, version 3007000
                                                              Category:dropped
                                                              Size (bytes):296672
                                                              Entropy (8bit):1.0166195010232575
                                                              Encrypted:false
                                                              SSDEEP:192:b7ReSvH7vMLzy8szHT8WzkgbT80zwNkgbT8zzF/3+kgbT8Vzz/8IB+kgbT8LzJwX:3kSvHrUEXxtfThKjYy7/qyFfFWgF73r
                                                              MD5:2D18D176E4375AEAA0B8D600A0C4DD9F
                                                              SHA1:6E08A9EF3273B1BCE5ACF3D595327D1295705049
                                                              SHA-256:D44979F07F4A8D04550274DDFC53446A30E3999AFD8484E494D113A2016BDB03
                                                              SHA-512:669CFF550C09F06A54CB096B5CC2E4E46AAFD1DA73A84E1EFF369C145426610709F69B5BB4F682BF869B6C47E6E34B8CA8FEBD9D7AD540DCFE15CC00357A8211
                                                              Malicious:false
                                                              Preview:7....-.........."...]..U...5.W7........"...]..U...IZ..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:modified
                                                              Size (bytes):250
                                                              Entropy (8bit):3.741686967221217
                                                              Encrypted:false
                                                              SSDEEP:3:VVXntjQPEnjQvxlfV+m/ll3seGKT9rcQ6xrQYStlTxotlTxotlTxotlTxotlTxoX:/XntM+4lfcWll3sedhOxSuuuuu
                                                              MD5:DAF45FE906B5581671AC7E2710181B5C
                                                              SHA1:4D4D704270A5CF65A1E412331B338760427F2B9C
                                                              SHA-256:19F507B66573196544E70A005F892B105DE9FD6B629C692263F8D50ED80D3365
                                                              SHA-512:0A268A2CC661186F2078D95E5662049F3772E59CBB9009EBF62B3E62FEE75633EC396401B268976CF5BE382036AF2FA8122DEBB4F169FB7563BB4676DD1D3689
                                                              Malicious:false
                                                              Preview:A..r.................20_1_1...1.,U.................20_1_1...1..&f...............H...0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):281
                                                              Entropy (8bit):5.249135614938911
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPkWuw1wkn23oH+Tcwtfrl2KLlLPXPk+Hyq2Pwkn23oH+TcwtfrK+IFUv:NPcXPfYeb1L1PcpvYfYeb23FUv
                                                              MD5:10C91C04BCD29FA9006EBA9C4F08FE1C
                                                              SHA1:09F2B533AA14B162CFF8851A73615EE643375BE5
                                                              SHA-256:F5CEE225E9806861881CC09584D6DDE618A78A3D0BE21983D5EC5AD62877EEEE
                                                              SHA-512:EAD233D9D8085FA1CB0120735A29FD15CD6C42F54D81BD267320CCC2E1EAB5D58FD92E74B7E11CAF91BDBEF11458B5336BC2D9D6E90C593F58BBC81EED5651F1
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:59.164 1d30 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/23-22:29:59.186 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):617
                                                              Entropy (8bit):3.9325179151892424
                                                              Encrypted:false
                                                              SSDEEP:12:G0nYUteza//z3p/Uz0RuWlJhC+lvBavRtin01zv0:G0nYUtezaD3RUovhC+lvBOL0
                                                              MD5:AD15D72AA4792C14DDD002CED70E8245
                                                              SHA1:30D0E75166FDA7126A73480EE3222C193231B579
                                                              SHA-256:17A781FB31D3176491D9B277ADEEE5521972C68956A2271637BBCBFEB27D6A7D
                                                              SHA-512:20B8D19B529A392FE0CBB44844926210D98C477498377B8370AA3A3A763C047EF96BE341686406522868EF848C83EF5EF4792B17CDD0462D4680EDA542C8A54F
                                                              Malicious:false
                                                              Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.|.................9_.....'\c..................9_.....

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):299
                                                              Entropy (8bit):5.210801084071561
                                                              Encrypted:false
                                                              SSDEEP:6:NPXPQR1wkn23oH+Tcwtfrzs52KLlLPXPkN9yq2Pwkn23oH+TcwtfrzAdIFUv:NPo0fYebs9L1PcuvYfYeb9FUv
                                                              MD5:702BA9F19C9422E69D38AB55D073E569
                                                              SHA1:97E73514A43A673FC9732B049B9483660BE424C9
                                                              SHA-256:EEB2C56FD8CAFFAFDE3AF943D9DF63292698D4998902E6FB3A8CE8ED70D741EF
                                                              SHA-512:BE7A76AD5B10D2DD194CB1E167E580FA88B64D6613E9080656321C1E00090DD1E3BE65EAD85BDF44F1CDEC38F4C5EA6251C6EBB4DD54D23A484AC0EC3663AA6D
                                                              Malicious:false
                                                              Preview:2024/08/23-22:29:58.799 1d30 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/23-22:29:59.161 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.01057775872642915
                                                              Encrypted:false
                                                              SSDEEP:3:MsFl:/F
                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                              Malicious:false
                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):270336
                                                              Entropy (8bit):8.280239615765425E-4
                                                              Encrypted:false
                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.011852361981932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsHlDll:/H
                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.012340643231932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsGl3ll:/y
                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                              Category:dropped
                                                              Size (bytes):262512
                                                              Entropy (8bit):9.553120663130604E-4
                                                              Encrypted:false
                                                              SSDEEP:3:LsNlN:Ls3N
                                                              MD5:7E413833ABA57955CF85DD7582B9EC72
                                                              SHA1:D485816E336B47C679FB5A90CABB252FFE21C7A7
                                                              SHA-256:5945553CF2CD35F4E2A4549E8C3B8A15B4482FEE427458952D5DD2CBACEB0A00
                                                              SHA-512:7A21A476F63FFD29AE877089FEF2FD27BFAD9B8078251513360AC316A541118D882A8355A027D08D8A1EE65E3675B713BC6ADBC22D8E0AEA7CCCF330FFE70DB7
                                                              Malicious:false
                                                              Preview:.........................................e...~/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.01057775872642915
                                                              Encrypted:false
                                                              SSDEEP:3:MsFl:/F
                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                              Malicious:false
                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):270336
                                                              Entropy (8bit):8.280239615765425E-4
                                                              Encrypted:false
                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.011852361981932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsHlDll:/H
                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.012340643231932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsGl3ll:/y
                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                              Category:dropped
                                                              Size (bytes):262512
                                                              Entropy (8bit):9.553120663130604E-4
                                                              Encrypted:false
                                                              SSDEEP:3:LsNlQ:Ls3
                                                              MD5:D426824696E37A8377732E61071DF369
                                                              SHA1:095D341A89D07A2D7B11EAC7B22B57180AF6044A
                                                              SHA-256:7CF4385676D2AB68DAA2EC516FAD266B8F2BE97809E9CEA1B7F59D973CB9736C
                                                              SHA-512:9E61B96D7AC31046EBEC7D0502BB749B6DD6B8966A608E523452F1B222959FC1719ED19E9A69AE135ACD204A8D403A9A4884DB3D4154C0A1052DC5E2F4AF726A
                                                              Malicious:false
                                                              Preview:........................................(...~/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):120
                                                              Entropy (8bit):3.32524464792714
                                                              Encrypted:false
                                                              SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                              MD5:A397E5983D4A1619E36143B4D804B870
                                                              SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                              SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                              SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                              Malicious:false
                                                              Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):13
                                                              Entropy (8bit):2.7192945256669794
                                                              Encrypted:false
                                                              SSDEEP:3:NYLFRQI:ap2I
                                                              MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                              SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                              SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                              SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                              Malicious:false
                                                              Preview:117.0.2045.47

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28591.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF285a1.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF289d7.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28a06.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2afdd.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2cf9a.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d037.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ef19.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ef38.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF398e6.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c015.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f713.TMP (copy)

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):6820
                                                              Entropy (8bit):5.7926517101689825
                                                              Encrypted:false
                                                              SSDEEP:96:iaqkHff6lp5ih/cI9URLl8Roto3MFVvlwhbe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:aknZeiRUUhd6qRAq1k8SPxVLZ7VTiq
                                                              MD5:53AC35A34D9FEBAC2877321DD7D99FB4
                                                              SHA1:0E2DBA4F11FE0F6DFB30CCDBBA412BB72199FDBB
                                                              SHA-256:BC6F5F80370C44E9A6964089C133473F343CE82E240F0D82F9D44A78659D4AA3
                                                              SHA-512:31B9F86A144D13EDD6BF2F5E7C16D8B97D28B403DDC2649752497D65EC9E2E6CE6B114167C43C417B1BB900A798653F7FB6AFC17B50CA78C8239F62BA202A8D9
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACLqlHJ7h6oQa8MvLd6xlGCEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAMAaDMk23yZlcV8QWD55GScriq8boswXYiKcuB9IlmXwAAAAA

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
                                                              Category:dropped
                                                              Size (bytes):20480
                                                              Entropy (8bit):0.5963118027796015
                                                              Encrypted:false
                                                              SSDEEP:12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isTydBVzQd9U9ez/qS9i:TLyXOUOq0afDdWec9sJz+Z7J5fc
                                                              MD5:48A6A0713B06707BC2FE9A0F381748D3
                                                              SHA1:043A614CFEF749A49837F19F627B9D6B73F15039
                                                              SHA-256:2F2006ADEA26E5FF95198883A080C9881D774154D073051FC69053AF912B037B
                                                              SHA-512:4C04FFAE2B558EB4C05AD9DCA094700D927AFAD1E561D6358F1A77CB09FC481A6424237DFF6AB37D147E029E19D565E876CD85A2E9C0EC1B068002AA13A16DBA
                                                              Malicious:false
                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.01057775872642915
                                                              Encrypted:false
                                                              SSDEEP:3:MsFl:/F
                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                              Malicious:false
                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):270336
                                                              Entropy (8bit):8.280239615765425E-4
                                                              Encrypted:false
                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.011852361981932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsHlDll:/H
                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.012340643231932763
                                                              Encrypted:false
                                                              SSDEEP:3:MsGl3ll:/y
                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                              Malicious:false
                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                              Category:dropped
                                                              Size (bytes):262512
                                                              Entropy (8bit):9.553120663130604E-4
                                                              Encrypted:false
                                                              SSDEEP:3:LsNlDVWS:Ls3JX
                                                              MD5:F766BC3FD4775535194BD46F533B927C
                                                              SHA1:65019A801732A266C2DC0110FD5CC732A76F48D8
                                                              SHA-256:3838DF7DEB274BE5D840D27FA966ACC185DEC7EA3793A133019D303CE5290F4A
                                                              SHA-512:97C56D30C78315216CFDD31AB6CD71F0C8776A205558F06DA6E694D48941245D246FC4AF077FD651FD14D283A174E6C874C9BBEDA8925DB4F161E52819B40B9C
                                                              Malicious:false
                                                              Preview:.........................................kp..~/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):47
                                                              Entropy (8bit):4.3818353308528755
                                                              Encrypted:false
                                                              SSDEEP:3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
                                                              MD5:48324111147DECC23AC222A361873FC5
                                                              SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                                                              SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                                                              SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                                                              Malicious:false
                                                              Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):35
                                                              Entropy (8bit):4.014438730983427
                                                              Encrypted:false
                                                              SSDEEP:3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
                                                              MD5:BB57A76019EADEDC27F04EB2FB1F1841
                                                              SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                                                              SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                                                              SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                                                              Malicious:false
                                                              Preview:{"forceServiceDetermination":false}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):29
                                                              Entropy (8bit):3.922828737239167
                                                              Encrypted:false
                                                              SSDEEP:3:2NGw+K+:fwZ+
                                                              MD5:7BAAFE811F480ACFCCCEE0D744355C79
                                                              SHA1:24B89AE82313084BB8BBEB9AD98A550F41DF7B27
                                                              SHA-256:D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
                                                              SHA-512:70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
                                                              Malicious:false
                                                              Preview:customSynchronousLookupUris_0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):35302
                                                              Entropy (8bit):7.99333285466604
                                                              Encrypted:true
                                                              SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                              MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                              SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                              SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                              SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                              Malicious:false
                                                              Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):18
                                                              Entropy (8bit):3.5724312513221195
                                                              Encrypted:false
                                                              SSDEEP:3:kDnaV6bVon:kDYa2
                                                              MD5:5692162977B015E31D5F35F50EFAB9CF
                                                              SHA1:705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
                                                              SHA-256:42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
                                                              SHA-512:32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
                                                              Malicious:false
                                                              Preview:edgeSettings_2.0-0

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3581
                                                              Entropy (8bit):4.459693941095613
                                                              Encrypted:false
                                                              SSDEEP:96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
                                                              MD5:BDE38FAE28EC415384B8CFE052306D6C
                                                              SHA1:3019740AF622B58D573C00BF5C98DD77F3FBB5CD
                                                              SHA-256:1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
                                                              SHA-512:9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
                                                              Malicious:false
                                                              Preview:{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):47
                                                              Entropy (8bit):4.493433469104717
                                                              Encrypted:false
                                                              SSDEEP:3:kfKbQSQSuLA5:kyUc5
                                                              MD5:3F90757B200B52DCF5FDAC696EFD3D60
                                                              SHA1:569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
                                                              SHA-256:1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
                                                              SHA-512:39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
                                                              Malicious:false
                                                              Preview:synchronousLookupUris_636976985063396749.rel.v2

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):35302
                                                              Entropy (8bit):7.99333285466604
                                                              Encrypted:true
                                                              SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                              MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                              SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                              SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                              SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                              Malicious:false
                                                              Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):50
                                                              Entropy (8bit):3.9904355005135823
                                                              Encrypted:false
                                                              SSDEEP:3:0xXF/XctY5GUf+:0RFeUf+
                                                              MD5:E144AFBFB9EE10479AE2A9437D3FC9CA
                                                              SHA1:5AAAC173107C688C06944D746394C21535B0514B
                                                              SHA-256:EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
                                                              SHA-512:837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
                                                              Malicious:false
                                                              Preview:topTraffic_170540185939602997400506234197983529371

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):575056
                                                              Entropy (8bit):7.999649474060713
                                                              Encrypted:true
                                                              SSDEEP:12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
                                                              MD5:BE5D1A12C1644421F877787F8E76642D
                                                              SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                                                              SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                                                              SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                                                              Malicious:false
                                                              Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):86
                                                              Entropy (8bit):4.389669793590032
                                                              Encrypted:false
                                                              SSDEEP:3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
                                                              MD5:03B6D5E81A4DC4D4E6C27BE1E932B9D9
                                                              SHA1:3C5EF0615314BDB136AB57C90359F1839BDD5C93
                                                              SHA-256:73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
                                                              SHA-512:0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
                                                              Malicious:false
                                                              Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\abc62594-fb01-4572-9543-f22f7c80a246.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):25108
                                                              Entropy (8bit):6.0321217555501105
                                                              Encrypted:false
                                                              SSDEEP:768:kM7X2zt1jKYqHkZez1lkgc908p34R836kJt6j:kMSzvKYqs414z36ct6j
                                                              MD5:48E184E772195011C5CF09423AD7F029
                                                              SHA1:5D33DBE7EAE0FDC20E0967639565D1ABDEA4B382
                                                              SHA-256:D6ABFB6F22A0694A49E9F9FCBBCE926C17A069A3477BD10565B71A2066E218EE
                                                              SHA-512:79EBADC143FD43E9C7F9E6F1E9799F609E01A5FDE0D0A7098CF74B428FF4A2BC73538E156BAAE87A56A602683727AEE8F81C8A0673832F136E018AD4D643A4A2
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13368940198947288","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\aebbae80-c229-405f-a37b-cc3260996437.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):8337
                                                              Entropy (8bit):5.78985212061845
                                                              Encrypted:false
                                                              SSDEEP:192:fsNwnaeiRUgBjfkpd6qRAq1k8SPxVLZ7VTiQ:fsNwg1l8pd6q3QxVNZTiQ
                                                              MD5:3244F9FD81D6AF3499519044A1582A7D
                                                              SHA1:B226C810FB1EAE4C7D9174633F0F6EE840C9290B
                                                              SHA-256:3A03D9809B2D042BD1C1179CDA1F2F8C69F2308FDBFDD2D0C36CC053C385A0F7
                                                              SHA-512:3DA39C03B9D524175A43B7C463B47797B64BEDA8337D8B2CF1ACAE4602E12216A63F0BEB2B2B08954C4ACEDD1CBB1B89DAA3AB03A049EAB9773DFF259E3BB567
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d00999b1-e34d-427d-8eea-934fc7359423.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):25159
                                                              Entropy (8bit):6.031309782744574
                                                              Encrypted:false
                                                              SSDEEP:768:kM7X2zt1jKYqHkZezklkgc908p34R836kJt6j:kMSzvKYqs4k4z36ct6j
                                                              MD5:5B6E01FDF0EAD6C7CDAB25B0273A5279
                                                              SHA1:4B48B7DAF2C07A8E915540C499BAAC4264A3EB5D
                                                              SHA-256:F865CB582B03888E31516BADEACA0FE8068CE0FB11AC0E65B86C882316B811DA
                                                              SHA-512:34304478E357F50EA1BE38527C24319DEEA5FF1036BF9E7E792716C41C04065083E11795DB0B3D1DF788FB3D9193149261D25099155BC3DD6ECC096F303A0E29
                                                              Malicious:false
                                                              Preview:{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13368940198947288","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dd34d852-484f-4756-be56-56b2900e79e1.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):8090
                                                              Entropy (8bit):5.811546497936802
                                                              Encrypted:false
                                                              SSDEEP:192:asNAnaeiRUvsQUkpRd6qRAq1k8SPxVLZ7VTiq:asNAgKhvpRd6q3QxVNZTiq
                                                              MD5:C1F018337E8FA9B530EDB2426BE3CD94
                                                              SHA1:094B53A4C14CA274197BE85F6C76578D37C033DE
                                                              SHA-256:2F751DB7CBE0F802550316A407C14D21886F2A5A4A9F11D0E3751A721D96BC21
                                                              SHA-512:767AE923A0DAE8352074C143DF691A59EF017985FB579A522B0ABC61DEA7C7067DB6A45A671163D2C6FFF1F9B9E6A07EE7C36017F53D7CEE61F6EA91181E2344
                                                              Malicious:false
                                                              Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

                                                              C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):2278
                                                              Entropy (8bit):3.8536148193991164
                                                              Encrypted:false
                                                              SSDEEP:48:uiTrlKxrgxFxl9Il8uPOY4Y7aJZ5q+p2MC7ExNd1rc:mgYc47EtYMMEc
                                                              MD5:1F25EC1409951BE6F0D2DFFCDF390868
                                                              SHA1:E44D8F1F2B4852A763F29D4354D04FF88A22D1C2
                                                              SHA-256:E5E18432F03AEA03FD69681EC089882FDA47FFC552ECB054203C784F3056DB7D
                                                              SHA-512:E7F9640A501F5357721D98835E03F0CCBEECD0559A197BE37A119C0988CC3B198A6C12AC904A8C725739C2773482740FDC93CFD6900E4777FD5A5BCF88D7FB98
                                                              Malicious:false
                                                              Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.L.O.5.t.X.1.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.i.6.p.R.y.e.

                                                              C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):4622
                                                              Entropy (8bit):4.001079640629875
                                                              Encrypted:false
                                                              SSDEEP:96:zYc003di9g5xBpxW+YSK0ei9d9hRMyT4XrxW+cO7S07Q:zbvLBW7etH932rxW+cOO07Q
                                                              MD5:2B2A369FD579E8FFCE52108760074502
                                                              SHA1:DA96178BDAD28B1666692EAB3DF192CDAB565063
                                                              SHA-256:F3BEC631DE787E608766A42ED38C1D2F334002276496978041F7ADA00A5D5EC6
                                                              SHA-512:62CAA0B6050EDBBFC77734BFD6D306160CFD7329574C05C4B1612119769C568923AD79BA974D46FF5CDB968FFC56D6142F4B642E43E6CDF09B7BD30DCF63DCBA
                                                              Malicious:false
                                                              Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.9.q.2.z.M.3.1.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.i.6.p.R.y.e.

                                                              C:\Users\user\AppData\Local\Temp\5849dbd1-39b8-42fd-a6e2-4dce1359a9c8.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Google Chrome extension, version 3
                                                              Category:dropped
                                                              Size (bytes):11185
                                                              Entropy (8bit):7.951995436832936
                                                              Encrypted:false
                                                              SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                              MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                              SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                              SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                              SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                              Malicious:false
                                                              Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                              C:\Users\user\AppData\Local\Temp\669b0d3c-cb9a-46fd-95a9-bdbafb3c4e8e.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
                                                              Category:dropped
                                                              Size (bytes):206855
                                                              Entropy (8bit):7.983996634657522
                                                              Encrypted:false
                                                              SSDEEP:3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
                                                              MD5:788DF0376CE061534448AA17288FEA95
                                                              SHA1:C3B9285574587B3D1950EE4A8D64145E93842AEB
                                                              SHA-256:B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
                                                              SHA-512:3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
                                                              Malicious:false
                                                              Preview:......Exif..II*.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..*B.P..*(.................*.....................( ..................*.. .".... .".......(.. .".....*.. ....o......E.6... ..*..."........."J......Ah......@.@@....:@{6..wCp..3...((.(......................*...@..(...."....................*......*.. ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

                                                              C:\Users\user\AppData\Local\Temp\861bf73e-060c-4308-86dd-829e165488c4.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:L:L
                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                              Malicious:false
                                                              Preview:.

                                                              C:\Users\user\AppData\Local\Temp\abbb5e39-708d-4609-96da-c70270c41583.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:L:L
                                                              MD5:5058F1AF8388633F609CADB75A75DC9D
                                                              SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                              SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                              SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                              Malicious:false
                                                              Preview:.

                                                              C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):353
                                                              Entropy (8bit):5.337202897449155
                                                              Encrypted:false
                                                              SSDEEP:6:YElVenOqpJ56s/ulVeRjRjm+HJpQJjDrwv/ulVe8TKq0TL56s/C:YVdP56s/brq4v0Dkv/b8+XL56s/C
                                                              MD5:2FDE1875C48BDFC934F71ADBF57B9FF4
                                                              SHA1:DC9376CB610FBE27614F21BC7FC00918A51648D3
                                                              SHA-256:5E791F49A5C555E6B51DB6DEA82BDB17A64B3FC6CA8DB5F0EA553D57F1BCD6C9
                                                              SHA-512:EE52B187F0D727E7EC25F87E1CB5B3F30239D9355CD62D83271204C3416B90F3D3FAC3506BAC1DBAAAFFBE4CF888F5204352F54227947160B49A8994151A60E7
                                                              Malicious:false
                                                              Preview:{"logTime": "0824/023003", "correlationVector":"WQl5VTykWTo6TjO4JUbSir","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0824/023003", "correlationVector":"74F6831D2F4F4434B59C7DFB5A7A570C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0824/023003", "correlationVector":"293Pjiwc74qJFstXUvBKqF","action":"EXTENSION_UPDATER", "result":""}.

                                                              C:\Users\user\AppData\Local\Temp\d10af106-df2d-40a8-bff2-302a4ef8a02c.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Google Chrome extension, version 3
                                                              Category:dropped
                                                              Size (bytes):135751
                                                              Entropy (8bit):7.804610863392373
                                                              Encrypted:false
                                                              SSDEEP:1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
                                                              MD5:83EF25FBEE6866A64F09323BFE1536E0
                                                              SHA1:24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
                                                              SHA-256:F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
                                                              SHA-512:C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
                                                              Malicious:false
                                                              Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7..*.Kk?....]<.S(.....9}........$..6...:...9..b|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]..*..-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

                                                              C:\Users\user\AppData\Local\Temp\e137d4fb-3b34-4a72-bb86-88a38e4aae64.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41902
                                                              Category:dropped
                                                              Size (bytes):76319
                                                              Entropy (8bit):7.996132588300074
                                                              Encrypted:true
                                                              SSDEEP:1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6w6DLZ8:GdS8scZNzFrMa4M+lK5/nEDd8
                                                              MD5:24439F0E82F6A60E541FB2697F02043F
                                                              SHA1:E3FAA84B0ED8CDD2268D53A0ECC6F3134D5EBD8F
                                                              SHA-256:B24DD5C374F8BB381A48605D183B6590245EE802C65F643632A3BE9BB1F313C5
                                                              SHA-512:8FD794657A9F80FDBC2350DC26A2C82DFD82266B934A4472B3319FDB870841C832137D4F5CE41D518859B8B1DA63031C6B7E750D301F87D6ECA45B958B147FCD
                                                              Malicious:false
                                                              Preview:...........m{..(.}...7.\...N.D*.w..m..q....%XfL.*I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'.*.."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g.*.^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

                                                              C:\Users\user\AppData\Local\Temp\fc1c68ab-2dcd-49fc-a7a8-b27609ddfa59.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 910234
                                                              Category:dropped
                                                              Size (bytes):481532
                                                              Entropy (8bit):7.9982605587449
                                                              Encrypted:true
                                                              SSDEEP:12288:xqhVKJJ50Ccg3cb1UfUl/cFu9BzK6of3gHRiW4jO6:xqhVKJ0P51gUeFu3GaG1
                                                              MD5:1629D92C89A027AF62A70EA3F091FA21
                                                              SHA1:320AB921C91EC19A784AFCDC853B7EBF04600AFA
                                                              SHA-256:F1E80336D3784742935613C857E1F4BF9245049BB3007183DB352ED6CE89C21C
                                                              SHA-512:8D4E7C1648BE24C4382E79CEEE9CB51C1BD4B031B084C1756F058014A353952021102C637B74F60549F621092810BF11B4D098C5D43E79C508E53AEDCCFEFCF2
                                                              Malicious:false
                                                              Preview:............o.6.........I....d[.z.6l.=...dIV...q..0...Iyk.C..8.R...v\7.....u..'..r...=.w..W.}..V_....W7......~..........<..f.-.O...l....a.../....l.m.e..kv.Y.n...~......}...ww..uSt.U..o.O...G..4w..|...........]]..y../..W.n...........".y..WB.2*C.7..W.4.....M...I..\&.($...."'....Y.e..o.7y.K.......oZ2.?..qW.O.$.............<.kV`2)G..%,...2.."Q..M.....}g.M`qa.x.Z_....N"......~.~.....;..4.....XEX...B0.Q=.'...z.,.|.>.5..W.6..$\RaT.&.m.%.b.2.....5#[..\...z.j.j|......~RN....@p.C.1.j.}..}..Z..Co'.i.%.TZ...O=%.`.J+............Y|.....mp.6...;v...l?...!..?"Q....a....'.8...)..)7..N...B.8...Yj.?..........V../...g....C..i.....IN...P..P.@.....N..u/...FJ.A<N<..gD. #..6....N.F.....C......4..........?R@.K../-%..P...|.././.o..?#K......%..=.8;........J..............6"..2.........jI....A..W.3......[.....$...>.%iJ..g..A...._....B.>.r...G.5.....$.P[.....J..r.y.4.KE.Lj/)i".w..Ig./.k?.....l../Z.f......"|%.-..T.....).l."Q..j*>%..E.J6...l...^.f.=`%./.l......7$D

                                                              C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                              Category:dropped
                                                              Size (bytes):32768
                                                              Entropy (8bit):0.4593089050301797
                                                              Encrypted:false
                                                              SSDEEP:48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
                                                              MD5:D910AD167F0217587501FDCDB33CC544
                                                              SHA1:2F57441CEFDC781011B53C1C5D29AC54835AFC1D
                                                              SHA-256:E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
                                                              SHA-512:F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
                                                              Malicious:false
                                                              Preview:... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\128.png

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                              Category:dropped
                                                              Size (bytes):4982
                                                              Entropy (8bit):7.929761711048726
                                                              Encrypted:false
                                                              SSDEEP:96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
                                                              MD5:913064ADAAA4C4FA2A9D011B66B33183
                                                              SHA1:99EA751AC2597A080706C690612AEEEE43161FC1
                                                              SHA-256:AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
                                                              SHA-512:162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
                                                              Malicious:false
                                                              Preview:.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb*..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...*T.P.B...*Tx...=.Q..wv.w.....|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......|..}./.....e..,.K.1........W.u.v. ...\.o

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\af\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):908
                                                              Entropy (8bit):4.512512697156616
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
                                                              MD5:12403EBCCE3AE8287A9E823C0256D205
                                                              SHA1:C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
                                                              SHA-256:B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
                                                              SHA-512:153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\am\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1285
                                                              Entropy (8bit):4.702209356847184
                                                              Encrypted:false
                                                              SSDEEP:24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
                                                              MD5:9721EBCE89EC51EB2BAEB4159E2E4D8C
                                                              SHA1:58979859B28513608626B563138097DC19236F1F
                                                              SHA-256:3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
                                                              SHA-512:FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ar\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1244
                                                              Entropy (8bit):4.5533961615623735
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
                                                              MD5:3EC93EA8F8422FDA079F8E5B3F386A73
                                                              SHA1:24640131CCFB21D9BC3373C0661DA02D50350C15
                                                              SHA-256:ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
                                                              SHA-512:F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\az\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):977
                                                              Entropy (8bit):4.867640976960053
                                                              Encrypted:false
                                                              SSDEEP:24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
                                                              MD5:9A798FD298008074E59ECC253E2F2933
                                                              SHA1:1E93DA985E880F3D3350FC94F5CCC498EFC8C813
                                                              SHA-256:628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
                                                              SHA-512:9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\be\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3107
                                                              Entropy (8bit):3.535189746470889
                                                              Encrypted:false
                                                              SSDEEP:48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
                                                              MD5:68884DFDA320B85F9FC5244C2DD00568
                                                              SHA1:FD9C01E03320560CBBB91DC3D1917C96D792A549
                                                              SHA-256:DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
                                                              SHA-512:7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\bg\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1389
                                                              Entropy (8bit):4.561317517930672
                                                              Encrypted:false
                                                              SSDEEP:24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
                                                              MD5:2E6423F38E148AC5A5A041B1D5989CC0
                                                              SHA1:88966FFE39510C06CD9F710DFAC8545672FFDCEB
                                                              SHA-256:AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
                                                              SHA-512:891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\bn\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1763
                                                              Entropy (8bit):4.25392954144533
                                                              Encrypted:false
                                                              SSDEEP:24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
                                                              MD5:651375C6AF22E2BCD228347A45E3C2C9
                                                              SHA1:109AC3A912326171D77869854D7300385F6E628C
                                                              SHA-256:1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
                                                              SHA-512:958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ca\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):930
                                                              Entropy (8bit):4.569672473374877
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
                                                              MD5:D177261FFE5F8AB4B3796D26835F8331
                                                              SHA1:4BE708E2FFE0F018AC183003B74353AD646C1657
                                                              SHA-256:D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
                                                              SHA-512:E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\cs\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):913
                                                              Entropy (8bit):4.947221919047
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
                                                              MD5:CCB00C63E4814F7C46B06E4A142F2DE9
                                                              SHA1:860936B2A500CE09498B07A457E0CCA6B69C5C23
                                                              SHA-256:21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
                                                              SHA-512:35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\cy\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):806
                                                              Entropy (8bit):4.815663786215102
                                                              Encrypted:false
                                                              SSDEEP:12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
                                                              MD5:A86407C6F20818972B80B9384ACFBBED
                                                              SHA1:D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
                                                              SHA-256:A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
                                                              SHA-512:D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\da\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):883
                                                              Entropy (8bit):4.5096240460083905
                                                              Encrypted:false
                                                              SSDEEP:24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
                                                              MD5:B922F7FD0E8CCAC31B411FC26542C5BA
                                                              SHA1:2D25E153983E311E44A3A348B7D97AF9AAD21A30
                                                              SHA-256:48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
                                                              SHA-512:AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\de\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1031
                                                              Entropy (8bit):4.621865814402898
                                                              Encrypted:false
                                                              SSDEEP:24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
                                                              MD5:D116453277CC860D196887CEC6432FFE
                                                              SHA1:0AE00288FDE696795CC62FD36EABC507AB6F4EA4
                                                              SHA-256:36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
                                                              SHA-512:C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\el\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1613
                                                              Entropy (8bit):4.618182455684241
                                                              Encrypted:false
                                                              SSDEEP:24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
                                                              MD5:9ABA4337C670C6349BA38FDDC27C2106
                                                              SHA1:1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
                                                              SHA-256:37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
                                                              SHA-512:8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\en\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):851
                                                              Entropy (8bit):4.4858053753176526
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                              MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                              SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                              SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                              SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\en_CA\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):851
                                                              Entropy (8bit):4.4858053753176526
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
                                                              MD5:07FFBE5F24CA348723FF8C6C488ABFB8
                                                              SHA1:6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
                                                              SHA-256:6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
                                                              SHA-512:7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\en_GB\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):848
                                                              Entropy (8bit):4.494568170878587
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
                                                              MD5:3734D498FB377CF5E4E2508B8131C0FA
                                                              SHA1:AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
                                                              SHA-256:AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
                                                              SHA-512:56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\en_US\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1425
                                                              Entropy (8bit):4.461560329690825
                                                              Encrypted:false
                                                              SSDEEP:24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
                                                              MD5:578215FBB8C12CB7E6CD73FBD16EC994
                                                              SHA1:9471D71FA6D82CE1863B74E24237AD4FD9477187
                                                              SHA-256:102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
                                                              SHA-512:E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
                                                              Malicious:false
                                                              Preview:{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\es\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):961
                                                              Entropy (8bit):4.537633413451255
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
                                                              MD5:F61916A206AC0E971CDCB63B29E580E3
                                                              SHA1:994B8C985DC1E161655D6E553146FB84D0030619
                                                              SHA-256:2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
                                                              SHA-512:D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\es_419\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):959
                                                              Entropy (8bit):4.570019855018913
                                                              Encrypted:false
                                                              SSDEEP:24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
                                                              MD5:535331F8FB98894877811B14994FEA9D
                                                              SHA1:42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
                                                              SHA-256:90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
                                                              SHA-512:2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\et\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):968
                                                              Entropy (8bit):4.633956349931516
                                                              Encrypted:false
                                                              SSDEEP:24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
                                                              MD5:64204786E7A7C1ED9C241F1C59B81007
                                                              SHA1:586528E87CD670249A44FB9C54B1796E40CDB794
                                                              SHA-256:CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
                                                              SHA-512:44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\eu\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):838
                                                              Entropy (8bit):4.4975520913636595
                                                              Encrypted:false
                                                              SSDEEP:24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
                                                              MD5:29A1DA4ACB4C9D04F080BB101E204E93
                                                              SHA1:2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
                                                              SHA-256:A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
                                                              SHA-512:B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\fa\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1305
                                                              Entropy (8bit):4.673517697192589
                                                              Encrypted:false
                                                              SSDEEP:24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
                                                              MD5:097F3BA8DE41A0AAF436C783DCFE7EF3
                                                              SHA1:986B8CABD794E08C7AD41F0F35C93E4824AC84DF
                                                              SHA-256:7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
                                                              SHA-512:8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\fi\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):911
                                                              Entropy (8bit):4.6294343834070935
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
                                                              MD5:B38CBD6C2C5BFAA6EE252D573A0B12A1
                                                              SHA1:2E490D5A4942D2455C3E751F96BD9960F93C4B60
                                                              SHA-256:2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
                                                              SHA-512:6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\fil\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):939
                                                              Entropy (8bit):4.451724169062555
                                                              Encrypted:false
                                                              SSDEEP:24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
                                                              MD5:FCEA43D62605860FFF41BE26BAD80169
                                                              SHA1:F25C2CE893D65666CC46EA267E3D1AA080A25F5B
                                                              SHA-256:F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
                                                              SHA-512:F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\fr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):977
                                                              Entropy (8bit):4.622066056638277
                                                              Encrypted:false
                                                              SSDEEP:24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
                                                              MD5:A58C0EEBD5DC6BB5D91DAF923BD3A2AA
                                                              SHA1:F169870EEED333363950D0BCD5A46D712231E2AE
                                                              SHA-256:0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
                                                              SHA-512:B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\fr_CA\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):972
                                                              Entropy (8bit):4.621319511196614
                                                              Encrypted:false
                                                              SSDEEP:24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
                                                              MD5:6CAC04BDCC09034981B4AB567B00C296
                                                              SHA1:84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
                                                              SHA-256:4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
                                                              SHA-512:160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\gl\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):990
                                                              Entropy (8bit):4.497202347098541
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
                                                              MD5:6BAAFEE2F718BEFBC7CD58A04CCC6C92
                                                              SHA1:CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
                                                              SHA-256:0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
                                                              SHA-512:3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\gu\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1658
                                                              Entropy (8bit):4.294833932445159
                                                              Encrypted:false
                                                              SSDEEP:24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
                                                              MD5:BC7E1D09028B085B74CB4E04D8A90814
                                                              SHA1:E28B2919F000B41B41209E56B7BF3A4448456CFE
                                                              SHA-256:FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
                                                              SHA-512:040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\hi\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1672
                                                              Entropy (8bit):4.314484457325167
                                                              Encrypted:false
                                                              SSDEEP:48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
                                                              MD5:98A7FC3E2E05AFFFC1CFE4A029F47476
                                                              SHA1:A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
                                                              SHA-256:D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
                                                              SHA-512:457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\hr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):935
                                                              Entropy (8bit):4.6369398601609735
                                                              Encrypted:false
                                                              SSDEEP:24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
                                                              MD5:25CDFF9D60C5FC4740A48EF9804BF5C7
                                                              SHA1:4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
                                                              SHA-256:73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
                                                              SHA-512:EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\hu\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1065
                                                              Entropy (8bit):4.816501737523951
                                                              Encrypted:false
                                                              SSDEEP:24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
                                                              MD5:8930A51E3ACE3DD897C9E61A2AEA1D02
                                                              SHA1:4108506500C68C054BA03310C49FA5B8EE246EA4
                                                              SHA-256:958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
                                                              SHA-512:126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\hy\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2771
                                                              Entropy (8bit):3.7629875118570055
                                                              Encrypted:false
                                                              SSDEEP:48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
                                                              MD5:55DE859AD778E0AA9D950EF505B29DA9
                                                              SHA1:4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
                                                              SHA-256:0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
                                                              SHA-512:EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\id\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):858
                                                              Entropy (8bit):4.474411340525479
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
                                                              MD5:34D6EE258AF9429465AE6A078C2FB1F5
                                                              SHA1:612CAE151984449A4346A66C0A0DF4235D64D932
                                                              SHA-256:E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
                                                              SHA-512:20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\is\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):954
                                                              Entropy (8bit):4.631887382471946
                                                              Encrypted:false
                                                              SSDEEP:12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
                                                              MD5:1F565FB1C549B18AF8BBFED8DECD5D94
                                                              SHA1:B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
                                                              SHA-256:E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
                                                              SHA-512:A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\it\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):899
                                                              Entropy (8bit):4.474743599345443
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
                                                              MD5:0D82B734EF045D5FE7AA680B6A12E711
                                                              SHA1:BD04F181E4EE09F02CD53161DCABCEF902423092
                                                              SHA-256:F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
                                                              SHA-512:01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\iw\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2230
                                                              Entropy (8bit):3.8239097369647634
                                                              Encrypted:false
                                                              SSDEEP:24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
                                                              MD5:26B1533C0852EE4661EC1A27BD87D6BF
                                                              SHA1:18234E3ABAF702DF9330552780C2F33B83A1188A
                                                              SHA-256:BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
                                                              SHA-512:450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ja\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1160
                                                              Entropy (8bit):5.292894989863142
                                                              Encrypted:false
                                                              SSDEEP:24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
                                                              MD5:15EC1963FC113D4AD6E7E59AE5DE7C0A
                                                              SHA1:4017FC6D8B302335469091B91D063B07C9E12109
                                                              SHA-256:34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
                                                              SHA-512:427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ka\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3264
                                                              Entropy (8bit):3.586016059431306
                                                              Encrypted:false
                                                              SSDEEP:48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
                                                              MD5:83F81D30913DC4344573D7A58BD20D85
                                                              SHA1:5AD0E91EA18045232A8F9DF1627007FE506A70E0
                                                              SHA-256:30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
                                                              SHA-512:85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\kk\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3235
                                                              Entropy (8bit):3.6081439490236464
                                                              Encrypted:false
                                                              SSDEEP:96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
                                                              MD5:2D94A58795F7B1E6E43C9656A147AD3C
                                                              SHA1:E377DB505C6924B6BFC9D73DC7C02610062F674E
                                                              SHA-256:548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
                                                              SHA-512:F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\km\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3122
                                                              Entropy (8bit):3.891443295908904
                                                              Encrypted:false
                                                              SSDEEP:96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
                                                              MD5:B3699C20A94776A5C2F90AEF6EB0DAD9
                                                              SHA1:1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
                                                              SHA-256:A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
                                                              SHA-512:1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\kn\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1880
                                                              Entropy (8bit):4.295185867329351
                                                              Encrypted:false
                                                              SSDEEP:48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
                                                              MD5:8E16966E815C3C274EEB8492B1EA6648
                                                              SHA1:7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
                                                              SHA-256:418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
                                                              SHA-512:85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ko\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1042
                                                              Entropy (8bit):5.3945675025513955
                                                              Encrypted:false
                                                              SSDEEP:24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
                                                              MD5:F3E59EEEB007144EA26306C20E04C292
                                                              SHA1:83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
                                                              SHA-256:C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
                                                              SHA-512:7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\lo\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2535
                                                              Entropy (8bit):3.8479764584971368
                                                              Encrypted:false
                                                              SSDEEP:48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
                                                              MD5:E20D6C27840B406555E2F5091B118FC5
                                                              SHA1:0DCECC1A58CEB4936E255A64A2830956BFA6EC14
                                                              SHA-256:89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
                                                              SHA-512:AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\lt\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1028
                                                              Entropy (8bit):4.797571191712988
                                                              Encrypted:false
                                                              SSDEEP:24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
                                                              MD5:970544AB4622701FFDF66DC556847652
                                                              SHA1:14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
                                                              SHA-256:5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
                                                              SHA-512:CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\lv\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):994
                                                              Entropy (8bit):4.700308832360794
                                                              Encrypted:false
                                                              SSDEEP:24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
                                                              MD5:A568A58817375590007D1B8ABCAEBF82
                                                              SHA1:B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
                                                              SHA-256:0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
                                                              SHA-512:FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ml\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2091
                                                              Entropy (8bit):4.358252286391144
                                                              Encrypted:false
                                                              SSDEEP:24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
                                                              MD5:4717EFE4651F94EFF6ACB6653E868D1A
                                                              SHA1:B8A7703152767FBE1819808876D09D9CC1C44450
                                                              SHA-256:22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
                                                              SHA-512:487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\mn\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2778
                                                              Entropy (8bit):3.595196082412897
                                                              Encrypted:false
                                                              SSDEEP:48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
                                                              MD5:83E7A14B7FC60D4C66BF313C8A2BEF0B
                                                              SHA1:1CCF1D79CDED5D65439266DB58480089CC110B18
                                                              SHA-256:613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
                                                              SHA-512:3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\mr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1719
                                                              Entropy (8bit):4.287702203591075
                                                              Encrypted:false
                                                              SSDEEP:48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
                                                              MD5:3B98C4ED8874A160C3789FEAD5553CFA
                                                              SHA1:5550D0EC548335293D962AAA96B6443DD8ABB9F6
                                                              SHA-256:ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
                                                              SHA-512:5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ms\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):936
                                                              Entropy (8bit):4.457879437756106
                                                              Encrypted:false
                                                              SSDEEP:24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
                                                              MD5:7D273824B1E22426C033FF5D8D7162B7
                                                              SHA1:EADBE9DBE5519BD60458B3551BDFC36A10049DD1
                                                              SHA-256:2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
                                                              SHA-512:E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\my\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):3830
                                                              Entropy (8bit):3.5483353063347587
                                                              Encrypted:false
                                                              SSDEEP:48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
                                                              MD5:342335A22F1886B8BC92008597326B24
                                                              SHA1:2CB04F892E430DCD7705C02BF0A8619354515513
                                                              SHA-256:243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
                                                              SHA-512:CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ne\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1898
                                                              Entropy (8bit):4.187050294267571
                                                              Encrypted:false
                                                              SSDEEP:24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
                                                              MD5:B1083DA5EC718D1F2F093BD3D1FB4F37
                                                              SHA1:74B6F050D918448396642765DEF1AD5390AB5282
                                                              SHA-256:E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
                                                              SHA-512:7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\nl\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):914
                                                              Entropy (8bit):4.513485418448461
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
                                                              MD5:32DF72F14BE59A9BC9777113A8B21DE6
                                                              SHA1:2A8D9B9A998453144307DD0B700A76E783062AD0
                                                              SHA-256:F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
                                                              SHA-512:E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\no\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):878
                                                              Entropy (8bit):4.4541485835627475
                                                              Encrypted:false
                                                              SSDEEP:24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
                                                              MD5:A1744B0F53CCF889955B95108367F9C8
                                                              SHA1:6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
                                                              SHA-256:21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
                                                              SHA-512:F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\pa\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2766
                                                              Entropy (8bit):3.839730779948262
                                                              Encrypted:false
                                                              SSDEEP:48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
                                                              MD5:97F769F51B83D35C260D1F8CFD7990AF
                                                              SHA1:0D59A76564B0AEE31D0A074305905472F740CECA
                                                              SHA-256:BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
                                                              SHA-512:D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\pl\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):978
                                                              Entropy (8bit):4.879137540019932
                                                              Encrypted:false
                                                              SSDEEP:24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
                                                              MD5:B8D55E4E3B9619784AECA61BA15C9C0F
                                                              SHA1:B4A9C9885FBEB78635957296FDDD12579FEFA033
                                                              SHA-256:E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
                                                              SHA-512:266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\pt_BR\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):907
                                                              Entropy (8bit):4.599411354657937
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
                                                              MD5:608551F7026E6BA8C0CF85D9AC11F8E3
                                                              SHA1:87B017B2D4DA17E322AF6384F82B57B807628617
                                                              SHA-256:A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
                                                              SHA-512:82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\pt_PT\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):914
                                                              Entropy (8bit):4.604761241355716
                                                              Encrypted:false
                                                              SSDEEP:24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
                                                              MD5:0963F2F3641A62A78B02825F6FA3941C
                                                              SHA1:7E6972BEAB3D18E49857079A24FB9336BC4D2D48
                                                              SHA-256:E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
                                                              SHA-512:22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ro\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):937
                                                              Entropy (8bit):4.686555713975264
                                                              Encrypted:false
                                                              SSDEEP:24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
                                                              MD5:BED8332AB788098D276B448EC2B33351
                                                              SHA1:6084124A2B32F386967DA980CBE79DD86742859E
                                                              SHA-256:085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
                                                              SHA-512:22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ru\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1337
                                                              Entropy (8bit):4.69531415794894
                                                              Encrypted:false
                                                              SSDEEP:24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
                                                              MD5:51D34FE303D0C90EE409A2397FCA437D
                                                              SHA1:B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
                                                              SHA-256:BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
                                                              SHA-512:E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\si\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2846
                                                              Entropy (8bit):3.7416822879702547
                                                              Encrypted:false
                                                              SSDEEP:48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
                                                              MD5:B8A4FD612534A171A9A03C1984BB4BDD
                                                              SHA1:F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
                                                              SHA-256:54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
                                                              SHA-512:C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\sk\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):934
                                                              Entropy (8bit):4.882122893545996
                                                              Encrypted:false
                                                              SSDEEP:24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
                                                              MD5:8E55817BF7A87052F11FE554A61C52D5
                                                              SHA1:9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
                                                              SHA-256:903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
                                                              SHA-512:EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\sl\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):963
                                                              Entropy (8bit):4.6041913416245
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
                                                              MD5:BFAEFEFF32813DF91C56B71B79EC2AF4
                                                              SHA1:F8EDA2B632610972B581724D6B2F9782AC37377B
                                                              SHA-256:AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
                                                              SHA-512:971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\sr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1320
                                                              Entropy (8bit):4.569671329405572
                                                              Encrypted:false
                                                              SSDEEP:24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
                                                              MD5:7F5F8933D2D078618496C67526A2B066
                                                              SHA1:B7050E3EFA4D39548577CF47CB119FA0E246B7A4
                                                              SHA-256:4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
                                                              SHA-512:0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\sv\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):884
                                                              Entropy (8bit):4.627108704340797
                                                              Encrypted:false
                                                              SSDEEP:24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
                                                              MD5:90D8FB448CE9C0B9BA3D07FB8DE6D7EE
                                                              SHA1:D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
                                                              SHA-256:64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
                                                              SHA-512:6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\sw\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):980
                                                              Entropy (8bit):4.50673686618174
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
                                                              MD5:D0579209686889E079D87C23817EDDD5
                                                              SHA1:C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
                                                              SHA-256:0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
                                                              SHA-512:D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ta\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1941
                                                              Entropy (8bit):4.132139619026436
                                                              Encrypted:false
                                                              SSDEEP:24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
                                                              MD5:DCC0D1725AEAEAAF1690EF8053529601
                                                              SHA1:BB9D31859469760AC93E84B70B57909DCC02EA65
                                                              SHA-256:6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
                                                              SHA-512:6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\te\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1969
                                                              Entropy (8bit):4.327258153043599
                                                              Encrypted:false
                                                              SSDEEP:48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
                                                              MD5:385E65EF723F1C4018EEE6E4E56BC03F
                                                              SHA1:0CEA195638A403FD99BAEF88A360BD746C21DF42
                                                              SHA-256:026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
                                                              SHA-512:E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\th\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1674
                                                              Entropy (8bit):4.343724179386811
                                                              Encrypted:false
                                                              SSDEEP:48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
                                                              MD5:64077E3D186E585A8BEA86FF415AA19D
                                                              SHA1:73A861AC810DABB4CE63AD052E6E1834F8CA0E65
                                                              SHA-256:D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
                                                              SHA-512:56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\tr\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1063
                                                              Entropy (8bit):4.853399816115876
                                                              Encrypted:false
                                                              SSDEEP:24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
                                                              MD5:76B59AAACC7B469792694CF3855D3F4C
                                                              SHA1:7C04A2C1C808FA57057A4CCEEE66855251A3C231
                                                              SHA-256:B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
                                                              SHA-512:2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\uk\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1333
                                                              Entropy (8bit):4.686760246306605
                                                              Encrypted:false
                                                              SSDEEP:24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
                                                              MD5:970963C25C2CEF16BB6F60952E103105
                                                              SHA1:BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
                                                              SHA-256:9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
                                                              SHA-512:1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\ur\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1263
                                                              Entropy (8bit):4.861856182762435
                                                              Encrypted:false
                                                              SSDEEP:24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
                                                              MD5:8B4DF6A9281333341C939C244DDB7648
                                                              SHA1:382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
                                                              SHA-256:5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
                                                              SHA-512:FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\vi\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1074
                                                              Entropy (8bit):5.062722522759407
                                                              Encrypted:false
                                                              SSDEEP:24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
                                                              MD5:773A3B9E708D052D6CBAA6D55C8A5438
                                                              SHA1:5617235844595D5C73961A2C0A4AC66D8EA5F90F
                                                              SHA-256:597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
                                                              SHA-512:E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\zh_CN\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):879
                                                              Entropy (8bit):5.7905809868505544
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
                                                              MD5:3E76788E17E62FB49FB5ED5F4E7A3DCE
                                                              SHA1:6904FFA0D13D45496F126E58C886C35366EFCC11
                                                              SHA-256:E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
                                                              SHA-512:F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\zh_HK\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1205
                                                              Entropy (8bit):4.50367724745418
                                                              Encrypted:false
                                                              SSDEEP:24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
                                                              MD5:524E1B2A370D0E71342D05DDE3D3E774
                                                              SHA1:60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
                                                              SHA-256:30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
                                                              SHA-512:D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\zh_TW\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):843
                                                              Entropy (8bit):5.76581227215314
                                                              Encrypted:false
                                                              SSDEEP:12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
                                                              MD5:0E60627ACFD18F44D4DF469D8DCE6D30
                                                              SHA1:2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
                                                              SHA-256:F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
                                                              SHA-512:6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
                                                              Malicious:false
                                                              Preview:{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_locales\zu\messages.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):912
                                                              Entropy (8bit):4.65963951143349
                                                              Encrypted:false
                                                              SSDEEP:24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
                                                              MD5:71F916A64F98B6D1B5D1F62D297FDEC1
                                                              SHA1:9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
                                                              SHA-256:EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
                                                              SHA-512:30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
                                                              Malicious:false
                                                              Preview:{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\_metadata\verified_contents.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):11280
                                                              Entropy (8bit):5.754230909218899
                                                              Encrypted:false
                                                              SSDEEP:192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
                                                              MD5:BE5DB35513DDEF454CE3502B6418B9B4
                                                              SHA1:C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
                                                              SHA-256:C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
                                                              SHA-512:38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
                                                              Malicious:false
                                                              Preview:[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\dasherSettingSchema.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):854
                                                              Entropy (8bit):4.284628987131403
                                                              Encrypted:false
                                                              SSDEEP:12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
                                                              MD5:4EC1DF2DA46182103D2FFC3B92D20CA5
                                                              SHA1:FB9D1BA3710CF31A87165317C6EDC110E98994CE
                                                              SHA-256:6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
                                                              SHA-512:939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
                                                              Malicious:false
                                                              Preview:{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\manifest.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2525
                                                              Entropy (8bit):5.417689528134667
                                                              Encrypted:false
                                                              SSDEEP:24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
                                                              MD5:10FF8E5B674311683D27CE1879384954
                                                              SHA1:9C269C14E067BB86642EB9F4816D75CF1B9B9158
                                                              SHA-256:17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
                                                              SHA-512:4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
                                                              Malicious:false
                                                              Preview:{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/*", "https://drive.google.com/*", "https://drive-autopush.corp.google.com/*", "https://drive-daily-0.corp.google.com/*", "https://drive-daily-1.corp.google.com/*", "https://drive-daily-2.corp.google.com/*", "https://drive-daily-3.corp.google.com/*", "https://drive-daily-4.corp.google.com/*", "https://drive-daily-5.corp.google.com/*", "https://drive-daily-6.corp.google.com/*", "https://drive-preprod.corp.google.com/*", "https://drive-staging.corp.google.com/*" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\offscreendocument.html

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:HTML document, ASCII text
                                                              Category:dropped
                                                              Size (bytes):97
                                                              Entropy (8bit):4.862433271815736
                                                              Encrypted:false
                                                              SSDEEP:3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
                                                              MD5:B747B5922A0BC74BBF0A9BC59DF7685F
                                                              SHA1:7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
                                                              SHA-256:B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
                                                              SHA-512:7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
                                                              Malicious:false
                                                              Preview:<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\offscreendocument_main.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with very long lines (4369)
                                                              Category:dropped
                                                              Size (bytes):95567
                                                              Entropy (8bit):5.4016395763198135
                                                              Encrypted:false
                                                              SSDEEP:1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
                                                              MD5:09AF2D8CFA8BF1078101DA78D09C4174
                                                              SHA1:F2369551E2CDD86258062BEB0729EE4D93FCA050
                                                              SHA-256:39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
                                                              SHA-512:F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
                                                              Malicious:false
                                                              Preview:'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\page_embed_script.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):291
                                                              Entropy (8bit):4.65176400421739
                                                              Encrypted:false
                                                              SSDEEP:6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
                                                              MD5:3AB0CD0F493B1B185B42AD38AE2DD572
                                                              SHA1:079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
                                                              SHA-256:73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
                                                              SHA-512:32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
                                                              Malicious:false
                                                              Preview:(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\CRX_INSTALL\service_worker_bin_prod.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:ASCII text, with very long lines (4369)
                                                              Category:dropped
                                                              Size (bytes):103988
                                                              Entropy (8bit):5.389407461078688
                                                              Encrypted:false
                                                              SSDEEP:1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
                                                              MD5:EA946F110850F17E637B15CF22B82837
                                                              SHA1:8D27C963E76E3D2F5B8634EE66706F95F000FCAF
                                                              SHA-256:029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
                                                              SHA-512:5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
                                                              Malicious:false
                                                              Preview:'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_1409800423\d10af106-df2d-40a8-bff2-302a4ef8a02c.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Google Chrome extension, version 3
                                                              Category:dropped
                                                              Size (bytes):135751
                                                              Entropy (8bit):7.804610863392373
                                                              Encrypted:false
                                                              SSDEEP:1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
                                                              MD5:83EF25FBEE6866A64F09323BFE1536E0
                                                              SHA1:24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
                                                              SHA-256:F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
                                                              SHA-512:C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
                                                              Malicious:false
                                                              Preview:Cr24..............0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7..*.Kk?....]<.S(.....9}........$..6...:...9..b|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]..*..-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_264244536\5849dbd1-39b8-42fd-a6e2-4dce1359a9c8.tmp

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Google Chrome extension, version 3
                                                              Category:dropped
                                                              Size (bytes):11185
                                                              Entropy (8bit):7.951995436832936
                                                              Encrypted:false
                                                              SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                              MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                              SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                              SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                              SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                              Malicious:false
                                                              Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_264244536\CRX_INSTALL\_metadata\verified_contents.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):1753
                                                              Entropy (8bit):5.8889033066924155
                                                              Encrypted:false
                                                              SSDEEP:48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
                                                              MD5:738E757B92939B24CDBBD0EFC2601315
                                                              SHA1:77058CBAFA625AAFBEA867052136C11AD3332143
                                                              SHA-256:D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
                                                              SHA-512:DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
                                                              Malicious:false
                                                              Preview:[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_264244536\CRX_INSTALL\content.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
                                                              Category:dropped
                                                              Size (bytes):9815
                                                              Entropy (8bit):6.1716321262973315
                                                              Encrypted:false
                                                              SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
                                                              MD5:3D20584F7F6C8EAC79E17CCA4207FB79
                                                              SHA1:3C16DCC27AE52431C8CDD92FBAAB0341524D3092
                                                              SHA-256:0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
                                                              SHA-512:315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
                                                              Malicious:false
                                                              Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_264244536\CRX_INSTALL\content_new.js

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
                                                              Category:dropped
                                                              Size (bytes):10388
                                                              Entropy (8bit):6.174387413738973
                                                              Encrypted:false
                                                              SSDEEP:192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
                                                              MD5:3DE1E7D989C232FC1B58F4E32DE15D64
                                                              SHA1:42B152EA7E7F31A964914F344543B8BF14B5F558
                                                              SHA-256:D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
                                                              SHA-512:177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
                                                              Malicious:false
                                                              Preview:(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

                                                              C:\Users\user\AppData\Local\Temp\scoped_dir3444_264244536\CRX_INSTALL\manifest.json

                                                              Download File
                                                              Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):962
                                                              Entropy (8bit):5.698567446030411
                                                              Encrypted:false
                                                              SSDEEP:24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
                                                              MD5:E805E9E69FD6ECDCA65136957B1FB3BE
                                                              SHA1:2356F60884130C86A45D4B232A26062C7830E622
                                                              SHA-256:5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
                                                              SHA-512:049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
                                                              Malicious:false
                                                              Preview:{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/*" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/*" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

                                                              C:\Users\user\AppData\Local\Temp\tmpaddon

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                              Category:dropped
                                                              Size (bytes):453023
                                                              Entropy (8bit):7.997718157581587
                                                              Encrypted:true
                                                              SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
                                                              MD5:85430BAED3398695717B0263807CF97C
                                                              SHA1:FFFBEE923CEA216F50FCE5D54219A188A5100F41
                                                              SHA-256:A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
                                                              SHA-512:06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
                                                              Malicious:false
                                                              Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):3.91829583405449
                                                              Encrypted:false
                                                              SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                              MD5:3088F0272D29FAA42ED452C5E8120B08
                                                              SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                              SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                              SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                              Malicious:false
                                                              Preview:{"schema":6,"addons":[]}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):3.91829583405449
                                                              Encrypted:false
                                                              SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                              MD5:3088F0272D29FAA42ED452C5E8120B08
                                                              SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                              SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                              SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                              Malicious:false
                                                              Preview:{"schema":6,"addons":[]}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                              Category:dropped
                                                              Size (bytes):66
                                                              Entropy (8bit):4.837595020998689
                                                              Encrypted:false
                                                              SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                              MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                              SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                              SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                              SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                              Malicious:false
                                                              Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                              Category:dropped
                                                              Size (bytes):66
                                                              Entropy (8bit):4.837595020998689
                                                              Encrypted:false
                                                              SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                              MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                              SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                              SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                              SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                              Malicious:false
                                                              Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):36830
                                                              Entropy (8bit):5.185924656884556
                                                              Encrypted:false
                                                              SSDEEP:768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
                                                              MD5:5656BA69BD2966108A461AAE35F60226
                                                              SHA1:9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
                                                              SHA-256:587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
                                                              SHA-512:38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
                                                              Malicious:false
                                                              Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):36830
                                                              Entropy (8bit):5.185924656884556
                                                              Encrypted:false
                                                              SSDEEP:768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
                                                              MD5:5656BA69BD2966108A461AAE35F60226
                                                              SHA1:9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
                                                              SHA-256:587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
                                                              SHA-512:38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
                                                              Malicious:false
                                                              Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):1021904
                                                              Entropy (8bit):6.648417932394748
                                                              Encrypted:false
                                                              SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                              MD5:FE3355639648C417E8307C6D051E3E37
                                                              SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                              SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                              SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                              Malicious:false
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                              Joe Sandbox View:
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):1021904
                                                              Entropy (8bit):6.648417932394748
                                                              Encrypted:false
                                                              SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                              MD5:FE3355639648C417E8307C6D051E3E37
                                                              SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                              SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                              SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                              Malicious:false
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                              Joe Sandbox View:
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):116
                                                              Entropy (8bit):4.968220104601006
                                                              Encrypted:false
                                                              SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                              MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                              SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                              SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                              SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                              Malicious:false
                                                              Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):116
                                                              Entropy (8bit):4.968220104601006
                                                              Encrypted:false
                                                              SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                              MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                              SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                              SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                              SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                              Malicious:false
                                                              Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ASCII text, with very long lines (1809), with CRLF line terminators
                                                              Category:modified
                                                              Size (bytes):11292
                                                              Entropy (8bit):5.530013452300617
                                                              Encrypted:false
                                                              SSDEEP:192:anaRtZYbBp6ihj4qyaaX86KDSkfGNBw8rYSl:NegqUI3cwp0
                                                              MD5:79E64B2F47BC3946DC320AF5CDA8E69A
                                                              SHA1:5496B7CEC0BA2E31ACCDD3944EBC41D50F6CF32B
                                                              SHA-256:1E281A2AAF45D13477B6EB86E02A5186C6BFEFCE8438FC6CBDB899470ECC0490
                                                              SHA-512:7A84A0EB0F86E4D8C4ABF6B5A1ABE745E281505177091F0F24477834575D47001B63B2B11F798B2860C85CAAC071BC864180691828A66159A3CAD01A1A9B0746
                                                              Malicious:false
                                                              Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1724472829);..user_pref("app.update.lastUpdateTime.background-update-timer", 1724472829);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..u

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:ASCII text, with very long lines (1809), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):11292
                                                              Entropy (8bit):5.530013452300617
                                                              Encrypted:false
                                                              SSDEEP:192:anaRtZYbBp6ihj4qyaaX86KDSkfGNBw8rYSl:NegqUI3cwp0
                                                              MD5:79E64B2F47BC3946DC320AF5CDA8E69A
                                                              SHA1:5496B7CEC0BA2E31ACCDD3944EBC41D50F6CF32B
                                                              SHA-256:1E281A2AAF45D13477B6EB86E02A5186C6BFEFCE8438FC6CBDB899470ECC0490
                                                              SHA-512:7A84A0EB0F86E4D8C4ABF6B5A1ABE745E281505177091F0F24477834575D47001B63B2B11F798B2860C85CAAC071BC864180691828A66159A3CAD01A1A9B0746
                                                              Malicious:false
                                                              Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1724472829);..user_pref("app.update.lastUpdateTime.background-update-timer", 1724472829);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..u

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):53
                                                              Entropy (8bit):4.136624295551173
                                                              Encrypted:false
                                                              SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
                                                              MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
                                                              SHA1:B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
                                                              SHA-256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
                                                              SHA-512:076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
                                                              Malicious:false
                                                              Preview:{"profile-after-change":true,"final-ui-startup":true}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):53
                                                              Entropy (8bit):4.136624295551173
                                                              Encrypted:false
                                                              SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
                                                              MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
                                                              SHA1:B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
                                                              SHA-256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
                                                              SHA-512:076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
                                                              Malicious:false
                                                              Preview:{"profile-after-change":true,"final-ui-startup":true}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Mozilla lz4 compressed data, originally 301 bytes
                                                              Category:dropped
                                                              Size (bytes):272
                                                              Entropy (8bit):5.491143905059059
                                                              Encrypted:false
                                                              SSDEEP:6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqCRwbffnK3S0EKtFptVbdNzdDdCQ:vLz2S+EWDDoWqC+bfPK32wXBd9
                                                              MD5:DB58F4C5BD1604BBD7E291CF790685DD
                                                              SHA1:FBCC793BD78B8447C6E9267B5A28C4E69D0A4A47
                                                              SHA-256:7E81984BCFD15501C0D321AA62F0F2D1FE22A05216E99119E9DE93816C583306
                                                              SHA-512:913C93E7D53450020A34083FB77591FF043D79D5DFE4857C217C89B7816454E1F238D2D4A35A92823C981C908FE0FAEABD77BEFC39D5D951E5B0DBAEB70F79CC
                                                              Malicious:false
                                                              Preview:mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2167541758}d..W..5":1j..........@":{"w...Update":1724472818044,"startTim...$797355,"recentCrashes":0},"global":{},"cookies":[]}

                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

                                                              Download File
                                                              Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              File Type:Mozilla lz4 compressed data, originally 301 bytes
                                                              Category:dropped
                                                              Size (bytes):272
                                                              Entropy (8bit):5.491143905059059
                                                              Encrypted:false
                                                              SSDEEP:6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqCRwbffnK3S0EKtFptVbdNzdDdCQ:vLz2S+EWDDoWqC+bfPK32wXBd9
                                                              MD5:DB58F4C5BD1604BBD7E291CF790685DD
                                                              SHA1:FBCC793BD78B8447C6E9267B5A28C4E69D0A4A47
                                                              SHA-256:7E81984BCFD15501C0D321AA62F0F2D1FE22A05216E99119E9DE93816C583306
                                                              SHA-512:913C93E7D53450020A34083FB77591FF043D79D5DFE4857C217C89B7816454E1F238D2D4A35A92823C981C908FE0FAEABD77BEFC39D5D951E5B0DBAEB70F79CC
                                                              Malicious:false
                                                              Preview:mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2167541758}d..W..5":1j..........@":{"w...Update":1724472818044,"startTim...$797355,"recentCrashes":0},"global":{},"cookies":[]}

                                                              Static File Info

                                                              General

                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                              Entropy (8bit):6.579620706291562
                                                              TrID:
                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                              • DOS Executable Generic (2002/1) 0.02%
                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                              File name:file.exe
                                                              File size:917'504 bytes
                                                              MD5:928d7803f08676539035325d8697fc53
                                                              SHA1:cd0dc8cf27e83ce4f8aad5379cb5330d539f4893
                                                              SHA256:b577947677a4dacf20eeb42a1e250af220bd161e00bcd20695036bcc3f5ae5e5
                                                              SHA512:b13d9f3089f8393aa00b5565196f25d6ef8b05808cd8f5c19ee8ce7a48197364a64f464866429a3d33c69ec2c9ef738d88ed8a4c29077338f7f336db6d800a24
                                                              SSDEEP:12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarT8:mqDEvCTbMWu7rQYlBQcBiT6rprG8av8
                                                              TLSH:92159E0273D1C062FF9B92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
                                                              File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                                                              File Icon

                                                              Icon Hash:aaf3e3e3938382a0

                                                              Static PE Info

                                                              General

                                                              Entrypoint:0x420577
                                                              Entrypoint Section:.text
                                                              Digitally signed:false
                                                              Imagebase:0x400000
                                                              Subsystem:windows gui
                                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                              DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                              Time Stamp:0x66C943E1 [Sat Aug 24 02:22:25 2024 UTC]
                                                              TLS Callbacks:
                                                              CLR (.Net) Version:
                                                              OS Version Major:5
                                                              OS Version Minor:1
                                                              File Version Major:5
                                                              File Version Minor:1
                                                              Subsystem Version Major:5
                                                              Subsystem Version Minor:1
                                                              Import Hash:948cc502fe9226992dce9417f952fce3

                                                              Entrypoint Preview

                                                              Instruction
                                                              call 00007FA7A8B85973h
                                                              jmp 00007FA7A8B8527Fh
                                                              push ebp
                                                              mov ebp, esp
                                                              push esi
                                                              push dword ptr [ebp+08h]
                                                              mov esi, ecx
                                                              call 00007FA7A8B8545Dh
                                                              mov dword ptr [esi], 0049FDF0h
                                                              mov eax, esi
                                                              pop esi
                                                              pop ebp
                                                              retn 0004h
                                                              and dword ptr [ecx+04h], 00000000h
                                                              mov eax, ecx
                                                              and dword ptr [ecx+08h], 00000000h
                                                              mov dword ptr [ecx+04h], 0049FDF8h
                                                              mov dword ptr [ecx], 0049FDF0h
                                                              ret
                                                              push ebp
                                                              mov ebp, esp
                                                              push esi
                                                              push dword ptr [ebp+08h]
                                                              mov esi, ecx
                                                              call 00007FA7A8B8542Ah
                                                              mov dword ptr [esi], 0049FE0Ch
                                                              mov eax, esi
                                                              pop esi
                                                              pop ebp
                                                              retn 0004h
                                                              and dword ptr [ecx+04h], 00000000h
                                                              mov eax, ecx
                                                              and dword ptr [ecx+08h], 00000000h
                                                              mov dword ptr [ecx+04h], 0049FE14h
                                                              mov dword ptr [ecx], 0049FE0Ch
                                                              ret
                                                              push ebp
                                                              mov ebp, esp
                                                              push esi
                                                              mov esi, ecx
                                                              lea eax, dword ptr [esi+04h]
                                                              mov dword ptr [esi], 0049FDD0h
                                                              and dword ptr [eax], 00000000h
                                                              and dword ptr [eax+04h], 00000000h
                                                              push eax
                                                              mov eax, dword ptr [ebp+08h]
                                                              add eax, 04h
                                                              push eax
                                                              call 00007FA7A8B8801Dh
                                                              pop ecx
                                                              pop ecx
                                                              mov eax, esi
                                                              pop esi
                                                              pop ebp
                                                              retn 0004h
                                                              lea eax, dword ptr [ecx+04h]
                                                              mov dword ptr [ecx], 0049FDD0h
                                                              push eax
                                                              call 00007FA7A8B88068h
                                                              pop ecx
                                                              ret
                                                              push ebp
                                                              mov ebp, esp
                                                              push esi
                                                              mov esi, ecx
                                                              lea eax, dword ptr [esi+04h]
                                                              mov dword ptr [esi], 0049FDD0h
                                                              push eax
                                                              call 00007FA7A8B88051h
                                                              test byte ptr [ebp+08h], 00000001h
                                                              pop ecx

                                                              Rich Headers

                                                              Programming Language:
                                                              • [ C ] VS2008 SP1 build 30729
                                                              • [IMP] VS2008 SP1 build 30729

                                                              Data Directories

                                                              NameVirtual AddressVirtual Size Is in Section
                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xc8e640x17c.rdata
                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xd40000x9500.rsrc
                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0xde0000x7594.reloc
                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0xb0ff00x1c.rdata
                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_TLS0xc34000x18.rdata
                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb10100x40.rdata
                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x894.rdata
                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                              Sections

                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                              .text0x10000x9ab1d0x9ac000a1473f3064dcbc32ef93c5c8a90f3a6False0.565500681542811data6.668273581389308IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                              .rdata0x9c0000x2fb820x2fc00c9cf2468b60bf4f80f136ed54b3989fbFalse0.35289185209424084data5.691811547483722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .data0xcc0000x706c0x480053b9025d545d65e23295e30afdbd16d9False0.04356553819444445DOS executable (block device driver @\273\)0.5846666986982398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                              .rsrc0xd40000x95000x9600ea7aada6bfbf9f53bf10c50f143a43b0False0.28109375data5.162257221478473IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .reloc0xde0000x75940x7600c68ee8931a32d45eb82dc450ee40efc3False0.7628111758474576data6.7972128181359786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                              Resources

                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                              RT_ICON0xd45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                              RT_ICON0xd46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                              RT_ICON0xd47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                              RT_ICON0xd49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                              RT_ICON0xd4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                              RT_ICON0xd4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                              RT_ICON0xd5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                              RT_ICON0xd64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                              RT_ICON0xd69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                              RT_ICON0xd8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                              RT_ICON0xda0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                              RT_MENU0xda4a00x50dataEnglishGreat Britain0.9
                                                              RT_STRING0xda4f00x594dataEnglishGreat Britain0.3333333333333333
                                                              RT_STRING0xdaa840x68adataEnglishGreat Britain0.2735961768219833
                                                              RT_STRING0xdb1100x490dataEnglishGreat Britain0.3715753424657534
                                                              RT_STRING0xdb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                              RT_STRING0xdbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                              RT_STRING0xdc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                              RT_STRING0xdc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                              RT_RCDATA0xdc7b80x7c6data1.0055276381909548
                                                              RT_GROUP_ICON0xdcf800x76dataEnglishGreat Britain0.6610169491525424
                                                              RT_GROUP_ICON0xdcff80x14dataEnglishGreat Britain1.25
                                                              RT_GROUP_ICON0xdd00c0x14dataEnglishGreat Britain1.15
                                                              RT_GROUP_ICON0xdd0200x14dataEnglishGreat Britain1.25
                                                              RT_VERSION0xdd0340xdcdataEnglishGreat Britain0.6181818181818182
                                                              RT_MANIFEST0xdd1100x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                              Imports

                                                              DLLImport
                                                              WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                              VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                              WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                              COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                              MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                              WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                              PSAPI.DLLGetProcessMemoryInfo
                                                              IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                              USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                              UxTheme.dllIsThemeActive
                                                              KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
                                                              USER32.dllGetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
                                                              GDI32.dllEndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
                                                              COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                              ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
                                                              SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                              ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                              OLEAUT32.dllCreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

                                                              Possible Origin

                                                              Language of compilation systemCountry where language is spokenMap
                                                              EnglishGreat Britain

                                                              Network Behavior

                                                              Network Port Distribution

                                                              TCP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Aug 24, 2024 04:29:52.437531948 CEST49675443192.168.2.4173.222.162.32
                                                              Aug 24, 2024 04:30:02.191498041 CEST49675443192.168.2.4173.222.162.32
                                                              Aug 24, 2024 04:30:03.350083113 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:03.350099087 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:03.350156069 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:03.350322962 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:03.350333929 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.104216099 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.192742109 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.192759037 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.193075895 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.193085909 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.193137884 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.193139076 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.193160057 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.193191051 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.193212032 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.193684101 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.213869095 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.213926077 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.214478016 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.214483023 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.288419008 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.399076939 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.399102926 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.399164915 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.399171114 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.402256012 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.402298927 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.402303934 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.408402920 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.408452034 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.408457994 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.414758921 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.414804935 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.414810896 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.421334982 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.421403885 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.421411037 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.427377939 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.427453995 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.427462101 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.433657885 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.433707952 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.433713913 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.439969063 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.440030098 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.440036058 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.491411924 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.491487980 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.491493940 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.491569996 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.491719007 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.491724014 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.494960070 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.495006084 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.495011091 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.501209021 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.501255035 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.501260042 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.507496119 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.507565022 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.507570982 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.513808012 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.513855934 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.513863087 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.520163059 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.520201921 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.520207882 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.526473999 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.526534081 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.526540041 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.532838106 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.532984972 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.532989979 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.539094925 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.539146900 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.539153099 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.544424057 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.544470072 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.544476032 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.549608946 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.549674034 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.549679041 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.555032015 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.555074930 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.555079937 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.565773964 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.565823078 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.565828085 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.566246986 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.566297054 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.566302061 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.571441889 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.573273897 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.573281050 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.583751917 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.583797932 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.583805084 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.583810091 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.584631920 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.584683895 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.584690094 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.584727049 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.584747076 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.588432074 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.589596033 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.589601040 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.592009068 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.593281984 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.593286991 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.595525026 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.595658064 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.595663071 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.598944902 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.599000931 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.599005938 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.602375984 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.602484941 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.602490902 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.606041908 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.606097937 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.606101990 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.609469891 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.609515905 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.609520912 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.612914085 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.612967014 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.612972975 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.616415024 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.616457939 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.616463900 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.620001078 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.620055914 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.620062113 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.623842955 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.623902082 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.623908043 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.626950026 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.629434109 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.629439116 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.630446911 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.630503893 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.630508900 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.633847952 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.634085894 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.634090900 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.637319088 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.637449980 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.637454987 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.642062902 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.643096924 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.643105030 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.647450924 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.647512913 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.647519112 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.647644997 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.647686958 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.647691965 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.652889013 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.652937889 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.652944088 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.654171944 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.654218912 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.654223919 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.658428907 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.658480883 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.658485889 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.660393000 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.660425901 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.660449028 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.660454988 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.660497904 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.663496971 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.663666010 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.663731098 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.663846970 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.663856030 CEST44349750142.250.184.193192.168.2.4
                                                              Aug 24, 2024 04:30:04.663863897 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:04.663902044 CEST49750443192.168.2.4142.250.184.193
                                                              Aug 24, 2024 04:30:05.222875118 CEST49761443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.222907066 CEST44349761162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.223006964 CEST49761443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.223196030 CEST49762443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.223201990 CEST44349762162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.223337889 CEST49762443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.223409891 CEST49761443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.223423004 CEST44349761162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.223562002 CEST49762443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.223573923 CEST44349762162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.321419001 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.321440935 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.321729898 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.321749926 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.321985006 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.322160006 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.323580027 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.323594093 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.323707104 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.323717117 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.389216900 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.389240026 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.389554977 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.389828920 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.389839888 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.452419043 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.452430964 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.453119040 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.453380108 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.453389883 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.698242903 CEST44349761162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.699778080 CEST49761443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.699801922 CEST44349761162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.700773001 CEST44349761162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.702138901 CEST49761443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.703272104 CEST49761443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.703339100 CEST44349761162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.703449011 CEST49761443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.704469919 CEST44349762162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.704842091 CEST49762443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.704849958 CEST44349762162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.705835104 CEST44349762162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.705910921 CEST49762443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.706690073 CEST49762443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.706773043 CEST44349762162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.706825018 CEST49762443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.748503923 CEST44349761162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.752506971 CEST44349762162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.804740906 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.813713074 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.813736916 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.814603090 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.815099955 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.816231966 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.816288948 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.816374063 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.835333109 CEST44349761162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.836042881 CEST49761443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.836231947 CEST49761443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.836246967 CEST44349761162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.849195004 CEST44349762162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.858601093 CEST49762443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.860501051 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.862637997 CEST49762443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.862651110 CEST44349762162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.886037111 CEST4976753192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.890836000 CEST53497671.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.900657892 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.900692940 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.900746107 CEST4976753192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.901042938 CEST4976753192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.901854038 CEST4976753192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.905781984 CEST53497671.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.906573057 CEST53497671.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.939074039 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.940366983 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.940635920 CEST49763443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:05.940656900 CEST44349763162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:05.982234955 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.982319117 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.986403942 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.986417055 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.986546040 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.986553907 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.987302065 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.987404108 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.992502928 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.992502928 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.992503881 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.992532969 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.993642092 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.993700981 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.994029999 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.994096041 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.994159937 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:05.994196892 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.994381905 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:05.994385004 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.036501884 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.036509991 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.195020914 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.195031881 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.204484940 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.204699039 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.228235006 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.228243113 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.228295088 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.228324890 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.228338957 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.228423119 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.228780031 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.228967905 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.228985071 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.228991985 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.229008913 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.229022980 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.229029894 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.229337931 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.229777098 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.229782104 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.229861975 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.229861975 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.233948946 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.233958006 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.233992100 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.233999968 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.234040022 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.234046936 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.234555006 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.234720945 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.236228943 CEST49768443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:06.236284971 CEST4434976835.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:06.236387014 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.236394882 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.236433983 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.236443043 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.236881018 CEST49768443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:06.236931086 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.237225056 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.237238884 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.237595081 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.237603903 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.238557100 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.241523027 CEST49768443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:06.241569996 CEST4434976835.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:06.244041920 CEST49765443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.244055033 CEST4434976513.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.250483990 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.250502110 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.251689911 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.251748085 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.251840115 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.272032976 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.272042036 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.272072077 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.272119045 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.272311926 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.272372007 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.279130936 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.283123016 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.294532061 CEST49764443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.294543028 CEST4434976413.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.296505928 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.347110033 CEST53497671.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:06.350151062 CEST4976753192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:06.352274895 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.352289915 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.354912996 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.354923964 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.354955912 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.355194092 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.355195999 CEST53497671.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:06.355983019 CEST4976753192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:06.402796984 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:06.402863026 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:06.404617071 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:06.405045033 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:06.405061007 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:06.434722900 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.434731007 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.434758902 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.434768915 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.435146093 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.435157061 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.435632944 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.436501980 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.436507940 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.436530113 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.436553001 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.439562082 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.439568043 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.443999052 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.521960974 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.521972895 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.521998882 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.522026062 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.522542000 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.522550106 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.522587061 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.522613049 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.522881985 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.522890091 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.523513079 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.523526907 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.523727894 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.524240971 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.524246931 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.524516106 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.524532080 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.524564028 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.524715900 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.524719954 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.525239944 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.590702057 CEST49770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.590774059 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.590862989 CEST49771443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.590908051 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.591300011 CEST49770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.591310024 CEST49771443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.591550112 CEST49771443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.591568947 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.591654062 CEST49770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.591669083 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.607933044 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.607954025 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.608513117 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.608546972 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.609181881 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.609205961 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.612776995 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.612785101 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.612854004 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.625365019 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.625372887 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.625384092 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.625579119 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.625586033 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.625595093 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.626176119 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.626185894 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.626194000 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.626856089 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.626859903 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.626868010 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.626905918 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.626921892 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.626931906 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.626940012 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.626956940 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.627007008 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.629575968 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.636513948 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.694463968 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.694479942 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.695121050 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.695161104 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.695470095 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.695482969 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.696079016 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.705925941 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.705934048 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.705945015 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.713794947 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.713799953 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.713809967 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.720998049 CEST4434976835.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:06.728502989 CEST4434976835.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:06.728692055 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.737339020 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.744704008 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.748004913 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.748008013 CEST49768443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:06.763297081 CEST49768443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:06.793859005 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.848073006 CEST49768443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:06.848083019 CEST4434976835.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:06.848206997 CEST49768443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:06.848232985 CEST4434976835.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:06.848567963 CEST49768443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:06.855694056 CEST49766443192.168.2.413.107.246.64
                                                              Aug 24, 2024 04:30:06.855701923 CEST4434976613.107.246.64192.168.2.4
                                                              Aug 24, 2024 04:30:06.956553936 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:06.959594011 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:06.959635019 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:06.960634947 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:06.960786104 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:07.041567087 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.044218063 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.056126118 CEST49771443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.056169987 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.056617022 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.057272911 CEST49770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.057312965 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.057605982 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.059592009 CEST49771443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.059803009 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.141732931 CEST49770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.141830921 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.146739960 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:07.146831989 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:07.146965027 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:07.188508987 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:07.227070093 CEST49770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.227106094 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:07.227128983 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:07.244622946 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:07.244632959 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:07.244664907 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:07.244677067 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:07.244695902 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:07.251193047 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:07.251856089 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:07.264503002 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.270307064 CEST49771443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.276336908 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.276369095 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.276479006 CEST49773443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.276550055 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.276586056 CEST49774443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.276623964 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.276709080 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.276721001 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.276794910 CEST49776443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.276812077 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.276889086 CEST49777443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.276911020 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.277420044 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.277466059 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.277514935 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.277551889 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.277724981 CEST49769443192.168.2.4152.195.19.97
                                                              Aug 24, 2024 04:30:07.277734041 CEST44349769152.195.19.97192.168.2.4
                                                              Aug 24, 2024 04:30:07.283118963 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.283142090 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.283142090 CEST49776443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.283152103 CEST49773443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.283152103 CEST49774443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.283706903 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.283706903 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.283716917 CEST49777443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.284125090 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.284140110 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.284225941 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.284241915 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.284324884 CEST49777443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.284338951 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.284446001 CEST49776443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.284452915 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.284533978 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.284547091 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.284645081 CEST49774443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.284670115 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.284764051 CEST49773443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.284785986 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.284852982 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.284861088 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.352264881 CEST49780443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:07.352279902 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:07.354988098 CEST49780443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:07.357573986 CEST49780443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:07.357584953 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:07.592401981 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:07.592421055 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:07.592514038 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:07.593111038 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:07.593121052 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:07.738465071 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.743129015 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.743159056 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.743531942 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.744141102 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.744213104 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.745141029 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.765331030 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.789625883 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.789654970 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.789972067 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.789982080 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.790131092 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.790271044 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.790329933 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.790569067 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.793826103 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.793838978 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.802561045 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.807405949 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.807470083 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.807672977 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.832521915 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.848519087 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.897474051 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.900259972 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.901184082 CEST49779443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.901200056 CEST44349779142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.917488098 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.917725086 CEST49774443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.917753935 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.918636084 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.918989897 CEST49774443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.919423103 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.919898033 CEST49774443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.919970989 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.920066118 CEST49774443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.922756910 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.928174019 CEST49778443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:07.928196907 CEST44349778142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:07.929438114 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.935745001 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.936757088 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.936845064 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.941483021 CEST49773443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.941504002 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.942418098 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.942430019 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.942440033 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.949223995 CEST49773443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.954804897 CEST49776443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.954818010 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.955112934 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.955193996 CEST49773443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.955271006 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.955374002 CEST49777443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.955384016 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.955420017 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.955430984 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.955504894 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.955509901 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.955596924 CEST49773443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.955768108 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.956182957 CEST49776443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.956242085 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.956271887 CEST49776443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.956312895 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.956322908 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.956413984 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.956424952 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.956774950 CEST49777443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.956845999 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.956861973 CEST49777443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.956979990 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.956979990 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.957479000 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.957549095 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.957768917 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.957823992 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.957879066 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.957930088 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.960513115 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.994524002 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:07.996040106 CEST49780443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:07.996501923 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.996553898 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.999383926 CEST49776443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.999399900 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.999399900 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:07.999408007 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:07.999422073 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.000514984 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.002274036 CEST49780443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:08.002278090 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:08.002485991 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:08.018390894 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.018868923 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.020518064 CEST49774443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.052165985 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.052397966 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.054316998 CEST49773443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.054491997 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.054658890 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.055695057 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.055810928 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.056226015 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.056267977 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.056297064 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.056346893 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.056886911 CEST49777443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.057853937 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.057977915 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.058013916 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.058311939 CEST49780443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:08.060051918 CEST49776443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.061167955 CEST49774443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.061203957 CEST4434977413.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.062000990 CEST49782443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.062016964 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.062896967 CEST49782443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.064189911 CEST49782443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.064199924 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.067882061 CEST49773443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.067912102 CEST4434977313.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.068264008 CEST49772443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.068279028 CEST4434977213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.068526983 CEST49775443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.068531990 CEST4434977513.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.068766117 CEST49777443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.068777084 CEST4434977713.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.068981886 CEST49776443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.068989038 CEST4434977613.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.086558104 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.088264942 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:08.088272095 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.089740992 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.090130091 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:08.098453999 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:08.098540068 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.098601103 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:08.100522995 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:08.140527964 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.200218916 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:08.200227022 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.200434923 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.200563908 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.200684071 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.200817108 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.200989962 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.203968048 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:08.205105066 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.205158949 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.205655098 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.205881119 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.205897093 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.223000050 CEST49781443192.168.2.4142.251.40.164
                                                              Aug 24, 2024 04:30:08.223007917 CEST44349781142.251.40.164192.168.2.4
                                                              Aug 24, 2024 04:30:08.236625910 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.236654997 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.245907068 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.249569893 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.249587059 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.265764952 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:08.265805960 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:08.266827106 CEST49780443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:08.284142017 CEST4978580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:08.287393093 CEST49780443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:08.287401915 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:08.287415028 CEST49780443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:08.287420034 CEST44349780184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:08.288932085 CEST804978534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:08.291209936 CEST4978580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:08.291402102 CEST4978580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:08.296154022 CEST804978534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:08.490107059 CEST49786443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:08.490122080 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:08.490391970 CEST49786443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:08.490699053 CEST49786443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:08.490709066 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:08.661773920 CEST49787443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.661828995 CEST44349787162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:08.661931992 CEST49788443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.661989927 CEST44349788162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:08.663356066 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.671669006 CEST49788443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.671670914 CEST49787443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.673108101 CEST49788443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.673129082 CEST44349788162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:08.673227072 CEST49787443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.673243046 CEST44349787162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:08.673333883 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.673356056 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.673753977 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.673893929 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.674447060 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.674704075 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.675015926 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.675076008 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.713356972 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.714025974 CEST49782443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.714036942 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.714349031 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.714864016 CEST49782443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.714919090 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.715002060 CEST49782443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.724975109 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.724986076 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.737056017 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.737250090 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.737262011 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.737646103 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.737656116 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.737709045 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.738339901 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.738404036 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.738555908 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.738617897 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.748351097 CEST804978534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:08.756501913 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.796631098 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.796633005 CEST4978580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:08.796643972 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.815656900 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.815676928 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.815798044 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.815846920 CEST49782443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.815941095 CEST49782443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.816721916 CEST49782443192.168.2.413.107.246.40
                                                              Aug 24, 2024 04:30:08.816729069 CEST4434978213.107.246.40192.168.2.4
                                                              Aug 24, 2024 04:30:08.827655077 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.896872997 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.973942995 CEST4979080192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:08.978707075 CEST804979034.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:08.978816032 CEST4979080192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:08.979027987 CEST4979080192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:08.983768940 CEST804979034.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:09.127238035 CEST44349788162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.129818916 CEST44349787162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.142596960 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:09.148499012 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:09.159446001 CEST49786443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:09.170820951 CEST49787443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.170862913 CEST44349787162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.170917034 CEST49788443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.170993090 CEST44349788162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.171180010 CEST44349787162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.171382904 CEST44349788162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.173048019 CEST49788443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.173127890 CEST44349788162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.173248053 CEST49787443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.173309088 CEST44349787162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.176522970 CEST49786443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:09.176527977 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:09.176754951 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:09.177663088 CEST49786443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:09.220510960 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:09.298839092 CEST49788443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.335809946 CEST49787443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.422746897 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:09.422780991 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:09.422821999 CEST49786443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:09.423674107 CEST49786443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:09.423686981 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:09.423697948 CEST49786443192.168.2.4184.28.90.27
                                                              Aug 24, 2024 04:30:09.423702955 CEST44349786184.28.90.27192.168.2.4
                                                              Aug 24, 2024 04:30:09.424133062 CEST804979034.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:09.532512903 CEST4979080192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:09.724435091 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:09.724450111 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:09.724571943 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:09.724759102 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:09.724767923 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:10.185905933 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:10.186139107 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:10.186146975 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:10.186989069 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:10.187047958 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:10.188038111 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:10.188087940 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:10.188196898 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:10.188204050 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:10.234083891 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:10.321881056 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:10.321938992 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:10.322032928 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:10.322412014 CEST49792443192.168.2.4142.251.40.106
                                                              Aug 24, 2024 04:30:10.322421074 CEST44349792142.251.40.106192.168.2.4
                                                              Aug 24, 2024 04:30:12.391887903 CEST49672443192.168.2.4173.222.162.32
                                                              Aug 24, 2024 04:30:12.391928911 CEST44349672173.222.162.32192.168.2.4
                                                              Aug 24, 2024 04:30:14.114260912 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:14.114300013 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:14.116606951 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:14.117611885 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:14.117628098 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:14.906147957 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:14.906230927 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:14.908767939 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:14.908782959 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:14.908992052 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:14.952637911 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:15.624317884 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:15.668500900 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.883836985 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.883862019 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.883868933 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.883903980 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.883922100 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.883936882 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.883946896 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:15.883972883 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.884213924 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:15.884378910 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.884629011 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:15.885087967 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:16.660547018 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:16.660583019 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:16.660594940 CEST49793443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:16.660602093 CEST4434979340.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:18.762898922 CEST4978580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:18.767730951 CEST804978534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:19.435955048 CEST4979080192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:19.440831900 CEST804979034.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:21.952949047 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:21.953010082 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:21.953113079 CEST49770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:21.953685999 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:21.953752041 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:21.953802109 CEST49771443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:24.037420988 CEST44349788162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:24.037508011 CEST44349788162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:24.039118052 CEST44349787162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:24.039170980 CEST44349787162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:24.039726973 CEST49787443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:24.039736986 CEST49788443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:28.801175117 CEST4978580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:28.806065083 CEST804978534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:29.450119019 CEST4979080192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:29.454926014 CEST804979034.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:33.668863058 CEST49799443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:33.668895006 CEST4434979935.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:33.669051886 CEST49799443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:33.669245005 CEST49799443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:33.669260025 CEST4434979935.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:33.683363914 CEST49800443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:33.683392048 CEST4434980035.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:33.684137106 CEST49800443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:33.685616016 CEST49800443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:33.685632944 CEST4434980035.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:33.689996004 CEST49801443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:33.690006971 CEST4434980134.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:33.690221071 CEST49801443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:33.690327883 CEST49801443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:33.690340042 CEST4434980134.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:33.875049114 CEST49802443192.168.2.452.222.236.120
                                                              Aug 24, 2024 04:30:33.875091076 CEST4434980252.222.236.120192.168.2.4
                                                              Aug 24, 2024 04:30:33.875386000 CEST49802443192.168.2.452.222.236.120
                                                              Aug 24, 2024 04:30:33.875523090 CEST49802443192.168.2.452.222.236.120
                                                              Aug 24, 2024 04:30:33.875534058 CEST4434980252.222.236.120192.168.2.4
                                                              Aug 24, 2024 04:30:34.158795118 CEST4434979935.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.158869028 CEST49799443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.161688089 CEST49799443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.161699057 CEST4434979935.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.161897898 CEST4434979935.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.164215088 CEST49799443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.164316893 CEST49799443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.164361000 CEST4434979935.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.164438963 CEST49799443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.165572882 CEST4979080192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.165595055 CEST4978580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.166614056 CEST4434980134.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.167880058 CEST49801443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.170489073 CEST49801443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.170495033 CEST4434980134.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.170542955 CEST804979034.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.170636892 CEST4979080192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.170733929 CEST4434980134.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.170861006 CEST804978534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.171336889 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.171564102 CEST4978580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.173338890 CEST49801443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.173453093 CEST49801443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.173477888 CEST4434980134.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.173595905 CEST49801443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.173861980 CEST49804443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.173877001 CEST4434980434.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.173938036 CEST49804443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.174065113 CEST49804443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.174077988 CEST4434980434.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.176130056 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.176181078 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.176287889 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.176760912 CEST4434980035.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:34.176896095 CEST49800443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:34.181027889 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.181134939 CEST49800443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:34.181143045 CEST4434980035.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:34.181226969 CEST49800443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:34.181282997 CEST4434980035.190.72.216192.168.2.4
                                                              Aug 24, 2024 04:30:34.181376934 CEST49800443192.168.2.435.190.72.216
                                                              Aug 24, 2024 04:30:34.622889996 CEST4434980252.222.236.120192.168.2.4
                                                              Aug 24, 2024 04:30:34.622962952 CEST49802443192.168.2.452.222.236.120
                                                              Aug 24, 2024 04:30:34.626010895 CEST49802443192.168.2.452.222.236.120
                                                              Aug 24, 2024 04:30:34.626023054 CEST4434980252.222.236.120192.168.2.4
                                                              Aug 24, 2024 04:30:34.626058102 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.626223087 CEST4434980252.222.236.120192.168.2.4
                                                              Aug 24, 2024 04:30:34.627305984 CEST4434980434.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.627746105 CEST49804443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.630373955 CEST49804443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.630379915 CEST4434980434.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.630583048 CEST4434980434.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.631624937 CEST49802443192.168.2.452.222.236.120
                                                              Aug 24, 2024 04:30:34.631709099 CEST49802443192.168.2.452.222.236.120
                                                              Aug 24, 2024 04:30:34.631745100 CEST4434980252.222.236.120192.168.2.4
                                                              Aug 24, 2024 04:30:34.632647038 CEST49802443192.168.2.452.222.236.120
                                                              Aug 24, 2024 04:30:34.634399891 CEST49804443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.634454012 CEST49804443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.634521008 CEST4434980434.149.100.209192.168.2.4
                                                              Aug 24, 2024 04:30:34.635261059 CEST4980580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.640100956 CEST804980534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.640559912 CEST49806443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.640574932 CEST4434980635.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.641344070 CEST49804443192.168.2.434.149.100.209
                                                              Aug 24, 2024 04:30:34.641381979 CEST4980580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.641381979 CEST49806443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.641535997 CEST4980580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.641679049 CEST49806443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.641691923 CEST4434980635.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.645708084 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.646311998 CEST804980534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.650558949 CEST49807443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.650598049 CEST4434980735.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.650604010 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.650686026 CEST49807443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.650685072 CEST49808443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.650763035 CEST49807443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.650764942 CEST4434980835.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.650779009 CEST4434980735.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.650966883 CEST49808443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.651068926 CEST49808443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:34.651106119 CEST4434980835.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:34.744628906 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.749481916 CEST4980580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.752630949 CEST4980980192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.757431984 CEST804980934.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.757494926 CEST4980980192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.757616043 CEST4980980192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:34.762484074 CEST804980934.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.798985004 CEST804980534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:34.802018881 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.005481958 CEST804980534.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:35.011574030 CEST4980580192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.097831011 CEST4434980635.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.102638006 CEST49806443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.105426073 CEST49806443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.105442047 CEST4434980635.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.105642080 CEST4434980635.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.109332085 CEST4434980835.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.109543085 CEST4434980735.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.113554001 CEST49808443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.113569021 CEST49807443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.116563082 CEST49807443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.116575003 CEST4434980735.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.116771936 CEST4434980735.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.119122028 CEST49808443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.119147062 CEST4434980835.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.119400978 CEST4434980835.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.121838093 CEST49806443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.121916056 CEST49806443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.121973991 CEST4434980635.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.126550913 CEST49806443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.127461910 CEST49807443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.127588987 CEST4434980735.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.127681017 CEST49807443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.127687931 CEST4434980735.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.128113985 CEST49808443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.128158092 CEST49808443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.128278971 CEST4434980835.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.129427910 CEST49808443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.130665064 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.135795116 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:35.226768970 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:35.227309942 CEST4980980192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.229732990 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.231879950 CEST804980934.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:35.232029915 CEST4980980192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.232343912 CEST804980934.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:35.233797073 CEST4980980192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.234780073 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:35.234855890 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.234994888 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.239756107 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:35.267565966 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:35.336507082 CEST4434980735.244.181.201192.168.2.4
                                                              Aug 24, 2024 04:30:35.336569071 CEST49807443192.168.2.435.244.181.201
                                                              Aug 24, 2024 04:30:35.705960035 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:35.764579058 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:45.227685928 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:45.232736111 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:45.713346004 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:45.718297958 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:53.247265100 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:53.247311115 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:53.247500896 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:53.248101950 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:53.248117924 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:53.734226942 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:53.734263897 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:53.818762064 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:53.818769932 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:54.031292915 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.031362057 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:54.034945011 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:54.034953117 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.035156012 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.043015003 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:54.084542990 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.360419989 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.360436916 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.360451937 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.360522985 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:54.360564947 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.362158060 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.362190008 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.362221956 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.363362074 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:54.363398075 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:54.365746975 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:54.365762949 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:54.365773916 CEST49812443192.168.2.440.127.169.103
                                                              Aug 24, 2024 04:30:54.365778923 CEST4434981240.127.169.103192.168.2.4
                                                              Aug 24, 2024 04:30:55.247927904 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:55.252746105 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:55.739264965 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:30:55.744301081 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:30:59.585684061 CEST49787443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:59.585700035 CEST49788443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:59.585706949 CEST44349787162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:59.585776091 CEST44349788162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:05.258791924 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:05.263869047 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:05.775912046 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:05.780797958 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:06.965565920 CEST49770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:06.965590000 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:06.966871977 CEST49771443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:06.966896057 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:09.217055082 CEST4972380192.168.2.4199.232.210.172
                                                              Aug 24, 2024 04:31:09.217113972 CEST4972480192.168.2.4199.232.210.172
                                                              Aug 24, 2024 04:31:09.222323895 CEST8049723199.232.210.172192.168.2.4
                                                              Aug 24, 2024 04:31:09.222381115 CEST4972380192.168.2.4199.232.210.172
                                                              Aug 24, 2024 04:31:09.222461939 CEST8049724199.232.210.172192.168.2.4
                                                              Aug 24, 2024 04:31:09.222512960 CEST4972480192.168.2.4199.232.210.172
                                                              Aug 24, 2024 04:31:15.265743017 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:15.270616055 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:15.782844067 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:15.788948059 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:25.282182932 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:25.287022114 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:25.793746948 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:25.798543930 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:35.287642956 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:35.292716026 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:35.800344944 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:35.805275917 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:38.745244980 CEST49783443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:31:38.745268106 CEST44349783142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:31:38.829967976 CEST49784443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:31:38.829977036 CEST44349784142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:31:45.300311089 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:45.305336952 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:45.817444086 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:45.822882891 CEST804981134.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:51.983241081 CEST49770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:51.983261108 CEST44349770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:51.983336926 CEST49771443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:51.983362913 CEST44349771162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:55.306907892 CEST4980380192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:55.312026978 CEST804980334.107.221.82192.168.2.4
                                                              Aug 24, 2024 04:31:55.824115992 CEST4981180192.168.2.434.107.221.82
                                                              Aug 24, 2024 04:31:55.828985929 CEST804981134.107.221.82192.168.2.4

                                                              UDP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Aug 24, 2024 04:30:00.370790005 CEST53564201.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:01.724797010 CEST6050953192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:01.724936008 CEST5503553192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:02.829281092 CEST53622491.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:03.158915043 CEST53528741.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:03.341725111 CEST5239853192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:03.342016935 CEST5258153192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:03.348510027 CEST53523981.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:03.349124908 CEST53525811.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.201962948 CEST5887953192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.208659887 CEST53588791.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.213561058 CEST4994353192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.214060068 CEST5351953192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.214250088 CEST5928853192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.221280098 CEST53499431.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.221290112 CEST53535191.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.221298933 CEST53592881.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.309504986 CEST5706753192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.309633017 CEST5703153192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:05.316015005 CEST53570671.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.316169977 CEST53570311.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:05.882051945 CEST53610361.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:06.236778975 CEST6425853192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:06.253057957 CEST53642581.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:06.284770966 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.299377918 CEST5565553192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:06.306986094 CEST53556551.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:06.590377092 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.733483076 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.733496904 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.733594894 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.733649015 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.733660936 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.794682026 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.796183109 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.796478987 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.796562910 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.798810005 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.798911095 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.893752098 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.893763065 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.893765926 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.893769026 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.896863937 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.897866011 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.898132086 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:06.954596996 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.954965115 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:06.955107927 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.052042007 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.132641077 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.132797003 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.142596006 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.144516945 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.144715071 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.230673075 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.231942892 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.240675926 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.242866039 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.243716002 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.244357109 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.244406939 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.274947882 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.275063992 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.489453077 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.489582062 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.587596893 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.588323116 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.588937044 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:07.590394020 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:07.902756929 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.204791069 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.262640953 CEST5091153192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:08.284717083 CEST6333053192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:08.291440964 CEST53633301.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:08.318986893 CEST6140353192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:08.325831890 CEST53614031.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:08.352217913 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.352231026 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.357794046 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.357804060 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.357815027 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.357826948 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.360636950 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.360697031 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.361208916 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.362010002 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.362093925 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.362415075 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.362415075 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.362531900 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.455537081 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.455600977 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.456492901 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.456792116 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.456832886 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.457406044 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.471163034 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.471479893 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.471999884 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.472007990 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.472522020 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.473886967 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.516776085 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:08.566590071 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:08.652621984 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.652718067 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.661511898 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.751632929 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:08.753011942 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:08.753838062 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:08.753981113 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:08.960400105 CEST5366153192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:08.965267897 CEST6119353192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:08.966664076 CEST4938553192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:08.967011929 CEST53536611.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:08.972079039 CEST53611931.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:08.976351976 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.109144926 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.109239101 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.114770889 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.116816998 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.116864920 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.116875887 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.137242079 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.170624971 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.172168016 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.172265053 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.172508001 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.172581911 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.270176888 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.270245075 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.272450924 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.272459984 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.273638964 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.274445057 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.373051882 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.373123884 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.373756886 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.470839977 CEST44350770162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.503238916 CEST50770443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.624077082 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.624192953 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:09.722945929 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.723195076 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.723911047 CEST44356206162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:30:09.724061966 CEST56206443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:30:16.012846947 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:16.012887955 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:16.107152939 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:16.141396046 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:16.141541004 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:16.157569885 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:16.207741976 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:16.276567936 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:16.293569088 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:16.347932100 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:20.790152073 CEST138138192.168.2.4192.168.2.255
                                                              Aug 24, 2024 04:30:33.668977976 CEST6037553192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:33.682750940 CEST5873453192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:33.687942982 CEST53603751.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:33.688450098 CEST5150053192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:33.689253092 CEST53587341.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:33.690164089 CEST6111753192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:33.695508003 CEST53515001.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:33.696846962 CEST53611171.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:33.697427034 CEST5280953192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:33.704257965 CEST53528091.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:33.866882086 CEST6037753192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:33.874277115 CEST53603771.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:33.875329018 CEST5684653192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:33.895754099 CEST53568461.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:33.896249056 CEST5152953192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:33.902967930 CEST53515291.1.1.1192.168.2.4
                                                              Aug 24, 2024 04:30:34.170026064 CEST5992353192.168.2.41.1.1.1
                                                              Aug 24, 2024 04:30:37.193887949 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:37.302165031 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:37.302429914 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:30:37.302491903 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:37.332612991 CEST59959443192.168.2.4142.251.40.110
                                                              Aug 24, 2024 04:30:37.423418999 CEST44359959142.251.40.110192.168.2.4
                                                              Aug 24, 2024 04:31:03.272274017 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.272445917 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.272680044 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.272829056 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.718769073 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.719499111 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:03.719989061 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.750099897 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.817893028 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:03.817914963 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:03.817962885 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:03.817972898 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:03.818229914 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.818229914 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.818275928 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.818281889 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:03.849848032 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:03.916094065 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:03.917736053 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:04.017189026 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:04.017827034 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:04.017838955 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:04.018208981 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:04.019572973 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:04.320435047 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:04.482979059 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.691791058 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.691813946 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.691823006 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.691845894 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.692284107 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:04.694164991 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:04.694470882 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:04.694587946 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:04.803530931 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.804754972 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.804764986 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.804821014 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.804828882 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:04.804975033 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:04.805080891 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:04.906089067 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:09.020793915 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:09.020910978 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:09.119508982 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:09.120086908 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:09.120385885 CEST44358778162.159.61.3192.168.2.4
                                                              Aug 24, 2024 04:31:09.120748043 CEST58778443192.168.2.4162.159.61.3
                                                              Aug 24, 2024 04:31:09.121511936 CEST57125443192.168.2.4142.251.16.84
                                                              Aug 24, 2024 04:31:09.121634960 CEST57125443192.168.2.4142.251.16.84
                                                              Aug 24, 2024 04:31:09.600670099 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.600991964 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.601047993 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.601108074 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.601120949 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.601986885 CEST57125443192.168.2.4142.251.16.84
                                                              Aug 24, 2024 04:31:09.602741003 CEST57125443192.168.2.4142.251.16.84
                                                              Aug 24, 2024 04:31:09.603025913 CEST57125443192.168.2.4142.251.16.84
                                                              Aug 24, 2024 04:31:09.706224918 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.706239939 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.706418037 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.718667984 CEST57125443192.168.2.4142.251.16.84
                                                              Aug 24, 2024 04:31:09.760942936 CEST57125443192.168.2.4142.251.16.84
                                                              Aug 24, 2024 04:31:09.797683001 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.797697067 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.797705889 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:09.803493977 CEST57125443192.168.2.4142.251.16.84
                                                              Aug 24, 2024 04:31:09.803564072 CEST57125443192.168.2.4142.251.16.84
                                                              Aug 24, 2024 04:31:09.932019949 CEST44357125142.251.16.84192.168.2.4
                                                              Aug 24, 2024 04:31:24.872714043 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:24.907051086 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:25.382328987 CEST44363263104.70.121.146192.168.2.4
                                                              Aug 24, 2024 04:31:25.421766043 CEST63263443192.168.2.4104.70.121.146
                                                              Aug 24, 2024 04:31:34.890270948 CEST44363263104.70.121.146192.168.2.4

                                                              DNS Queries

                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                              Aug 24, 2024 04:30:01.724797010 CEST192.168.2.41.1.1.10xd103Standard query (0)bzib.nelreports.netA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:01.724936008 CEST192.168.2.41.1.1.10x1787Standard query (0)bzib.nelreports.net65IN (0x0001)false
                                                              Aug 24, 2024 04:30:03.341725111 CEST192.168.2.41.1.1.10x1691Standard query (0)clients2.googleusercontent.comA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:03.342016935 CEST192.168.2.41.1.1.10xade5Standard query (0)clients2.googleusercontent.com65IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.201962948 CEST192.168.2.41.1.1.10x757dStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.213561058 CEST192.168.2.41.1.1.10x7643Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.214060068 CEST192.168.2.41.1.1.10xda3eStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.214250088 CEST192.168.2.41.1.1.10x1349Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.309504986 CEST192.168.2.41.1.1.10xf6a0Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.309633017 CEST192.168.2.41.1.1.10x4953Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Aug 24, 2024 04:30:06.236778975 CEST192.168.2.41.1.1.10x2aecStandard query (0)prod.classify-client.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:06.299377918 CEST192.168.2.41.1.1.10x757bStandard query (0)prod.classify-client.prod.webservices.mozgcp.net28IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.262640953 CEST192.168.2.41.1.1.10xf289Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.284717083 CEST192.168.2.41.1.1.10xfd9bStandard query (0)prod.detectportal.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.318986893 CEST192.168.2.41.1.1.10x9118Standard query (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.960400105 CEST192.168.2.41.1.1.10x4380Standard query (0)example.orgA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.965267897 CEST192.168.2.41.1.1.10xb376Standard query (0)ipv4only.arpaA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.966664076 CEST192.168.2.41.1.1.10x98bcStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.668977976 CEST192.168.2.41.1.1.10x59d9Standard query (0)prod.balrog.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.682750940 CEST192.168.2.41.1.1.10xdde9Standard query (0)firefox.settings.services.mozilla.comA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.688450098 CEST192.168.2.41.1.1.10x2394Standard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.690164089 CEST192.168.2.41.1.1.10x5fc3Standard query (0)prod.remote-settings.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.697427034 CEST192.168.2.41.1.1.10xe005Standard query (0)prod.remote-settings.prod.webservices.mozgcp.net28IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.866882086 CEST192.168.2.41.1.1.10xa381Standard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.875329018 CEST192.168.2.41.1.1.10xc450Standard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.896249056 CEST192.168.2.41.1.1.10x20bStandard query (0)services.addons.mozilla.org28IN (0x0001)false
                                                              Aug 24, 2024 04:30:34.170026064 CEST192.168.2.41.1.1.10xf55fStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false

                                                              DNS Answers

                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                              Aug 24, 2024 04:30:01.732146978 CEST1.1.1.1192.168.2.40x1787No error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:01.732635975 CEST1.1.1.1192.168.2.40xd103No error (0)bzib.nelreports.netbzib.nelreports.net.akamaized.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:03.348510027 CEST1.1.1.1192.168.2.40x1691No error (0)clients2.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:03.348510027 CEST1.1.1.1192.168.2.40x1691No error (0)googlehosted.l.googleusercontent.com142.250.184.193A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:03.349124908 CEST1.1.1.1192.168.2.40xade5No error (0)clients2.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:04.683130026 CEST1.1.1.1192.168.2.40x3e2No error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:04.683130026 CEST1.1.1.1192.168.2.40x3e2No error (0)sni1gl.wpc.nucdn.net152.199.21.175A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:04.683759928 CEST1.1.1.1192.168.2.40xfd4cNo error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.208659887 CEST1.1.1.1192.168.2.40x757dNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.208659887 CEST1.1.1.1192.168.2.40x757dNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.221280098 CEST1.1.1.1192.168.2.40x7643No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.221290112 CEST1.1.1.1192.168.2.40xda3eNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.221290112 CEST1.1.1.1192.168.2.40xda3eNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.221298933 CEST1.1.1.1192.168.2.40x1349No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.316015005 CEST1.1.1.1192.168.2.40xf6a0No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.316015005 CEST1.1.1.1192.168.2.40xf6a0No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.316169977 CEST1.1.1.1192.168.2.40x4953No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.316473961 CEST1.1.1.1192.168.2.40x496fNo error (0)shed.dual-low.s-part-0036.t-0009.t-msedge.nets-part-0036.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.316473961 CEST1.1.1.1192.168.2.40x496fNo error (0)s-part-0036.t-0009.t-msedge.net13.107.246.64A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:05.696300983 CEST1.1.1.1192.168.2.40x5eaeNo error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:06.230287075 CEST1.1.1.1192.168.2.40xab55No error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:06.253057957 CEST1.1.1.1192.168.2.40x2aecNo error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:06.347110033 CEST1.1.1.1192.168.2.40x862bNo error (0)scdn1f005.wpc.ad629.nucdn.netsni1gl.wpc.nucdn.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:06.347110033 CEST1.1.1.1192.168.2.40x862bNo error (0)sni1gl.wpc.nucdn.net152.195.19.97A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.269109964 CEST1.1.1.1192.168.2.40xf289No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.269109964 CEST1.1.1.1192.168.2.40xf289No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.291440964 CEST1.1.1.1192.168.2.40xfd9bNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.325831890 CEST1.1.1.1192.168.2.40x9118No error (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.967011929 CEST1.1.1.1192.168.2.40x4380No error (0)example.org93.184.215.14A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.972079039 CEST1.1.1.1192.168.2.40xb376No error (0)ipv4only.arpa192.0.0.171A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.972079039 CEST1.1.1.1192.168.2.40xb376No error (0)ipv4only.arpa192.0.0.170A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.973212957 CEST1.1.1.1192.168.2.40x98bcNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:08.973212957 CEST1.1.1.1192.168.2.40x98bcNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.664194107 CEST1.1.1.1192.168.2.40x5ceeNo error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.664194107 CEST1.1.1.1192.168.2.40x5ceeNo error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.687942982 CEST1.1.1.1192.168.2.40x59d9No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.689253092 CEST1.1.1.1192.168.2.40xdde9No error (0)firefox.settings.services.mozilla.comprod.remote-settings.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.689253092 CEST1.1.1.1192.168.2.40xdde9No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.696846962 CEST1.1.1.1192.168.2.40x5fc3No error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.874277115 CEST1.1.1.1192.168.2.40xa381No error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.874277115 CEST1.1.1.1192.168.2.40xa381No error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.874277115 CEST1.1.1.1192.168.2.40xa381No error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.874277115 CEST1.1.1.1192.168.2.40xa381No error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.895754099 CEST1.1.1.1192.168.2.40xc450No error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.895754099 CEST1.1.1.1192.168.2.40xc450No error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.895754099 CEST1.1.1.1192.168.2.40xc450No error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:33.895754099 CEST1.1.1.1192.168.2.40xc450No error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:34.176729918 CEST1.1.1.1192.168.2.40xf55fNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:34.176729918 CEST1.1.1.1192.168.2.40xf55fNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:34.649861097 CEST1.1.1.1192.168.2.40x71aNo error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:34.649861097 CEST1.1.1.1192.168.2.40x71aNo error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                              Aug 24, 2024 04:30:35.171650887 CEST1.1.1.1192.168.2.40xf1bfNo error (0)a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.coma17.rackcdn.comCNAME (Canonical name)IN (0x0001)false
                                                              Aug 24, 2024 04:30:35.171650887 CEST1.1.1.1192.168.2.40xf1bfNo error (0)a17.rackcdn.coma17.rackcdn.com.mdc.edgesuite.netCNAME (Canonical name)IN (0x0001)false

                                                              HTTP Request Dependency Graph

                                                              • clients2.googleusercontent.com
                                                              • chrome.cloudflare-dns.com
                                                              • edgeassetservice.azureedge.net
                                                              • msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
                                                              • https:
                                                                • www.google.com
                                                              • fs.microsoft.com
                                                              • www.googleapis.com
                                                              • slscr.update.microsoft.com
                                                              • detectportal.firefox.com

                                                              HTTP Packets

                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              0192.168.2.44978534.107.221.82801308C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Aug 24, 2024 04:30:08.291402102 CEST303OUTGET /canonical.html HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Connection: keep-alive
                                                              Aug 24, 2024 04:30:08.748351097 CEST298INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 90
                                                              Via: 1.1 google
                                                              Date: Fri, 23 Aug 2024 15:03:14 GMT
                                                              Age: 41214
                                                              Content-Type: text/html
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                              Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                              Aug 24, 2024 04:30:18.762898922 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:30:28.801175117 CEST6OUTData Raw: 00
                                                              Data Ascii:


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              1192.168.2.44979034.107.221.82801308C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Aug 24, 2024 04:30:08.979027987 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Connection: keep-alive
                                                              Pragma: no-cache
                                                              Cache-Control: no-cache
                                                              Aug 24, 2024 04:30:09.424133062 CEST216INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 8
                                                              Via: 1.1 google
                                                              Date: Fri, 23 Aug 2024 18:39:18 GMT
                                                              Age: 28251
                                                              Content-Type: text/plain
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 73 75 63 63 65 73 73 0a
                                                              Data Ascii: success
                                                              Aug 24, 2024 04:30:19.435955048 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:30:29.450119019 CEST6OUTData Raw: 00
                                                              Data Ascii:


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              2192.168.2.44980334.107.221.82801308C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Aug 24, 2024 04:30:34.176287889 CEST303OUTGET /canonical.html HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Connection: keep-alive
                                                              Aug 24, 2024 04:30:34.626058102 CEST298INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 90
                                                              Via: 1.1 google
                                                              Date: Fri, 23 Aug 2024 16:11:10 GMT
                                                              Age: 37164
                                                              Content-Type: text/html
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                              Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                              Aug 24, 2024 04:30:34.645708084 CEST303OUTGET /canonical.html HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Connection: keep-alive
                                                              Aug 24, 2024 04:30:34.744628906 CEST298INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 90
                                                              Via: 1.1 google
                                                              Date: Fri, 23 Aug 2024 16:11:10 GMT
                                                              Age: 37164
                                                              Content-Type: text/html
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                              Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                              Aug 24, 2024 04:30:35.130665064 CEST303OUTGET /canonical.html HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Connection: keep-alive
                                                              Aug 24, 2024 04:30:35.226768970 CEST298INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 90
                                                              Via: 1.1 google
                                                              Date: Fri, 23 Aug 2024 16:11:10 GMT
                                                              Age: 37165
                                                              Content-Type: text/html
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                              Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                              Aug 24, 2024 04:30:45.227685928 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:30:55.247927904 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:05.258791924 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:15.265743017 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:25.282182932 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:35.287642956 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:45.300311089 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:55.306907892 CEST6OUTData Raw: 00
                                                              Data Ascii:


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              3192.168.2.44980534.107.221.82801308C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Aug 24, 2024 04:30:34.641535997 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Connection: keep-alive
                                                              Pragma: no-cache
                                                              Cache-Control: no-cache


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              4192.168.2.44980934.107.221.82801308C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Aug 24, 2024 04:30:34.757616043 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Connection: keep-alive
                                                              Pragma: no-cache
                                                              Cache-Control: no-cache
                                                              Aug 24, 2024 04:30:35.231879950 CEST216INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 8
                                                              Via: 1.1 google
                                                              Date: Fri, 23 Aug 2024 18:39:18 GMT
                                                              Age: 28277
                                                              Content-Type: text/plain
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 73 75 63 63 65 73 73 0a
                                                              Data Ascii: success


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              5192.168.2.44981134.107.221.82801308C:\Program Files\Mozilla Firefox\firefox.exe
                                                              TimestampBytes transferredDirectionData
                                                              Aug 24, 2024 04:30:35.234994888 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                              Host: detectportal.firefox.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                              Accept: */*
                                                              Accept-Language: en-US,en;q=0.5
                                                              Accept-Encoding: gzip, deflate
                                                              Connection: keep-alive
                                                              Pragma: no-cache
                                                              Cache-Control: no-cache
                                                              Aug 24, 2024 04:30:35.705960035 CEST216INHTTP/1.1 200 OK
                                                              Server: nginx
                                                              Content-Length: 8
                                                              Via: 1.1 google
                                                              Date: Fri, 23 Aug 2024 18:39:18 GMT
                                                              Age: 28277
                                                              Content-Type: text/plain
                                                              Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                              Data Raw: 73 75 63 63 65 73 73 0a
                                                              Data Ascii: success
                                                              Aug 24, 2024 04:30:45.713346004 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:30:55.739264965 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:05.775912046 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:15.782844067 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:25.793746948 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:35.800344944 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:45.817444086 CEST6OUTData Raw: 00
                                                              Data Ascii:
                                                              Aug 24, 2024 04:31:55.824115992 CEST6OUTData Raw: 00
                                                              Data Ascii:


                                                              HTTPS Proxied Packets

                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              0192.168.2.449750142.250.184.1934437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:04 UTC594OUTGET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1
                                                              Host: clients2.googleusercontent.com
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:04 UTC573INHTTP/1.1 200 OK
                                                              Accept-Ranges: bytes
                                                              Content-Length: 135751
                                                              X-GUploader-UploadID: AHxI1nP4Uq7ym029o9g0gC5fDAtfw-xCJjGzKz6hI_6xke6av19xRBqcyBfTQc29euaGs8wt0r_5tgeeow
                                                              X-Goog-Hash: crc32c=IDdmTg==
                                                              Server: UploadServer
                                                              Date: Fri, 23 Aug 2024 14:27:46 GMT
                                                              Expires: Sat, 23 Aug 2025 14:27:46 GMT
                                                              Cache-Control: public, max-age=31536000
                                                              Age: 43338
                                                              Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT
                                                              ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016
                                                              Content-Type: application/x-chrome-extension
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Connection: close
                                                              2024-08-24 02:30:04 UTC817INData Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08
                                                              Data Ascii: Cr240"0*H0^1"wgt2JG1)X4=&?[j,Lzjue[Iq*Ba/XPhL2%3_oH)'=e?j3UH|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
                                                              2024-08-24 02:30:04 UTC1390INData Raw: fd c7 0f 59 dd ca cf cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d
                                                              Data Ascii: Y0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.|ws+LT>&&Pjanss9ga:SY>
                                                              2024-08-24 02:30:04 UTC1390INData Raw: b0 78 c3 9a 50 64 5d fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad
                                                              Data Ascii: xPd]DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z|pQ"k<`ZT|uKC1Yg4ewW
                                                              2024-08-24 02:30:04 UTC1390INData Raw: d9 73 4a e4 91 70 9d a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d
                                                              Data Ascii: sJp:fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b|wt7nvtD<C}|7e^m?<F\p2uB<Yx9"AI3\[s5y~
                                                              2024-08-24 02:30:04 UTC1390INData Raw: 58 f0 77 67 86 f4 73 f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb
                                                              Data Ascii: Xwgs9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:
                                                              2024-08-24 02:30:04 UTC1390INData Raw: 4d 15 00 a4 81 86 68 ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a
                                                              Data Ascii: Mh3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:
                                                              2024-08-24 02:30:04 UTC1390INData Raw: a0 8e 2c ba 65 e8 66 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82
                                                              Data Ascii: ,ef4=%2n$hgffa,_@uYk|9.Y1+x8aBP|*].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=e*ZkLS65mj}0"$
                                                              2024-08-24 02:30:04 UTC1390INData Raw: 3f ec fa 62 d7 ae 70 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12
                                                              Data Ascii: ?bpnh"|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF|V1lvgf&3]1g>Lc(s.u
                                                              2024-08-24 02:30:04 UTC1390INData Raw: f9 d6 22 50 e1 7c 45 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39
                                                              Data Ascii: "P|E'3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9
                                                              2024-08-24 02:30:04 UTC1390INData Raw: 4e 57 c1 ef e1 60 9a 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f
                                                              Data Ascii: NW`^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gOD


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              1192.168.2.449761162.159.61.34437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:05 UTC245OUTPOST /dns-query HTTP/1.1
                                                              Host: chrome.cloudflare-dns.com
                                                              Connection: keep-alive
                                                              Content-Length: 128
                                                              Accept: application/dns-message
                                                              Accept-Language: *
                                                              User-Agent: Chrome
                                                              Accept-Encoding: identity
                                                              Content-Type: application/dns-message
                                                              2024-08-24 02:30:05 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom)TP
                                                              2024-08-24 02:30:05 UTC247INHTTP/1.1 200 OK
                                                              Server: cloudflare
                                                              Date: Sat, 24 Aug 2024 02:30:05 GMT
                                                              Content-Type: application/dns-message
                                                              Connection: close
                                                              Access-Control-Allow-Origin: *
                                                              Content-Length: 468
                                                              CF-RAY: 8b7feb1e28d642cb-EWR
                                                              alt-svc: h3=":443"; ma=86400
                                                              2024-08-24 02:30:05 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom%A)


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              2192.168.2.449762162.159.61.34437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:05 UTC245OUTPOST /dns-query HTTP/1.1
                                                              Host: chrome.cloudflare-dns.com
                                                              Connection: keep-alive
                                                              Content-Length: 128
                                                              Accept: application/dns-message
                                                              Accept-Language: *
                                                              User-Agent: Chrome
                                                              Accept-Encoding: identity
                                                              Content-Type: application/dns-message
                                                              2024-08-24 02:30:05 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom)TP
                                                              2024-08-24 02:30:05 UTC247INHTTP/1.1 200 OK
                                                              Server: cloudflare
                                                              Date: Sat, 24 Aug 2024 02:30:05 GMT
                                                              Content-Type: application/dns-message
                                                              Connection: close
                                                              Access-Control-Allow-Origin: *
                                                              Content-Length: 468
                                                              CF-RAY: 8b7feb1e3a0f8c7d-EWR
                                                              alt-svc: h3=":443"; ma=86400
                                                              2024-08-24 02:30:05 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fc 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom))


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              3192.168.2.449763162.159.61.34437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:05 UTC245OUTPOST /dns-query HTTP/1.1
                                                              Host: chrome.cloudflare-dns.com
                                                              Connection: keep-alive
                                                              Content-Length: 128
                                                              Accept: application/dns-message
                                                              Accept-Language: *
                                                              User-Agent: Chrome
                                                              Accept-Encoding: identity
                                                              Content-Type: application/dns-message
                                                              2024-08-24 02:30:05 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom)TP
                                                              2024-08-24 02:30:05 UTC247INHTTP/1.1 200 OK
                                                              Server: cloudflare
                                                              Date: Sat, 24 Aug 2024 02:30:05 GMT
                                                              Content-Type: application/dns-message
                                                              Connection: close
                                                              Access-Control-Allow-Origin: *
                                                              Content-Length: 468
                                                              CF-RAY: 8b7feb1ec98742db-EWR
                                                              alt-svc: h3=":443"; ma=86400
                                                              2024-08-24 02:30:05 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 05 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                              Data Ascii: wwwgstaticcom(c)


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              4192.168.2.44976413.107.246.644437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:05 UTC711OUTGET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Edge-Asset-Group: EntityExtractionDomainsConfig
                                                              Sec-Mesh-Client-Edge-Version: 117.0.2045.47
                                                              Sec-Mesh-Client-Edge-Channel: stable
                                                              Sec-Mesh-Client-OS: Windows
                                                              Sec-Mesh-Client-OS-Version: 10.0.19045
                                                              Sec-Mesh-Client-Arch: x86_64
                                                              Sec-Mesh-Client-WebView: 0
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:06 UTC583INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:06 GMT
                                                              Content-Type: application/octet-stream
                                                              Content-Length: 70207
                                                              Connection: close
                                                              Content-Encoding: gzip
                                                              Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT
                                                              ETag: 0x8DCB31E67C22927
                                                              x-ms-request-id: ea88565b-f01e-003d-6c06-f5dd21000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023006Z-15c77d89844bhmk535uzmhuz380000000cp0000000007yrc
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:06 UTC15801INData Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7
                                                              Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
                                                              2024-08-24 02:30:06 UTC16384INData Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31
                                                              Data Ascii: JEq*b,0Rte*|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;|a``|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
                                                              2024-08-24 02:30:06 UTC16384INData Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63
                                                              Data Ascii: /M5?Rg|M kt|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX*$Nkct&iZ%b8Zoj@ u2OgA1DG3*5d*lg|9GV>OVzVMPA76.|c
                                                              2024-08-24 02:30:06 UTC16384INData Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81
                                                              Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
                                                              2024-08-24 02:30:06 UTC5254INData Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83
                                                              Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              5192.168.2.44976513.107.246.644437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:05 UTC486OUTGET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Edge-Asset-Group: ArbitrationService
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:06 UTC559INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:05 GMT
                                                              Content-Type: application/octet-stream
                                                              Content-Length: 11989
                                                              Connection: close
                                                              Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT
                                                              ETag: 0x8DCC30802EF150E
                                                              x-ms-request-id: 9d463e20-501e-0019-7d06-f5446f000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023005Z-15c77d89844fb9g8ewy8k6m5cc0000000dgg000000002vxk
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:06 UTC11989INData Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45
                                                              Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              6192.168.2.44976613.107.246.644437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:06 UTC470OUTGET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Edge-Asset-Group: Shoreline
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:06 UTC563INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:06 GMT
                                                              Content-Type: application/octet-stream
                                                              Content-Length: 306698
                                                              Connection: close
                                                              Content-Encoding: gzip
                                                              Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT
                                                              ETag: 0x8DBC9B5C40EBFF4
                                                              x-ms-request-id: 996e2297-301e-0064-6384-f5d8a7000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023006Z-15c77d89844j2tjq56kca6f6zs0000000ad00000000079hn
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:06 UTC15821INData Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe
                                                              Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&|'J'~eL|&c~6{JAw^z3cUEeMaTu W/^~b|X_?r~vXwW
                                                              2024-08-24 02:30:06 UTC16384INData Raw: 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44
                                                              Data Ascii: |[T[%6Q+"PR6mU5YgV-HoB /!~qL|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz|PVM&UOu~{-oM5QafAp4'eD
                                                              2024-08-24 02:30:06 UTC16384INData Raw: b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d
                                                              Data Ascii: O7gkD$>U|}mlBxz*BFSzP~|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)|[U35QTB-x$$QifD
                                                              2024-08-24 02:30:06 UTC16384INData Raw: a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08
                                                              Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:*_Gp`n3.e_j;`?ihbE}*Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
                                                              2024-08-24 02:30:06 UTC16384INData Raw: 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5
                                                              Data Ascii: k/IyMR\!1Q|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0o*j~~{Y1U}n|?*4>tk,OS]|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
                                                              2024-08-24 02:30:06 UTC16384INData Raw: 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c
                                                              Data Ascii: M1eIwyfr;Tt5S};PtEr~*uVOLC=A{5__p*tHt|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<
                                                              2024-08-24 02:30:06 UTC16384INData Raw: 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9
                                                              Data Ascii: Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
                                                              2024-08-24 02:30:06 UTC16384INData Raw: 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da
                                                              Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
                                                              2024-08-24 02:30:06 UTC16384INData Raw: b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62
                                                              Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;|.'Ocl7vUh&n{G]%vHN@e]?/y+y]b
                                                              2024-08-24 02:30:06 UTC16384INData Raw: c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4
                                                              Data Ascii: /}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0*"1OvD#jK_F(Mu,abs&0`K`|'5Z:-#BoFX1-3JESJY(bJX*@D[93&Pq<jy@^2%S^?`>uBRC)


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              7192.168.2.449769152.195.19.974437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:07 UTC618OUTGET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725071402&P2=404&P3=2&P4=FAfXQEP8oG6E2is%2fQUUmdF3pUAcCOnb68LmvcnOUGZCZUfz5r%2b3TFGrN8KD8XISvw1bMH6K%2bQDCpPvNg3dW9TA%3d%3d HTTP/1.1
                                                              Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
                                                              Connection: keep-alive
                                                              MS-CV: 293Pjiwc74qJFstXUvBKqF
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:07 UTC632INHTTP/1.1 200 OK
                                                              Accept-Ranges: bytes
                                                              Age: 4393138
                                                              Cache-Control: public, max-age=17280000
                                                              Content-Type: application/x-chrome-extension
                                                              Date: Sat, 24 Aug 2024 02:30:07 GMT
                                                              Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8="
                                                              Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT
                                                              MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31
                                                              MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0
                                                              MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4
                                                              Server: ECAcc (nyd/D11E)
                                                              X-AspNet-Version: 4.0.30319
                                                              X-AspNetMvc-Version: 5.3
                                                              X-Cache: HIT
                                                              X-CCC: US
                                                              X-CID: 11
                                                              X-Powered-By: ASP.NET
                                                              X-Powered-By: ARR/3.0
                                                              X-Powered-By: ASP.NET
                                                              Content-Length: 11185
                                                              Connection: close
                                                              2024-08-24 02:30:07 UTC11185INData Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20
                                                              Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              8192.168.2.449779142.251.40.1104437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:07 UTC579OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                              Host: play.google.com
                                                              Connection: keep-alive
                                                              Accept: */*
                                                              Access-Control-Request-Method: POST
                                                              Access-Control-Request-Headers: x-goog-authuser
                                                              Origin: https://accounts.google.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Sec-Fetch-Mode: cors
                                                              Sec-Fetch-Site: same-site
                                                              Sec-Fetch-Dest: empty
                                                              Referer: https://accounts.google.com/
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:07 UTC520INHTTP/1.1 200 OK
                                                              Access-Control-Allow-Origin: https://accounts.google.com
                                                              Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                              Access-Control-Max-Age: 86400
                                                              Access-Control-Allow-Credentials: true
                                                              Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                              Content-Type: text/plain; charset=UTF-8
                                                              Date: Sat, 24 Aug 2024 02:30:07 GMT
                                                              Server: Playlog
                                                              Content-Length: 0
                                                              X-XSS-Protection: 0
                                                              X-Frame-Options: SAMEORIGIN
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Connection: close


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              9192.168.2.449778142.251.40.1104437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:07 UTC579OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                              Host: play.google.com
                                                              Connection: keep-alive
                                                              Accept: */*
                                                              Access-Control-Request-Method: POST
                                                              Access-Control-Request-Headers: x-goog-authuser
                                                              Origin: https://accounts.google.com
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Sec-Fetch-Mode: cors
                                                              Sec-Fetch-Site: same-site
                                                              Sec-Fetch-Dest: empty
                                                              Referer: https://accounts.google.com/
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:07 UTC520INHTTP/1.1 200 OK
                                                              Access-Control-Allow-Origin: https://accounts.google.com
                                                              Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                              Access-Control-Max-Age: 86400
                                                              Access-Control-Allow-Credentials: true
                                                              Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                              Content-Type: text/plain; charset=UTF-8
                                                              Date: Sat, 24 Aug 2024 02:30:07 GMT
                                                              Server: Playlog
                                                              Content-Length: 0
                                                              X-XSS-Protection: 0
                                                              X-Frame-Options: SAMEORIGIN
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Connection: close


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              10192.168.2.44977413.107.246.404437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:07 UTC431OUTGET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:08 UTC543INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:07 GMT
                                                              Content-Type: image/png
                                                              Content-Length: 1966
                                                              Connection: close
                                                              Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT
                                                              ETag: 0x8DBDCB5EC122A94
                                                              x-ms-request-id: 34f43450-901e-0062-3e89-f52fdf000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023007Z-15c77d89844fb9g8ewy8k6m5cc0000000dg0000000003yu9
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:08 UTC1966INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc
                                                              Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNnt*w<T:A*-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              11192.168.2.44977313.107.246.404437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:07 UTC433OUTGET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:08 UTC543INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:07 GMT
                                                              Content-Type: image/png
                                                              Content-Length: 1751
                                                              Connection: close
                                                              Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT
                                                              ETag: 0x8DBCEA8D5AACC85
                                                              x-ms-request-id: c5621c3e-101e-001e-7a6a-f5b2ea000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023007Z-15c77d89844s74b6f00rmfgxs00000000dn000000000c65a
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:08 UTC1751INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7
                                                              Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              12192.168.2.44977613.107.246.404437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:07 UTC433OUTGET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:08 UTC543INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:07 GMT
                                                              Content-Type: image/png
                                                              Content-Length: 1427
                                                              Connection: close
                                                              Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT
                                                              ETag: 0x8DBDCB5EF021F8E
                                                              x-ms-request-id: c872ec7e-501e-0056-326a-f58077000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023007Z-15c77d89844sw96qqartrpgkmc0000000c30000000002963
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:08 UTC1427INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89
                                                              Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              13192.168.2.44977713.107.246.404437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:07 UTC430OUTGET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:08 UTC543INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:07 GMT
                                                              Content-Type: image/png
                                                              Content-Length: 2008
                                                              Connection: close
                                                              Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT
                                                              ETag: 0x8DBC9B5C0C17219
                                                              x-ms-request-id: 9d4d0421-d01e-0003-5e8f-f56b00000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023007Z-15c77d89844bhmk535uzmhuz380000000cpg00000000728t
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:08 UTC2008INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73
                                                              Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              14192.168.2.44977213.107.246.404437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:07 UTC422OUTGET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:08 UTC543INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:07 GMT
                                                              Content-Type: image/png
                                                              Content-Length: 2229
                                                              Connection: close
                                                              Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT
                                                              ETag: 0x8DBD59359A9E77B
                                                              x-ms-request-id: 91564f5f-a01e-0048-7d5f-f55a9a000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023007Z-15c77d89844n564ch5vmt0hbn00000000c0g00000000q4ds
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:08 UTC2229INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8
                                                              Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              15192.168.2.44977513.107.246.404437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:07 UTC425OUTGET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:08 UTC522INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:07 GMT
                                                              Content-Type: image/png
                                                              Content-Length: 1154
                                                              Connection: close
                                                              Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT
                                                              ETag: 0x8DBD5935D5B3965
                                                              x-ms-request-id: 3757ef32-a01e-0007-2b5f-f59e82000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023007Z-15c77d89844wjss9q4wnt54wg40000000cs0000000007285
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:08 UTC1154INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8
                                                              Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              16192.168.2.449780184.28.90.27443
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:08 UTC161OUTHEAD /fs/windows/config.json HTTP/1.1
                                                              Connection: Keep-Alive
                                                              Accept: */*
                                                              Accept-Encoding: identity
                                                              User-Agent: Microsoft BITS/7.8
                                                              Host: fs.microsoft.com
                                                              2024-08-24 02:30:08 UTC467INHTTP/1.1 200 OK
                                                              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                              Content-Type: application/octet-stream
                                                              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                              Server: ECAcc (lpl/EF70)
                                                              X-CID: 11
                                                              X-Ms-ApiVersion: Distribute 1.2
                                                              X-Ms-Region: prod-weu-z1
                                                              Cache-Control: public, max-age=137732
                                                              Date: Sat, 24 Aug 2024 02:30:08 GMT
                                                              Connection: close
                                                              X-CID: 2


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              17192.168.2.449781142.251.40.1644437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:08 UTC899OUTGET /favicon.ico HTTP/1.1
                                                              Host: www.google.com
                                                              Connection: keep-alive
                                                              sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                              sec-ch-ua-mobile: ?0
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              sec-ch-ua-arch: "x86"
                                                              sec-ch-ua-full-version: "117.0.2045.47"
                                                              sec-ch-ua-platform-version: "10.0.0"
                                                              sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                              sec-ch-ua-bitness: "64"
                                                              sec-ch-ua-model: ""
                                                              sec-ch-ua-wow64: ?0
                                                              sec-ch-ua-platform: "Windows"
                                                              Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                              Sec-Fetch-Site: same-site
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: image
                                                              Referer: https://accounts.google.com/
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:08 UTC704INHTTP/1.1 200 OK
                                                              Accept-Ranges: bytes
                                                              Cross-Origin-Resource-Policy: cross-origin
                                                              Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable"
                                                              Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
                                                              Content-Length: 5430
                                                              X-Content-Type-Options: nosniff
                                                              Server: sffe
                                                              X-XSS-Protection: 0
                                                              Date: Sat, 24 Aug 2024 02:15:29 GMT
                                                              Expires: Sun, 01 Sep 2024 02:15:29 GMT
                                                              Cache-Control: public, max-age=691200
                                                              Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT
                                                              Content-Type: image/x-icon
                                                              Vary: Accept-Encoding
                                                              Age: 879
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Connection: close
                                                              2024-08-24 02:30:08 UTC686INData Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff
                                                              Data Ascii: h& ( 0.v]X:X:rY
                                                              2024-08-24 02:30:08 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb
                                                              Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
                                                              2024-08-24 02:30:08 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc
                                                              Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
                                                              2024-08-24 02:30:08 UTC1390INData Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                              Data Ascii: BBBBBBF!4I
                                                              2024-08-24 02:30:08 UTC574INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                              Data Ascii: $'


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              18192.168.2.44978213.107.246.404437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:08 UTC431OUTGET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1
                                                              Host: edgeassetservice.azureedge.net
                                                              Connection: keep-alive
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:08 UTC543INHTTP/1.1 200 OK
                                                              Date: Sat, 24 Aug 2024 02:30:08 GMT
                                                              Content-Type: image/png
                                                              Content-Length: 1468
                                                              Connection: close
                                                              Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT
                                                              ETag: 0x8DBDCB5E23DFC43
                                                              x-ms-request-id: 1502b88b-c01e-0058-5c77-f56c7c000000
                                                              x-ms-version: 2009-09-19
                                                              x-ms-lease-status: unlocked
                                                              x-ms-blob-type: BlockBlob
                                                              x-azure-ref: 20240824T023008Z-15c77d89844fb9g8ewy8k6m5cc0000000d9g00000000f0a7
                                                              Cache-Control: public, max-age=604800
                                                              x-fd-int-roxy-purgeid: 69316365
                                                              X-Cache: TCP_HIT
                                                              X-Cache-Info: L1_T2
                                                              Accept-Ranges: bytes
                                                              2024-08-24 02:30:08 UTC1468INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6
                                                              Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              19192.168.2.449786184.28.90.27443
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:09 UTC239OUTGET /fs/windows/config.json HTTP/1.1
                                                              Connection: Keep-Alive
                                                              Accept: */*
                                                              Accept-Encoding: identity
                                                              If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT
                                                              Range: bytes=0-2147483646
                                                              User-Agent: Microsoft BITS/7.8
                                                              Host: fs.microsoft.com
                                                              2024-08-24 02:30:09 UTC515INHTTP/1.1 200 OK
                                                              ApiVersion: Distribute 1.1
                                                              Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json
                                                              Content-Type: application/octet-stream
                                                              ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7"
                                                              Last-Modified: Tue, 16 May 2017 22:58:00 GMT
                                                              Server: ECAcc (lpl/EF06)
                                                              X-CID: 11
                                                              X-Ms-ApiVersion: Distribute 1.2
                                                              X-Ms-Region: prod-weu-z1
                                                              Cache-Control: public, max-age=137706
                                                              Date: Sat, 24 Aug 2024 02:30:09 GMT
                                                              Content-Length: 55
                                                              Connection: close
                                                              X-CID: 2
                                                              2024-08-24 02:30:09 UTC55INData Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d
                                                              Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              20192.168.2.449792142.251.40.1064437528C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:10 UTC448OUTPOST /chromewebstore/v1.1/items/verify HTTP/1.1
                                                              Host: www.googleapis.com
                                                              Connection: keep-alive
                                                              Content-Length: 119
                                                              Content-Type: application/json
                                                              Sec-Fetch-Site: none
                                                              Sec-Fetch-Mode: no-cors
                                                              Sec-Fetch-Dest: empty
                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                              Accept-Encoding: gzip, deflate, br
                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                              2024-08-24 02:30:10 UTC119OUTData Raw: 7b 22 68 61 73 68 22 3a 22 77 41 77 79 65 4c 41 4a 35 6c 59 57 64 42 7a 33 4c 6d 49 79 69 37 54 77 73 6d 46 2b 31 75 4e 7a 49 63 2f 43 75 38 46 53 57 4e 30 3d 22 2c 22 69 64 73 22 3a 5b 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d
                                                              Data Ascii: {"hash":"wAwyeLAJ5lYWdBz3LmIyi7TwsmF+1uNzIc/Cu8FSWN0=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}
                                                              2024-08-24 02:30:10 UTC341INHTTP/1.1 200 OK
                                                              Content-Type: application/json; charset=UTF-8
                                                              Vary: Origin
                                                              Vary: X-Origin
                                                              Vary: Referer
                                                              Date: Sat, 24 Aug 2024 02:30:10 GMT
                                                              Server: ESF
                                                              Content-Length: 483
                                                              X-XSS-Protection: 0
                                                              X-Frame-Options: SAMEORIGIN
                                                              X-Content-Type-Options: nosniff
                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                              Connection: close
                                                              2024-08-24 02:30:10 UTC483INData Raw: 7b 0a 20 20 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 20 31 2c 0a 20 20 22 73 69 67 6e 61 74 75 72 65 22 3a 20 22 45 38 53 43 50 67 7a 5a 63 45 59 36 55 65 45 4a 4f 39 63 2f 47 34 55 46 2b 72 49 41 65 51 33 59 44 6c 5a 51 32 2b 31 4f 64 48 2f 2b 2b 57 32 6c 5a 2b 79 4d 6b 67 35 4e 34 65 56 6a 47 45 42 4b 6a 4f 78 48 33 57 45 35 75 2f 4a 4a 54 51 5a 59 62 49 76 55 4d 47 5a 71 31 78 50 46 2f 66 4a 2b 59 33 75 4f 72 5a 62 63 69 6c 44 47 4b 44 73 51 76 6d 2f 6e 46 6d 34 49 4f 57 4c 79 4e 64 6a 52 4a 53 71 6f 67 46 56 59 56 33 69 61 4a 6f 45 75 4c 5a 31 71 71 51 76 68 45 34 65 70 54 33 4a 6a 63 48 6c 49 69 70 32 2b 2f 34 31 43 74 51 4c 34 58 62 39 47 51 35 71 39 45 79 50 6b 4a 56 36 38 2b 73 7a 47 7a 33 73 78 65 49 73 2b 69 73 68 63 61 7a 45 48
                                                              Data Ascii: { "protocol_version": 1, "signature": "E8SCPgzZcEY6UeEJO9c/G4UF+rIAeQ3YDlZQ2+1OdH/++W2lZ+yMkg5N4eVjGEBKjOxH3WE5u/JJTQZYbIvUMGZq1xPF/fJ+Y3uOrZbcilDGKDsQvm/nFm4IOWLyNdjRJSqogFVYV3iaJoEuLZ1qqQvhE4epT3JjcHlIip2+/41CtQL4Xb9GQ5q9EyPkJV68+szGz3sxeIs+ishcazEH


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              21192.168.2.44979340.127.169.103443
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:15 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZG6HXcpbTsvDHyu&MD=dzM9PfNg HTTP/1.1
                                                              Connection: Keep-Alive
                                                              Accept: */*
                                                              User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                              Host: slscr.update.microsoft.com
                                                              2024-08-24 02:30:15 UTC560INHTTP/1.1 200 OK
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Content-Type: application/octet-stream
                                                              Expires: -1
                                                              Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                              ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                              MS-CorrelationId: 358e7889-33bf-4b35-a37f-2176cdbe79ca
                                                              MS-RequestId: 64dc973a-cf4c-442e-91b8-c3d57e32034d
                                                              MS-CV: I+Bgq5APzku0GY0o.0
                                                              X-Microsoft-SLSClientCache: 2880
                                                              Content-Disposition: attachment; filename=environment.cab
                                                              X-Content-Type-Options: nosniff
                                                              Date: Sat, 24 Aug 2024 02:30:15 GMT
                                                              Connection: close
                                                              Content-Length: 24490
                                                              2024-08-24 02:30:15 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                              Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                              2024-08-24 02:30:15 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                              Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                              22192.168.2.44981240.127.169.103443
                                                              TimestampBytes transferredDirectionData
                                                              2024-08-24 02:30:54 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZG6HXcpbTsvDHyu&MD=dzM9PfNg HTTP/1.1
                                                              Connection: Keep-Alive
                                                              Accept: */*
                                                              User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                              Host: slscr.update.microsoft.com
                                                              2024-08-24 02:30:54 UTC560INHTTP/1.1 200 OK
                                                              Cache-Control: no-cache
                                                              Pragma: no-cache
                                                              Content-Type: application/octet-stream
                                                              Expires: -1
                                                              Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                              ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440"
                                                              MS-CorrelationId: 5ea95d90-a554-4617-95eb-1ea089dcd913
                                                              MS-RequestId: ffa2640e-cd6f-4f6e-be29-b4cce63222ab
                                                              MS-CV: CKdRBt633UuI1HOb.0
                                                              X-Microsoft-SLSClientCache: 1440
                                                              Content-Disposition: attachment; filename=environment.cab
                                                              X-Content-Type-Options: nosniff
                                                              Date: Sat, 24 Aug 2024 02:30:54 GMT
                                                              Connection: close
                                                              Content-Length: 30005
                                                              2024-08-24 02:30:54 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e
                                                              Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
                                                              2024-08-24 02:30:54 UTC14181INData Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f
                                                              Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro


                                                              Statistics

                                                              CPU Usage

                                                              Click to jump to process

                                                              Memory Usage

                                                              Click to jump to process

                                                              High Level Behavior Distribution

                                                              Click to dive into process behavior distribution

                                                              Behavior

                                                              Click to jump to process

                                                              System Behavior

                                                              General

                                                              Target ID:0
                                                              Start time:22:29:55
                                                              Start date:23/08/2024
                                                              Path:C:\Users\user\Desktop\file.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Users\user\Desktop\file.exe"
                                                              Imagebase:0xf30000
                                                              File size:917'504 bytes
                                                              MD5 hash:928D7803F08676539035325D8697FC53
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:low
                                                              Has exited:true

                                                              General

                                                              Target ID:1
                                                              Start time:22:29:56
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:2
                                                              Start time:22:29:56
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                              Imagebase:0x7ff6bf500000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:3
                                                              Start time:22:29:56
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd --attempting-deelevation
                                                              Imagebase:0x7ff6bf500000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:true

                                                              General

                                                              Target ID:4
                                                              Start time:22:29:56
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                              Imagebase:0x7ff6bf500000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:false

                                                              General

                                                              Target ID:6
                                                              Start time:22:29:56
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=2020,i,9690704396746272970,7138892134863444414,262144 /prefetch:3
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:7
                                                              Start time:22:29:56
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:false

                                                              General

                                                              Target ID:8
                                                              Start time:22:29:58
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:3
                                                              Imagebase:0x8e0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:false

                                                              General

                                                              Target ID:11
                                                              Start time:22:30:01
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {417e413c-0ac2-4c75-986c-e5a7a571dbf5} 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 2191046bb10 socket
                                                              Imagebase:0x7ff6bf500000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high
                                                              Has exited:false

                                                              General

                                                              Target ID:12
                                                              Start time:22:30:01
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6328 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:13
                                                              Start time:22:30:01
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6616 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:14
                                                              Start time:22:30:03
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6432 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
                                                              Imagebase:0x7ff774dc0000
                                                              File size:1'255'976 bytes
                                                              MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate
                                                              Has exited:true

                                                              General

                                                              Target ID:15
                                                              Start time:22:30:03
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6432 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
                                                              Imagebase:0x7ff774dc0000
                                                              File size:1'255'976 bytes
                                                              MD5 hash:76C58E5BABFE4ACF0308AA646FC0F416
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:16
                                                              Start time:22:30:07
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3740 -parentBuildID 20230927232528 -prefsHandle 2644 -prefMapHandle 2632 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc0ed6fd-ea1d-4451-9064-cb3a34864dc1} 1308 "\\.\pipe\gecko-crash-server-pipe.1308" 21922520010 rdd
                                                              Imagebase:0x7ff6bf500000
                                                              File size:676'768 bytes
                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              General

                                                              Target ID:18
                                                              Start time:22:30:15
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:19
                                                              Start time:22:30:15
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2056,i,13833807712326710726,497949093223533568,262144 /prefetch:3
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:22
                                                              Start time:22:30:23
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:23
                                                              Start time:22:30:23
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2032,i,17075278910170813969,5314795059078489493,262144 /prefetch:3
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:true

                                                              General

                                                              Target ID:25
                                                              Start time:22:30:57
                                                              Start date:23/08/2024
                                                              Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6564 --field-trial-handle=2004,i,17858570832628587952,3287302538124252717,262144 /prefetch:8
                                                              Imagebase:0x7ff67dcd0000
                                                              File size:4'210'216 bytes
                                                              MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                              Has elevated privileges:false
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Has exited:false

                                                              Disassembly

                                                              Reset < >

                                                                Execution Graph

                                                                Execution Coverage:1.8%
                                                                Dynamic/Decrypted Code Coverage:0%
                                                                Signature Coverage:5.2%
                                                                Total number of Nodes:1369
                                                                Total number of Limit Nodes:38
                                                                execution_graph 91225 f31033 91230 f34c91 91225->91230 91229 f31042 91238 f3a961 91230->91238 91234 f34d9c 91235 f31038 91234->91235 91246 f351f7 22 API calls __fread_nolock 91234->91246 91237 f500a3 29 API calls __onexit 91235->91237 91237->91229 91247 f4fe0b 91238->91247 91240 f3a976 91257 f4fddb 91240->91257 91242 f34cff 91243 f33af0 91242->91243 91282 f33b1c 91243->91282 91246->91234 91249 f4fddb 91247->91249 91250 f4fdfa 91249->91250 91252 f4fdfc 91249->91252 91267 f5ea0c 91249->91267 91274 f54ead 7 API calls 2 library calls 91249->91274 91250->91240 91253 f5066d 91252->91253 91275 f532a4 RaiseException 91252->91275 91276 f532a4 RaiseException 91253->91276 91256 f5068a 91256->91240 91259 f4fde0 91257->91259 91258 f5ea0c ___std_exception_copy 21 API calls 91258->91259 91259->91258 91260 f4fdfa 91259->91260 91262 f4fdfc 91259->91262 91279 f54ead 7 API calls 2 library calls 91259->91279 91260->91242 91263 f5066d 91262->91263 91280 f532a4 RaiseException 91262->91280 91281 f532a4 RaiseException 91263->91281 91266 f5068a 91266->91242 91272 f63820 _abort 91267->91272 91268 f6385e 91278 f5f2d9 20 API calls _abort 91268->91278 91270 f63849 RtlAllocateHeap 91271 f6385c 91270->91271 91270->91272 91271->91249 91272->91268 91272->91270 91277 f54ead 7 API calls 2 library calls 91272->91277 91274->91249 91275->91253 91276->91256 91277->91272 91278->91271 91279->91259 91280->91263 91281->91266 91283 f33b0f 91282->91283 91284 f33b29 91282->91284 91283->91234 91284->91283 91285 f33b30 RegOpenKeyExW 91284->91285 91285->91283 91286 f33b4a RegQueryValueExW 91285->91286 91287 f33b80 RegCloseKey 91286->91287 91288 f33b6b 91286->91288 91287->91283 91288->91287 91289 f825fb 91399 f9be52 91289->91399 91292 f82605 91298 f82630 91292->91298 91299 f9be52 Sleep 91292->91299 91304 f3d880 91292->91304 91467 f4e300 23 API calls 91292->91467 91293 f3dbaf Sleep 91294 f3dbc0 91293->91294 91306 f3dbcb 91293->91306 91464 f4e551 timeGetTime 91294->91464 91295 f82b74 Sleep 91296 f82b85 91295->91296 91318 f82b90 91295->91318 91505 f4e551 timeGetTime 91296->91505 91468 f39cb3 91298->91468 91299->91292 91302 f82bdb 91311 f82c0b GetExitCodeProcess 91302->91311 91316 f82c51 91302->91316 91317 f3d9b8 messages 91302->91317 91304->91293 91304->91295 91304->91317 91327 f828ce 91304->91327 91329 f3dae8 91304->91329 91331 f3dac8 91304->91331 91336 f81dda timeGetTime 91304->91336 91338 f3da04 timeGetTime 91304->91338 91340 f3dd50 91304->91340 91347 f41310 91304->91347 91405 f3dfd0 185 API calls 3 library calls 91304->91405 91406 f3bf40 91304->91406 91466 fa3a2a 23 API calls 91304->91466 91307 f3dc56 91306->91307 91309 f82a5a 91306->91309 91310 f82a51 91306->91310 91306->91317 91325 f82a58 91306->91325 91307->91317 91502 fc29bf GetForegroundWindow 91309->91502 91501 fc29bf GetForegroundWindow 91310->91501 91312 f82c21 WaitForSingleObject 91311->91312 91313 f82c37 CloseHandle 91311->91313 91312->91313 91312->91317 91313->91316 91320 f82ca9 Sleep 91316->91320 91318->91302 91318->91317 91506 f9d4dc CreateToolhelp32Snapshot Process32FirstW 91318->91506 91319 f8267c 91475 fa3a2a 23 API calls 91319->91475 91320->91317 91322 f82b47 91504 f9e97b QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 91322->91504 91325->91307 91325->91317 91325->91322 91503 fb5658 23 API calls 91325->91503 91476 f3ec40 91327->91476 91329->91317 91334 f3daf9 messages 91329->91334 91500 fa359c 82 API calls __wsopen_s 91331->91500 91334->91293 91465 f4e300 23 API calls 91336->91465 91338->91304 91341 f3dd6f 91340->91341 91343 f3dd83 91340->91343 91516 f3d260 91341->91516 91548 fa359c 82 API calls __wsopen_s 91343->91548 91345 f3dd7a 91345->91304 91346 f82f75 91346->91346 91348 f41376 91347->91348 91349 f417b0 91347->91349 91351 f41390 91348->91351 91352 f86331 91348->91352 91580 f50242 5 API calls __Init_thread_wait 91349->91580 91356 f41940 9 API calls 91351->91356 91353 f8633d 91352->91353 91585 fb709c 185 API calls 91352->91585 91353->91304 91355 f417ba 91357 f417fb 91355->91357 91359 f39cb3 22 API calls 91355->91359 91358 f413a0 91356->91358 91362 f86346 91357->91362 91364 f4182c 91357->91364 91360 f41940 9 API calls 91358->91360 91368 f417d4 91359->91368 91361 f413b6 91360->91361 91361->91357 91363 f413ec 91361->91363 91586 fa359c 82 API calls __wsopen_s 91362->91586 91363->91362 91387 f41408 __fread_nolock 91363->91387 91582 f3aceb 23 API calls messages 91364->91582 91367 f41839 91583 f4d217 185 API calls 91367->91583 91581 f501f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 91368->91581 91371 f8636e 91587 fa359c 82 API calls __wsopen_s 91371->91587 91372 f4152f 91374 f4153c 91372->91374 91375 f863d1 91372->91375 91377 f41940 9 API calls 91374->91377 91589 fb5745 54 API calls _wcslen 91375->91589 91379 f41549 91377->91379 91378 f4fddb 22 API calls 91378->91387 91382 f41940 9 API calls 91379->91382 91393 f415c7 messages 91379->91393 91380 f41872 91584 f4faeb 23 API calls 91380->91584 91381 f4fe0b 22 API calls 91381->91387 91391 f41563 91382->91391 91383 f4171d 91383->91304 91386 f3ec40 185 API calls 91386->91387 91387->91367 91387->91371 91387->91372 91387->91378 91387->91381 91387->91386 91388 f863b2 91387->91388 91387->91393 91588 fa359c 82 API calls __wsopen_s 91388->91588 91391->91393 91590 f3a8c7 22 API calls __fread_nolock 91391->91590 91393->91380 91394 f4167b messages 91393->91394 91556 f41940 91393->91556 91566 fbac5b 91393->91566 91569 fba2ea 91393->91569 91574 fa5c5a 91393->91574 91591 fa359c 82 API calls __wsopen_s 91393->91591 91394->91383 91579 f4ce17 22 API calls messages 91394->91579 91400 f9be78 91399->91400 91401 f9be5d 91399->91401 91402 f9bea6 91400->91402 91403 f9be94 Sleep 91400->91403 91401->91292 91402->91292 91403->91402 91405->91304 91660 f3adf0 91406->91660 91408 f3bf9d 91409 f3bfa9 91408->91409 91410 f804b6 91408->91410 91411 f804c6 91409->91411 91412 f3c01e 91409->91412 91679 fa359c 82 API calls __wsopen_s 91410->91679 91680 fa359c 82 API calls __wsopen_s 91411->91680 91665 f3ac91 91412->91665 91416 f3c7da 91421 f4fe0b 22 API calls 91416->91421 91417 f97120 22 API calls 91461 f3c039 __fread_nolock messages 91417->91461 91426 f3c808 __fread_nolock 91421->91426 91423 f804f5 91427 f8055a 91423->91427 91681 f4d217 185 API calls 91423->91681 91432 f4fe0b 22 API calls 91426->91432 91450 f3c603 91427->91450 91682 fa359c 82 API calls __wsopen_s 91427->91682 91428 f4fddb 22 API calls 91428->91461 91429 f3ec40 185 API calls 91429->91461 91430 f3af8a 22 API calls 91430->91461 91431 f8091a 91692 fa3209 23 API calls 91431->91692 91462 f3c350 __fread_nolock messages 91432->91462 91435 f808a5 91436 f3ec40 185 API calls 91435->91436 91438 f808cf 91436->91438 91438->91450 91690 f3a81b 41 API calls 91438->91690 91439 f80591 91683 fa359c 82 API calls __wsopen_s 91439->91683 91440 f808f6 91691 fa359c 82 API calls __wsopen_s 91440->91691 91444 f3bbe0 40 API calls 91444->91461 91446 f3c237 91448 f3c253 91446->91448 91693 f3a8c7 22 API calls __fread_nolock 91446->91693 91452 f80976 91448->91452 91456 f3c297 messages 91448->91456 91450->91304 91451 f4fe0b 22 API calls 91451->91461 91694 f3aceb 23 API calls messages 91452->91694 91455 f809bf 91455->91450 91695 fa359c 82 API calls __wsopen_s 91455->91695 91456->91455 91676 f3aceb 23 API calls messages 91456->91676 91458 f3c335 91458->91455 91459 f3c342 91458->91459 91677 f3a704 22 API calls messages 91459->91677 91461->91416 91461->91417 91461->91423 91461->91426 91461->91427 91461->91428 91461->91429 91461->91430 91461->91431 91461->91435 91461->91439 91461->91440 91461->91444 91461->91446 91461->91450 91461->91451 91461->91455 91669 f3ad81 91461->91669 91684 f97099 22 API calls __fread_nolock 91461->91684 91685 fb5745 54 API calls _wcslen 91461->91685 91686 f4aa42 22 API calls messages 91461->91686 91687 f9f05c 40 API calls 91461->91687 91688 f3a993 41 API calls 91461->91688 91689 f3aceb 23 API calls messages 91461->91689 91463 f3c3ac 91462->91463 91678 f4ce17 22 API calls messages 91462->91678 91463->91304 91464->91306 91465->91304 91466->91304 91467->91292 91469 f39cc2 _wcslen 91468->91469 91470 f4fe0b 22 API calls 91469->91470 91471 f39cea __fread_nolock 91470->91471 91472 f4fddb 22 API calls 91471->91472 91473 f39d00 91472->91473 91474 f3a993 41 API calls 91473->91474 91474->91319 91475->91317 91497 f3ec76 messages 91476->91497 91477 f500a3 29 API calls pre_c_initialization 91477->91497 91478 f3fef7 91493 f3ed9d messages 91478->91493 91714 f3a8c7 22 API calls __fread_nolock 91478->91714 91481 f4fddb 22 API calls 91481->91497 91482 f84600 91482->91493 91713 f3a8c7 22 API calls __fread_nolock 91482->91713 91483 f84b0b 91716 fa359c 82 API calls __wsopen_s 91483->91716 91484 f3a8c7 22 API calls 91484->91497 91488 f50242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 91488->91497 91491 f3fbe3 91491->91493 91494 f84bdc 91491->91494 91499 f3f3ae messages 91491->91499 91492 f3a961 22 API calls 91492->91497 91493->91331 91717 fa359c 82 API calls __wsopen_s 91494->91717 91496 f84beb 91718 fa359c 82 API calls __wsopen_s 91496->91718 91497->91477 91497->91478 91497->91481 91497->91482 91497->91483 91497->91484 91497->91488 91497->91491 91497->91492 91497->91493 91497->91496 91498 f501f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 91497->91498 91497->91499 91711 f401e0 185 API calls 2 library calls 91497->91711 91712 f406a0 41 API calls messages 91497->91712 91498->91497 91499->91493 91715 fa359c 82 API calls __wsopen_s 91499->91715 91500->91317 91501->91325 91502->91325 91503->91322 91504->91307 91505->91318 91719 f9def7 91506->91719 91508 f9d529 Process32NextW 91509 f9d5db FindCloseChangeNotification 91508->91509 91515 f9d522 91508->91515 91509->91302 91510 f3a961 22 API calls 91510->91515 91511 f39cb3 22 API calls 91511->91515 91515->91508 91515->91509 91515->91510 91515->91511 91725 f3525f 22 API calls 91515->91725 91726 f36350 22 API calls 91515->91726 91727 f4ce60 41 API calls 91515->91727 91517 f3ec40 185 API calls 91516->91517 91528 f3d29d 91517->91528 91518 f81bc4 91555 fa359c 82 API calls __wsopen_s 91518->91555 91520 f3d30b messages 91520->91345 91521 f3d6d5 91521->91520 91531 f4fe0b 22 API calls 91521->91531 91522 f3d3c3 91522->91521 91524 f3d3ce 91522->91524 91523 f3d5ff 91526 f3d614 91523->91526 91527 f81bb5 91523->91527 91525 f4fddb 22 API calls 91524->91525 91536 f3d3d5 __fread_nolock 91525->91536 91532 f4fddb 22 API calls 91526->91532 91554 fb5705 23 API calls 91527->91554 91528->91518 91528->91520 91528->91521 91528->91522 91529 f3d4b8 91528->91529 91530 f4fddb 22 API calls 91528->91530 91543 f3d429 __fread_nolock messages 91528->91543 91534 f4fe0b 22 API calls 91529->91534 91530->91528 91531->91536 91540 f3d46a 91532->91540 91534->91543 91535 f4fddb 22 API calls 91537 f3d3f6 91535->91537 91536->91535 91536->91537 91537->91543 91549 f3bec0 185 API calls 91537->91549 91539 f81ba4 91553 fa359c 82 API calls __wsopen_s 91539->91553 91540->91345 91543->91523 91543->91539 91543->91540 91544 f81b7f 91543->91544 91546 f81b5d 91543->91546 91550 f31f6f 185 API calls 91543->91550 91552 fa359c 82 API calls __wsopen_s 91544->91552 91551 fa359c 82 API calls __wsopen_s 91546->91551 91548->91346 91549->91543 91550->91543 91551->91540 91552->91540 91553->91540 91554->91518 91555->91520 91557 f41981 91556->91557 91558 f4195d 91556->91558 91592 f50242 5 API calls __Init_thread_wait 91557->91592 91565 f4196e 91558->91565 91594 f50242 5 API calls __Init_thread_wait 91558->91594 91560 f4198b 91560->91558 91593 f501f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 91560->91593 91562 f48727 91562->91565 91595 f501f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 91562->91595 91565->91393 91596 fbad64 91566->91596 91568 fbac6f 91568->91393 91570 f37510 53 API calls 91569->91570 91571 fba306 91570->91571 91572 f9d4dc 47 API calls 91571->91572 91573 fba315 91572->91573 91573->91393 91575 f37510 53 API calls 91574->91575 91576 fa5c6d 91575->91576 91655 f9dbbe lstrlenW 91576->91655 91578 fa5c77 91578->91393 91579->91394 91580->91355 91581->91357 91582->91367 91583->91380 91584->91380 91585->91353 91586->91393 91587->91393 91588->91393 91589->91391 91590->91393 91591->91393 91592->91560 91593->91558 91594->91562 91595->91565 91597 f3a961 22 API calls 91596->91597 91598 fbad77 ___scrt_fastfail 91597->91598 91599 fbadce 91598->91599 91601 f37510 53 API calls 91598->91601 91600 fbadee 91599->91600 91602 f37510 53 API calls 91599->91602 91603 fbae3a 91600->91603 91606 f37510 53 API calls 91600->91606 91604 fbadab 91601->91604 91605 fbade4 91602->91605 91608 fbae4d ___scrt_fastfail 91603->91608 91650 f3b567 39 API calls 91603->91650 91604->91599 91609 f37510 53 API calls 91604->91609 91648 f37620 22 API calls _wcslen 91605->91648 91615 fbae04 91606->91615 91624 f37510 91608->91624 91611 fbadc4 91609->91611 91647 f37620 22 API calls _wcslen 91611->91647 91615->91603 91616 f37510 53 API calls 91615->91616 91617 fbae28 91616->91617 91617->91603 91649 f3a8c7 22 API calls __fread_nolock 91617->91649 91619 fbaec8 91619->91568 91620 fbaeb0 91620->91619 91621 fbaf35 GetProcessId 91620->91621 91622 fbaf48 91621->91622 91623 fbaf58 CloseHandle 91622->91623 91623->91619 91625 f37525 91624->91625 91641 f37522 ShellExecuteExW 91624->91641 91626 f3755b 91625->91626 91627 f3752d 91625->91627 91630 f7500f 91626->91630 91631 f3756d 91626->91631 91637 f750f6 91626->91637 91651 f551c6 26 API calls 91627->91651 91640 f4fe0b 22 API calls 91630->91640 91642 f75088 91630->91642 91652 f4fb21 51 API calls 91631->91652 91632 f7510e 91632->91632 91635 f4fddb 22 API calls 91638 f37547 91635->91638 91636 f3753d 91636->91635 91654 f55183 26 API calls 91637->91654 91639 f39cb3 22 API calls 91638->91639 91639->91641 91643 f75058 91640->91643 91641->91620 91653 f4fb21 51 API calls 91642->91653 91644 f4fddb 22 API calls 91643->91644 91645 f7507f 91644->91645 91646 f39cb3 22 API calls 91645->91646 91646->91642 91647->91599 91648->91600 91649->91603 91650->91608 91651->91636 91652->91636 91653->91637 91654->91632 91656 f9dbdc GetFileAttributesW 91655->91656 91657 f9dc06 91655->91657 91656->91657 91658 f9dbe8 FindFirstFileW 91656->91658 91657->91578 91658->91657 91659 f9dbf9 FindClose 91658->91659 91659->91657 91661 f3ae01 91660->91661 91664 f3ae1c messages 91660->91664 91696 f3aec9 91661->91696 91663 f3ae09 CharUpperBuffW 91663->91664 91664->91408 91666 f3acae 91665->91666 91667 f3acd1 91666->91667 91702 fa359c 82 API calls __wsopen_s 91666->91702 91667->91461 91670 f3ad92 91669->91670 91671 f7fadb 91669->91671 91672 f4fddb 22 API calls 91670->91672 91673 f3ad99 91672->91673 91703 f3adcd 91673->91703 91676->91458 91677->91462 91678->91462 91679->91411 91680->91450 91681->91427 91682->91450 91683->91450 91684->91461 91685->91461 91686->91461 91687->91461 91688->91461 91689->91461 91690->91440 91691->91450 91692->91446 91693->91448 91694->91455 91695->91450 91697 f3aed9 __fread_nolock 91696->91697 91698 f3aedc 91696->91698 91697->91663 91699 f4fddb 22 API calls 91698->91699 91700 f3aee7 91699->91700 91701 f4fe0b 22 API calls 91700->91701 91701->91697 91702->91667 91707 f3addd 91703->91707 91704 f3adb6 91704->91461 91705 f4fddb 22 API calls 91705->91707 91706 f3a961 22 API calls 91706->91707 91707->91704 91707->91705 91707->91706 91709 f3adcd 22 API calls 91707->91709 91710 f3a8c7 22 API calls __fread_nolock 91707->91710 91709->91707 91710->91707 91711->91497 91712->91497 91713->91493 91714->91493 91715->91493 91716->91493 91717->91496 91718->91493 91720 f9df02 91719->91720 91721 f9df19 91720->91721 91724 f9df1f 91720->91724 91728 f563b2 GetStringTypeW _strftime 91720->91728 91729 f562fb 39 API calls 91721->91729 91724->91515 91725->91515 91726->91515 91727->91515 91728->91720 91729->91724 91730 f32e37 91731 f3a961 22 API calls 91730->91731 91732 f32e4d 91731->91732 91809 f34ae3 91732->91809 91734 f32e6b 91823 f33a5a 91734->91823 91736 f32e7f 91737 f39cb3 22 API calls 91736->91737 91738 f32e8c 91737->91738 91830 f34ecb 91738->91830 91741 f72cb0 91870 fa2cf9 91741->91870 91742 f32ead 91852 f3a8c7 22 API calls __fread_nolock 91742->91852 91744 f72cc3 91746 f72ccf 91744->91746 91896 f34f39 91744->91896 91750 f34f39 68 API calls 91746->91750 91747 f32ec3 91853 f36f88 22 API calls 91747->91853 91752 f72ce5 91750->91752 91751 f32ecf 91753 f39cb3 22 API calls 91751->91753 91902 f33084 22 API calls 91752->91902 91754 f32edc 91753->91754 91854 f3a81b 41 API calls 91754->91854 91757 f32eec 91759 f39cb3 22 API calls 91757->91759 91758 f72d02 91903 f33084 22 API calls 91758->91903 91760 f32f12 91759->91760 91855 f3a81b 41 API calls 91760->91855 91763 f72d1e 91764 f33a5a 24 API calls 91763->91764 91765 f72d44 91764->91765 91904 f33084 22 API calls 91765->91904 91766 f32f21 91769 f3a961 22 API calls 91766->91769 91768 f72d50 91905 f3a8c7 22 API calls __fread_nolock 91768->91905 91771 f32f3f 91769->91771 91856 f33084 22 API calls 91771->91856 91772 f72d5e 91906 f33084 22 API calls 91772->91906 91775 f32f4b 91857 f54a28 40 API calls 3 library calls 91775->91857 91776 f72d6d 91907 f3a8c7 22 API calls __fread_nolock 91776->91907 91778 f32f59 91778->91752 91779 f32f63 91778->91779 91858 f54a28 40 API calls 3 library calls 91779->91858 91782 f32f6e 91782->91758 91784 f32f78 91782->91784 91783 f72d83 91908 f33084 22 API calls 91783->91908 91859 f54a28 40 API calls 3 library calls 91784->91859 91787 f72d90 91788 f32f83 91788->91763 91789 f32f8d 91788->91789 91860 f54a28 40 API calls 3 library calls 91789->91860 91791 f32f98 91792 f32fdc 91791->91792 91861 f33084 22 API calls 91791->91861 91792->91776 91793 f32fe8 91792->91793 91793->91787 91864 f363eb 22 API calls 91793->91864 91796 f32fbf 91862 f3a8c7 22 API calls __fread_nolock 91796->91862 91797 f32ff8 91865 f36a50 22 API calls 91797->91865 91800 f32fcd 91863 f33084 22 API calls 91800->91863 91801 f33006 91866 f370b0 23 API calls 91801->91866 91806 f33021 91807 f33065 91806->91807 91867 f36f88 22 API calls 91806->91867 91868 f370b0 23 API calls 91806->91868 91869 f33084 22 API calls 91806->91869 91810 f34af0 __wsopen_s 91809->91810 91812 f34b22 91810->91812 91912 f36b57 91810->91912 91822 f34b58 91812->91822 91909 f34c6d 91812->91909 91814 f34c29 91815 f39cb3 22 API calls 91814->91815 91816 f34c5e 91814->91816 91817 f34c52 91815->91817 91816->91734 91819 f3515f 22 API calls 91817->91819 91818 f39cb3 22 API calls 91818->91822 91819->91816 91820 f34c6d 22 API calls 91820->91822 91822->91814 91822->91818 91822->91820 91924 f3515f 91822->91924 91935 f71f50 91823->91935 91826 f39cb3 22 API calls 91827 f33a8d 91826->91827 91937 f33aa2 91827->91937 91829 f33a97 91829->91736 91957 f34e90 LoadLibraryA 91830->91957 91835 f34ef6 LoadLibraryExW 91965 f34e59 LoadLibraryA 91835->91965 91836 f73ccf 91838 f34f39 68 API calls 91836->91838 91840 f73cd6 91838->91840 91841 f34e59 3 API calls 91840->91841 91843 f73cde 91841->91843 91987 f350f5 40 API calls __fread_nolock 91843->91987 91844 f34f20 91844->91843 91845 f34f2c 91844->91845 91847 f34f39 68 API calls 91845->91847 91849 f32ea5 91847->91849 91848 f73cf5 91988 fa28fe 27 API calls 91848->91988 91849->91741 91849->91742 91851 f73d05 91852->91747 91853->91751 91854->91757 91855->91766 91856->91775 91857->91778 91858->91782 91859->91788 91860->91791 91861->91796 91862->91800 91863->91792 91864->91797 91865->91801 91866->91806 91867->91806 91868->91806 91869->91806 91871 fa2d15 91870->91871 92058 f3511f 64 API calls 91871->92058 91873 fa2d29 92059 fa2e66 75 API calls 91873->92059 91875 fa2d3b 91876 fa2d3f 91875->91876 92060 f350f5 40 API calls __fread_nolock 91875->92060 91876->91744 91878 fa2d56 92061 f350f5 40 API calls __fread_nolock 91878->92061 91880 fa2d66 92062 f350f5 40 API calls __fread_nolock 91880->92062 91882 fa2d81 92063 f350f5 40 API calls __fread_nolock 91882->92063 91884 fa2d9c 92064 f3511f 64 API calls 91884->92064 91886 fa2db3 91887 f5ea0c ___std_exception_copy 21 API calls 91886->91887 91888 fa2dba 91887->91888 91889 f5ea0c ___std_exception_copy 21 API calls 91888->91889 91890 fa2dc4 91889->91890 92065 f350f5 40 API calls __fread_nolock 91890->92065 91892 fa2dd8 92066 fa28fe 27 API calls 91892->92066 91894 fa2dee 91894->91876 92067 fa22ce 91894->92067 91897 f34f43 91896->91897 91898 f34f4a 91896->91898 91899 f5e678 67 API calls 91897->91899 91900 f34f6a FreeLibrary 91898->91900 91901 f34f59 91898->91901 91899->91898 91900->91901 91901->91746 91902->91758 91903->91763 91904->91768 91905->91772 91906->91776 91907->91783 91908->91787 91910 f3aec9 22 API calls 91909->91910 91911 f34c78 91910->91911 91911->91812 91913 f36b67 _wcslen 91912->91913 91914 f74ba1 91912->91914 91917 f36ba2 91913->91917 91918 f36b7d 91913->91918 91931 f393b2 91914->91931 91916 f74baa 91916->91916 91920 f4fddb 22 API calls 91917->91920 91930 f36f34 22 API calls 91918->91930 91922 f36bae 91920->91922 91921 f36b85 __fread_nolock 91921->91812 91923 f4fe0b 22 API calls 91922->91923 91923->91921 91925 f3516e 91924->91925 91929 f3518f __fread_nolock 91924->91929 91928 f4fe0b 22 API calls 91925->91928 91926 f4fddb 22 API calls 91927 f351a2 91926->91927 91927->91822 91928->91929 91929->91926 91930->91921 91932 f393c0 91931->91932 91934 f393c9 __fread_nolock 91931->91934 91933 f3aec9 22 API calls 91932->91933 91932->91934 91933->91934 91934->91916 91936 f33a67 GetModuleFileNameW 91935->91936 91936->91826 91938 f71f50 __wsopen_s 91937->91938 91939 f33aaf GetFullPathNameW 91938->91939 91940 f33ae9 91939->91940 91941 f33ace 91939->91941 91951 f3a6c3 91940->91951 91943 f36b57 22 API calls 91941->91943 91944 f33ada 91943->91944 91947 f337a0 91944->91947 91948 f337ae 91947->91948 91949 f393b2 22 API calls 91948->91949 91950 f337c2 91949->91950 91950->91829 91952 f3a6d0 91951->91952 91953 f3a6dd 91951->91953 91952->91944 91954 f4fddb 22 API calls 91953->91954 91955 f3a6e7 91954->91955 91956 f4fe0b 22 API calls 91955->91956 91956->91952 91958 f34ec6 91957->91958 91959 f34ea8 GetProcAddress 91957->91959 91962 f5e5eb 91958->91962 91960 f34eb8 91959->91960 91960->91958 91961 f34ebf FreeLibrary 91960->91961 91961->91958 91989 f5e52a 91962->91989 91964 f34eea 91964->91835 91964->91836 91966 f34e6e GetProcAddress 91965->91966 91967 f34e8d 91965->91967 91968 f34e7e 91966->91968 91970 f34f80 91967->91970 91968->91967 91969 f34e86 FreeLibrary 91968->91969 91969->91967 91971 f4fe0b 22 API calls 91970->91971 91972 f34f95 91971->91972 92044 f35722 91972->92044 91974 f34fa1 __fread_nolock 91975 f350a5 91974->91975 91976 f73d1d 91974->91976 91986 f34fdc 91974->91986 92047 f342a2 CreateStreamOnHGlobal 91975->92047 92055 fa304d 74 API calls 91976->92055 91979 f73d22 92056 f3511f 64 API calls 91979->92056 91982 f73d45 92057 f350f5 40 API calls __fread_nolock 91982->92057 91985 f3506e messages 91985->91844 91986->91979 91986->91985 92053 f350f5 40 API calls __fread_nolock 91986->92053 92054 f3511f 64 API calls 91986->92054 91987->91848 91988->91851 91990 f5e536 ___DestructExceptionObject 91989->91990 91991 f5e544 91990->91991 91994 f5e574 91990->91994 92014 f5f2d9 20 API calls _abort 91991->92014 91993 f5e549 92015 f627ec 26 API calls _abort 91993->92015 91996 f5e586 91994->91996 91997 f5e579 91994->91997 92006 f68061 91996->92006 92016 f5f2d9 20 API calls _abort 91997->92016 92000 f5e58f 92001 f5e595 92000->92001 92002 f5e5a2 92000->92002 92017 f5f2d9 20 API calls _abort 92001->92017 92018 f5e5d4 LeaveCriticalSection __fread_nolock 92002->92018 92004 f5e554 __fread_nolock 92004->91964 92007 f6806d ___DestructExceptionObject 92006->92007 92019 f62f5e EnterCriticalSection 92007->92019 92009 f6807b 92020 f680fb 92009->92020 92013 f680ac __fread_nolock 92013->92000 92014->91993 92015->92004 92016->92004 92017->92004 92018->92004 92019->92009 92026 f6811e 92020->92026 92021 f68177 92039 f64c7d 20 API calls 2 library calls 92021->92039 92024 f68180 92040 f629c8 20 API calls __dosmaperr 92024->92040 92026->92021 92029 f68088 92026->92029 92037 f5918d EnterCriticalSection 92026->92037 92038 f591a1 LeaveCriticalSection 92026->92038 92027 f68189 92027->92029 92041 f63405 11 API calls 2 library calls 92027->92041 92034 f680b7 92029->92034 92030 f681a8 92042 f5918d EnterCriticalSection 92030->92042 92033 f681bb 92033->92029 92043 f62fa6 LeaveCriticalSection 92034->92043 92036 f680be 92036->92013 92037->92026 92038->92026 92039->92024 92040->92027 92041->92030 92042->92033 92043->92036 92045 f4fddb 22 API calls 92044->92045 92046 f35734 92045->92046 92046->91974 92048 f342d9 92047->92048 92049 f342bc FindResourceExW 92047->92049 92048->91986 92049->92048 92050 f735ba LoadResource 92049->92050 92050->92048 92051 f735cf SizeofResource 92050->92051 92051->92048 92052 f735e3 LockResource 92051->92052 92052->92048 92053->91986 92054->91986 92055->91979 92056->91982 92057->91985 92058->91873 92059->91875 92060->91878 92061->91880 92062->91882 92063->91884 92064->91886 92065->91892 92066->91894 92068 fa22e7 92067->92068 92069 fa22d9 92067->92069 92071 fa232c 92068->92071 92072 f5e5eb 29 API calls 92068->92072 92083 fa22f0 92068->92083 92070 f5e5eb 29 API calls 92069->92070 92070->92068 92096 fa2557 40 API calls __fread_nolock 92071->92096 92073 fa2311 92072->92073 92073->92071 92076 fa231a 92073->92076 92075 fa2370 92077 fa2374 92075->92077 92078 fa2395 92075->92078 92076->92083 92104 f5e678 92076->92104 92079 fa2381 92077->92079 92082 f5e678 67 API calls 92077->92082 92097 fa2171 92078->92097 92079->92083 92085 f5e678 67 API calls 92079->92085 92082->92079 92083->91876 92084 fa239d 92086 fa23c3 92084->92086 92087 fa23a3 92084->92087 92085->92083 92117 fa23f3 74 API calls 92086->92117 92089 fa23b0 92087->92089 92090 f5e678 67 API calls 92087->92090 92089->92083 92091 f5e678 67 API calls 92089->92091 92090->92089 92091->92083 92092 fa23de 92092->92083 92095 f5e678 67 API calls 92092->92095 92093 fa23ca 92093->92092 92094 f5e678 67 API calls 92093->92094 92094->92092 92095->92083 92096->92075 92098 f5ea0c ___std_exception_copy 21 API calls 92097->92098 92099 fa217f 92098->92099 92100 f5ea0c ___std_exception_copy 21 API calls 92099->92100 92101 fa2190 92100->92101 92102 f5ea0c ___std_exception_copy 21 API calls 92101->92102 92103 fa219c 92102->92103 92103->92084 92105 f5e684 ___DestructExceptionObject 92104->92105 92106 f5e695 92105->92106 92107 f5e6aa 92105->92107 92135 f5f2d9 20 API calls _abort 92106->92135 92109 f5e6a5 __fread_nolock 92107->92109 92118 f5918d EnterCriticalSection 92107->92118 92109->92083 92111 f5e69a 92136 f627ec 26 API calls _abort 92111->92136 92112 f5e6c6 92119 f5e602 92112->92119 92115 f5e6d1 92137 f5e6ee LeaveCriticalSection __fread_nolock 92115->92137 92117->92093 92118->92112 92120 f5e624 92119->92120 92121 f5e60f 92119->92121 92127 f5e61f 92120->92127 92138 f5dc0b 92120->92138 92170 f5f2d9 20 API calls _abort 92121->92170 92123 f5e614 92171 f627ec 26 API calls _abort 92123->92171 92127->92115 92131 f5e646 92155 f6862f 92131->92155 92135->92111 92136->92109 92137->92109 92139 f5dc1f 92138->92139 92140 f5dc23 92138->92140 92144 f64d7a 92139->92144 92140->92139 92141 f5d955 __fread_nolock 26 API calls 92140->92141 92142 f5dc43 92141->92142 92173 f659be 62 API calls 5 library calls 92142->92173 92145 f5e640 92144->92145 92146 f64d90 92144->92146 92148 f5d955 92145->92148 92146->92145 92174 f629c8 20 API calls __dosmaperr 92146->92174 92149 f5d976 92148->92149 92150 f5d961 92148->92150 92149->92131 92175 f5f2d9 20 API calls _abort 92150->92175 92152 f5d966 92176 f627ec 26 API calls _abort 92152->92176 92154 f5d971 92154->92131 92156 f68653 92155->92156 92157 f6863e 92155->92157 92158 f6868e 92156->92158 92163 f6867a 92156->92163 92180 f5f2c6 20 API calls _abort 92157->92180 92182 f5f2c6 20 API calls _abort 92158->92182 92161 f68643 92181 f5f2d9 20 API calls _abort 92161->92181 92177 f68607 92163->92177 92164 f68693 92183 f5f2d9 20 API calls _abort 92164->92183 92167 f5e64c 92167->92127 92172 f629c8 20 API calls __dosmaperr 92167->92172 92168 f6869b 92184 f627ec 26 API calls _abort 92168->92184 92170->92123 92171->92127 92172->92127 92173->92139 92174->92145 92175->92152 92176->92154 92185 f68585 92177->92185 92179 f6862b 92179->92167 92180->92161 92181->92167 92182->92164 92183->92168 92184->92167 92186 f68591 ___DestructExceptionObject 92185->92186 92196 f65147 EnterCriticalSection 92186->92196 92188 f6859f 92189 f685c6 92188->92189 92190 f685d1 92188->92190 92197 f686ae 92189->92197 92212 f5f2d9 20 API calls _abort 92190->92212 92193 f685cc 92213 f685fb LeaveCriticalSection __wsopen_s 92193->92213 92195 f685ee __fread_nolock 92195->92179 92196->92188 92214 f653c4 92197->92214 92199 f686c4 92227 f65333 21 API calls 2 library calls 92199->92227 92200 f686be 92200->92199 92201 f686f6 92200->92201 92203 f653c4 __wsopen_s 26 API calls 92200->92203 92201->92199 92204 f653c4 __wsopen_s 26 API calls 92201->92204 92206 f686ed 92203->92206 92207 f68702 FindCloseChangeNotification 92204->92207 92205 f6871c 92208 f6873e 92205->92208 92228 f5f2a3 20 API calls __dosmaperr 92205->92228 92209 f653c4 __wsopen_s 26 API calls 92206->92209 92207->92199 92210 f6870e GetLastError 92207->92210 92208->92193 92209->92201 92210->92199 92212->92193 92213->92195 92215 f653e6 92214->92215 92216 f653d1 92214->92216 92221 f6540b 92215->92221 92231 f5f2c6 20 API calls _abort 92215->92231 92229 f5f2c6 20 API calls _abort 92216->92229 92218 f653d6 92230 f5f2d9 20 API calls _abort 92218->92230 92221->92200 92222 f65416 92232 f5f2d9 20 API calls _abort 92222->92232 92223 f653de 92223->92200 92225 f6541e 92233 f627ec 26 API calls _abort 92225->92233 92227->92205 92228->92208 92229->92218 92230->92223 92231->92222 92232->92225 92233->92223 92234 f33156 92237 f33170 92234->92237 92238 f33187 92237->92238 92239 f331eb 92238->92239 92240 f3318c 92238->92240 92276 f331e9 92238->92276 92244 f331f1 92239->92244 92245 f72dfb 92239->92245 92241 f33265 PostQuitMessage 92240->92241 92242 f33199 92240->92242 92278 f3316a 92241->92278 92247 f331a4 92242->92247 92248 f72e7c 92242->92248 92243 f331d0 DefWindowProcW 92243->92278 92249 f331f8 92244->92249 92250 f3321d SetTimer RegisterWindowMessageW 92244->92250 92289 f318e2 10 API calls 92245->92289 92254 f331ae 92247->92254 92255 f72e68 92247->92255 92303 f9bf30 34 API calls ___scrt_fastfail 92248->92303 92251 f33201 KillTimer 92249->92251 92252 f72d9c 92249->92252 92256 f33246 CreatePopupMenu 92250->92256 92250->92278 92282 f330f2 92251->92282 92263 f72dd7 MoveWindow 92252->92263 92264 f72da1 92252->92264 92253 f72e1c 92290 f4e499 42 API calls 92253->92290 92261 f72e4d 92254->92261 92262 f331b9 92254->92262 92302 f9c161 27 API calls ___scrt_fastfail 92255->92302 92256->92278 92261->92243 92301 f90ad7 22 API calls 92261->92301 92267 f331c4 92262->92267 92268 f33253 92262->92268 92263->92278 92270 f72da7 92264->92270 92271 f72dc6 SetFocus 92264->92271 92266 f33263 92266->92278 92267->92243 92279 f330f2 Shell_NotifyIconW 92267->92279 92287 f3326f 44 API calls ___scrt_fastfail 92268->92287 92269 f72e8e 92269->92243 92269->92278 92270->92267 92275 f72db0 92270->92275 92271->92278 92288 f318e2 10 API calls 92275->92288 92276->92243 92280 f72e41 92279->92280 92291 f33837 92280->92291 92283 f33154 92282->92283 92284 f33104 ___scrt_fastfail 92282->92284 92286 f33c50 DeleteObject DestroyWindow 92283->92286 92285 f33123 Shell_NotifyIconW 92284->92285 92285->92283 92286->92278 92287->92266 92288->92278 92289->92253 92290->92267 92292 f33862 ___scrt_fastfail 92291->92292 92304 f34212 92292->92304 92295 f338e8 92297 f73386 Shell_NotifyIconW 92295->92297 92298 f33906 Shell_NotifyIconW 92295->92298 92308 f33923 92298->92308 92300 f3391c 92300->92276 92301->92276 92302->92266 92303->92269 92305 f735a4 92304->92305 92306 f338b7 92304->92306 92305->92306 92307 f735ad DestroyIcon 92305->92307 92306->92295 92330 f9c874 42 API calls _strftime 92306->92330 92307->92306 92309 f33a13 92308->92309 92310 f3393f 92308->92310 92309->92300 92331 f36270 92310->92331 92313 f73393 LoadStringW 92316 f733ad 92313->92316 92314 f3395a 92315 f36b57 22 API calls 92314->92315 92317 f3396f 92315->92317 92324 f33994 ___scrt_fastfail 92316->92324 92337 f3a8c7 22 API calls __fread_nolock 92316->92337 92318 f733c9 92317->92318 92319 f3397c 92317->92319 92338 f36350 22 API calls 92318->92338 92319->92316 92321 f33986 92319->92321 92336 f36350 22 API calls 92321->92336 92327 f339f9 Shell_NotifyIconW 92324->92327 92325 f733d7 92325->92324 92339 f333c6 92325->92339 92327->92309 92328 f733f9 92329 f333c6 22 API calls 92328->92329 92329->92324 92330->92295 92332 f4fe0b 22 API calls 92331->92332 92333 f36295 92332->92333 92334 f4fddb 22 API calls 92333->92334 92335 f3394d 92334->92335 92335->92313 92335->92314 92336->92324 92337->92324 92338->92325 92340 f730bb 92339->92340 92341 f333dd 92339->92341 92342 f4fddb 22 API calls 92340->92342 92348 f333ee 92341->92348 92344 f730c5 _wcslen 92342->92344 92346 f4fe0b 22 API calls 92344->92346 92345 f333e8 92345->92328 92347 f730fe __fread_nolock 92346->92347 92349 f333fe _wcslen 92348->92349 92350 f33411 92349->92350 92351 f7311d 92349->92351 92358 f3a587 92350->92358 92353 f4fddb 22 API calls 92351->92353 92355 f73127 92353->92355 92354 f3341e __fread_nolock 92354->92345 92356 f4fe0b 22 API calls 92355->92356 92357 f73157 __fread_nolock 92356->92357 92359 f3a59d 92358->92359 92361 f3a598 __fread_nolock 92358->92361 92360 f4fe0b 22 API calls 92359->92360 92362 f7f80f 92359->92362 92360->92361 92361->92354 92362->92362 92363 f3105b 92368 f3344d 92363->92368 92365 f3106a 92399 f500a3 29 API calls __onexit 92365->92399 92367 f31074 92369 f3345d __wsopen_s 92368->92369 92370 f3a961 22 API calls 92369->92370 92371 f33513 92370->92371 92372 f33a5a 24 API calls 92371->92372 92373 f3351c 92372->92373 92400 f33357 92373->92400 92376 f333c6 22 API calls 92377 f33535 92376->92377 92378 f3515f 22 API calls 92377->92378 92379 f33544 92378->92379 92380 f3a961 22 API calls 92379->92380 92381 f3354d 92380->92381 92382 f3a6c3 22 API calls 92381->92382 92383 f33556 RegOpenKeyExW 92382->92383 92384 f73176 RegQueryValueExW 92383->92384 92388 f33578 92383->92388 92385 f73193 92384->92385 92386 f7320c RegCloseKey 92384->92386 92387 f4fe0b 22 API calls 92385->92387 92386->92388 92398 f7321e _wcslen 92386->92398 92389 f731ac 92387->92389 92388->92365 92390 f35722 22 API calls 92389->92390 92391 f731b7 RegQueryValueExW 92390->92391 92392 f731d4 92391->92392 92395 f731ee messages 92391->92395 92393 f36b57 22 API calls 92392->92393 92393->92395 92394 f34c6d 22 API calls 92394->92398 92395->92386 92396 f39cb3 22 API calls 92396->92398 92397 f3515f 22 API calls 92397->92398 92398->92388 92398->92394 92398->92396 92398->92397 92399->92367 92401 f71f50 __wsopen_s 92400->92401 92402 f33364 GetFullPathNameW 92401->92402 92403 f33386 92402->92403 92404 f36b57 22 API calls 92403->92404 92405 f333a4 92404->92405 92405->92376 92406 f31098 92411 f342de 92406->92411 92410 f310a7 92412 f3a961 22 API calls 92411->92412 92413 f342f5 GetVersionExW 92412->92413 92414 f36b57 22 API calls 92413->92414 92415 f34342 92414->92415 92416 f393b2 22 API calls 92415->92416 92428 f34378 92415->92428 92417 f3436c 92416->92417 92418 f337a0 22 API calls 92417->92418 92418->92428 92419 f3441b GetCurrentProcess IsWow64Process 92420 f34437 92419->92420 92421 f73824 GetSystemInfo 92420->92421 92422 f3444f LoadLibraryA 92420->92422 92423 f34460 GetProcAddress 92422->92423 92424 f3449c GetSystemInfo 92422->92424 92423->92424 92427 f34470 GetNativeSystemInfo 92423->92427 92425 f34476 92424->92425 92429 f3109d 92425->92429 92430 f3447a FreeLibrary 92425->92430 92426 f737df 92427->92425 92428->92419 92428->92426 92431 f500a3 29 API calls __onexit 92429->92431 92430->92429 92431->92410 92432 f3f7bf 92433 f3f7d3 92432->92433 92434 f3fcb6 92432->92434 92436 f3fcc2 92433->92436 92437 f4fddb 22 API calls 92433->92437 92469 f3aceb 23 API calls messages 92434->92469 92470 f3aceb 23 API calls messages 92436->92470 92439 f3f7e5 92437->92439 92439->92436 92440 f3f83e 92439->92440 92441 f3fd3d 92439->92441 92443 f41310 185 API calls 92440->92443 92459 f3ed9d messages 92440->92459 92471 fa1155 22 API calls 92441->92471 92464 f3ec76 messages 92443->92464 92444 f84beb 92477 fa359c 82 API calls __wsopen_s 92444->92477 92445 f4fddb 22 API calls 92445->92464 92448 f3fef7 92448->92459 92473 f3a8c7 22 API calls __fread_nolock 92448->92473 92449 f84600 92449->92459 92472 f3a8c7 22 API calls __fread_nolock 92449->92472 92450 f84b0b 92475 fa359c 82 API calls __wsopen_s 92450->92475 92456 f3a8c7 22 API calls 92456->92464 92457 f3fbe3 92457->92459 92460 f84bdc 92457->92460 92466 f3f3ae messages 92457->92466 92458 f3a961 22 API calls 92458->92464 92476 fa359c 82 API calls __wsopen_s 92460->92476 92462 f50242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 92462->92464 92463 f500a3 29 API calls pre_c_initialization 92463->92464 92464->92444 92464->92445 92464->92448 92464->92449 92464->92450 92464->92456 92464->92457 92464->92458 92464->92459 92464->92462 92464->92463 92465 f501f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 92464->92465 92464->92466 92467 f401e0 185 API calls 2 library calls 92464->92467 92468 f406a0 41 API calls messages 92464->92468 92465->92464 92466->92459 92474 fa359c 82 API calls __wsopen_s 92466->92474 92467->92464 92468->92464 92469->92436 92470->92441 92471->92459 92472->92459 92473->92459 92474->92459 92475->92459 92476->92444 92477->92459 92478 f83f75 92489 f4ceb1 92478->92489 92480 f83f8b 92481 f84006 92480->92481 92498 f4e300 23 API calls 92480->92498 92483 f3bf40 185 API calls 92481->92483 92484 f84052 92483->92484 92488 f84a88 92484->92488 92500 fa359c 82 API calls __wsopen_s 92484->92500 92486 f83fe6 92486->92484 92499 fa1abf 22 API calls 92486->92499 92490 f4ced2 92489->92490 92491 f4cebf 92489->92491 92493 f4cf05 92490->92493 92494 f4ced7 92490->92494 92501 f3aceb 23 API calls messages 92491->92501 92502 f3aceb 23 API calls messages 92493->92502 92496 f4fddb 22 API calls 92494->92496 92497 f4cec9 92496->92497 92497->92480 92498->92486 92499->92481 92500->92488 92501->92497 92502->92497 92503 f503fb 92504 f50407 ___DestructExceptionObject 92503->92504 92532 f4feb1 92504->92532 92506 f5040e 92507 f50561 92506->92507 92510 f50438 92506->92510 92562 f5083f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 92507->92562 92509 f50568 92555 f54e52 92509->92555 92521 f50477 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 92510->92521 92543 f6247d 92510->92543 92517 f50457 92519 f504d8 92551 f50959 92519->92551 92521->92519 92558 f54e1a 38 API calls 2 library calls 92521->92558 92523 f504de 92524 f504f3 92523->92524 92559 f50992 GetModuleHandleW 92524->92559 92526 f504fa 92526->92509 92527 f504fe 92526->92527 92528 f50507 92527->92528 92560 f54df5 28 API calls _abort 92527->92560 92561 f50040 13 API calls 2 library calls 92528->92561 92531 f5050f 92531->92517 92533 f4feba 92532->92533 92564 f50698 IsProcessorFeaturePresent 92533->92564 92535 f4fec6 92565 f52c94 10 API calls 3 library calls 92535->92565 92537 f4fecb 92538 f4fecf 92537->92538 92566 f62317 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 92537->92566 92538->92506 92540 f4fed8 92541 f4fee6 92540->92541 92567 f52cbd 8 API calls 3 library calls 92540->92567 92541->92506 92544 f62494 92543->92544 92568 f50a8c 92544->92568 92546 f50451 92546->92517 92547 f62421 92546->92547 92550 f62450 92547->92550 92548 f50a8c _ValidateLocalCookies 5 API calls 92549 f62479 92548->92549 92549->92521 92550->92548 92576 f52340 92551->92576 92554 f5097f 92554->92523 92578 f54bcf 92555->92578 92558->92519 92559->92526 92560->92528 92561->92531 92562->92509 92564->92535 92565->92537 92566->92540 92567->92538 92569 f50a95 92568->92569 92570 f50a97 IsProcessorFeaturePresent 92568->92570 92569->92546 92572 f50c5d 92570->92572 92575 f50c21 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 92572->92575 92574 f50d40 92574->92546 92575->92574 92577 f5096c GetStartupInfoW 92576->92577 92577->92554 92579 f54bdb _abort 92578->92579 92580 f54bf4 92579->92580 92581 f54be2 92579->92581 92602 f62f5e EnterCriticalSection 92580->92602 92617 f54d29 GetModuleHandleW 92581->92617 92584 f54be7 92584->92580 92618 f54d6d GetModuleHandleExW 92584->92618 92585 f54c99 92606 f54cd9 92585->92606 92588 f54c70 92593 f54c88 92588->92593 92597 f62421 _abort 5 API calls 92588->92597 92591 f54cb6 92609 f54ce8 92591->92609 92592 f54ce2 92626 f71d29 5 API calls _ValidateLocalCookies 92592->92626 92598 f62421 _abort 5 API calls 92593->92598 92597->92593 92598->92585 92599 f54bfb 92599->92585 92599->92588 92603 f621a8 92599->92603 92602->92599 92627 f61ee1 92603->92627 92647 f62fa6 LeaveCriticalSection 92606->92647 92608 f54cb2 92608->92591 92608->92592 92648 f6360c 92609->92648 92612 f54d16 92615 f54d6d _abort 8 API calls 92612->92615 92613 f54cf6 GetPEB 92613->92612 92614 f54d06 GetCurrentProcess TerminateProcess 92613->92614 92614->92612 92616 f54d1e ExitProcess 92615->92616 92617->92584 92619 f54d97 GetProcAddress 92618->92619 92620 f54dba 92618->92620 92623 f54dac 92619->92623 92621 f54dc0 FreeLibrary 92620->92621 92622 f54dc9 92620->92622 92621->92622 92624 f50a8c _ValidateLocalCookies 5 API calls 92622->92624 92623->92620 92625 f54bf3 92624->92625 92625->92580 92630 f61e90 92627->92630 92629 f61f05 92629->92588 92631 f61e9c ___DestructExceptionObject 92630->92631 92638 f62f5e EnterCriticalSection 92631->92638 92633 f61eaa 92639 f61f31 92633->92639 92637 f61ec8 __fread_nolock 92637->92629 92638->92633 92640 f61f51 92639->92640 92644 f61f59 92639->92644 92641 f50a8c _ValidateLocalCookies 5 API calls 92640->92641 92642 f61eb7 92641->92642 92645 f61ed5 LeaveCriticalSection _abort 92642->92645 92644->92640 92646 f629c8 20 API calls __dosmaperr 92644->92646 92645->92637 92646->92640 92647->92608 92649 f63627 92648->92649 92650 f63631 92648->92650 92652 f50a8c _ValidateLocalCookies 5 API calls 92649->92652 92655 f62fd7 5 API calls 2 library calls 92650->92655 92653 f54cf2 92652->92653 92653->92612 92653->92613 92654 f63648 92654->92649 92655->92654 92656 f32de3 92657 f32df0 __wsopen_s 92656->92657 92658 f32e09 92657->92658 92659 f72c2b ___scrt_fastfail 92657->92659 92660 f33aa2 23 API calls 92658->92660 92662 f72c47 GetOpenFileNameW 92659->92662 92661 f32e12 92660->92661 92672 f32da5 92661->92672 92664 f72c96 92662->92664 92666 f36b57 22 API calls 92664->92666 92667 f72cab 92666->92667 92667->92667 92669 f32e27 92690 f344a8 92669->92690 92673 f71f50 __wsopen_s 92672->92673 92674 f32db2 GetLongPathNameW 92673->92674 92675 f36b57 22 API calls 92674->92675 92676 f32dda 92675->92676 92677 f33598 92676->92677 92678 f3a961 22 API calls 92677->92678 92679 f335aa 92678->92679 92680 f33aa2 23 API calls 92679->92680 92681 f335b5 92680->92681 92682 f335c0 92681->92682 92683 f732eb 92681->92683 92684 f3515f 22 API calls 92682->92684 92688 f7330d 92683->92688 92725 f4ce60 41 API calls 92683->92725 92686 f335cc 92684->92686 92719 f335f3 92686->92719 92689 f335df 92689->92669 92691 f34ecb 94 API calls 92690->92691 92692 f344cd 92691->92692 92693 f73833 92692->92693 92694 f34ecb 94 API calls 92692->92694 92695 fa2cf9 80 API calls 92693->92695 92696 f344e1 92694->92696 92697 f73848 92695->92697 92696->92693 92698 f344e9 92696->92698 92699 f7384c 92697->92699 92700 f73869 92697->92700 92703 f73854 92698->92703 92704 f344f5 92698->92704 92701 f34f39 68 API calls 92699->92701 92702 f4fe0b 22 API calls 92700->92702 92701->92703 92712 f738ae 92702->92712 92727 f9da5a 82 API calls 92703->92727 92726 f3940c 136 API calls 2 library calls 92704->92726 92707 f73862 92707->92700 92708 f32e31 92709 f34f39 68 API calls 92711 f73a5f 92709->92711 92711->92709 92733 f9989b 82 API calls __wsopen_s 92711->92733 92712->92711 92716 f39cb3 22 API calls 92712->92716 92728 f9967e 22 API calls __fread_nolock 92712->92728 92729 f995ad 42 API calls _wcslen 92712->92729 92730 fa0b5a 22 API calls 92712->92730 92731 f3a4a1 22 API calls __fread_nolock 92712->92731 92732 f33ff7 22 API calls 92712->92732 92716->92712 92720 f33605 92719->92720 92724 f33624 __fread_nolock 92719->92724 92722 f4fe0b 22 API calls 92720->92722 92721 f4fddb 22 API calls 92723 f3363b 92721->92723 92722->92724 92723->92689 92724->92721 92725->92683 92726->92708 92727->92707 92728->92712 92729->92712 92730->92712 92731->92712 92732->92712 92733->92711 92734 f72ba5 92735 f32b25 92734->92735 92736 f72baf 92734->92736 92762 f32b83 7 API calls 92735->92762 92738 f33a5a 24 API calls 92736->92738 92740 f72bb8 92738->92740 92742 f39cb3 22 API calls 92740->92742 92744 f72bc6 92742->92744 92743 f32b2f 92747 f32b44 92743->92747 92750 f33837 49 API calls 92743->92750 92745 f72bf5 92744->92745 92746 f72bce 92744->92746 92749 f333c6 22 API calls 92745->92749 92748 f333c6 22 API calls 92746->92748 92754 f32b5f 92747->92754 92757 f330f2 Shell_NotifyIconW 92747->92757 92751 f72bd9 92748->92751 92752 f72bf1 GetForegroundWindow ShellExecuteW 92749->92752 92750->92747 92766 f36350 22 API calls 92751->92766 92758 f72c26 92752->92758 92760 f32b66 SetCurrentDirectoryW 92754->92760 92756 f72be7 92759 f333c6 22 API calls 92756->92759 92757->92754 92758->92754 92759->92752 92761 f32b7a 92760->92761 92767 f32cd4 7 API calls 92762->92767 92764 f32b2a 92765 f32c63 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 92764->92765 92765->92743 92766->92756 92767->92764 92768 f68402 92773 f681be 92768->92773 92771 f6842a 92778 f681ef try_get_first_available_module 92773->92778 92775 f683ee 92792 f627ec 26 API calls _abort 92775->92792 92777 f68343 92777->92771 92785 f70984 92777->92785 92778->92778 92781 f68338 92778->92781 92788 f58e0b 40 API calls 2 library calls 92778->92788 92780 f6838c 92780->92781 92789 f58e0b 40 API calls 2 library calls 92780->92789 92781->92777 92791 f5f2d9 20 API calls _abort 92781->92791 92783 f683ab 92783->92781 92790 f58e0b 40 API calls 2 library calls 92783->92790 92793 f70081 92785->92793 92787 f7099f 92787->92771 92788->92780 92789->92783 92790->92781 92791->92775 92792->92777 92794 f7008d ___DestructExceptionObject 92793->92794 92795 f7009b 92794->92795 92797 f700d4 92794->92797 92850 f5f2d9 20 API calls _abort 92795->92850 92804 f7065b 92797->92804 92798 f700a0 92851 f627ec 26 API calls _abort 92798->92851 92803 f700aa __fread_nolock 92803->92787 92805 f70678 92804->92805 92806 f706a6 92805->92806 92807 f7068d 92805->92807 92853 f65221 92806->92853 92867 f5f2c6 20 API calls _abort 92807->92867 92810 f706ab 92811 f706b4 92810->92811 92812 f706cb 92810->92812 92869 f5f2c6 20 API calls _abort 92811->92869 92866 f7039a CreateFileW 92812->92866 92816 f706b9 92870 f5f2d9 20 API calls _abort 92816->92870 92817 f70781 GetFileType 92822 f707d3 92817->92822 92823 f7078c GetLastError 92817->92823 92818 f700f8 92852 f70121 LeaveCriticalSection __wsopen_s 92818->92852 92820 f70756 GetLastError 92872 f5f2a3 20 API calls __dosmaperr 92820->92872 92821 f70704 92821->92817 92821->92820 92871 f7039a CreateFileW 92821->92871 92875 f6516a 21 API calls 2 library calls 92822->92875 92873 f5f2a3 20 API calls __dosmaperr 92823->92873 92824 f70692 92868 f5f2d9 20 API calls _abort 92824->92868 92828 f7079a CloseHandle 92828->92824 92831 f707c3 92828->92831 92830 f70749 92830->92817 92830->92820 92874 f5f2d9 20 API calls _abort 92831->92874 92832 f707f4 92835 f70840 92832->92835 92876 f705ab 72 API calls 3 library calls 92832->92876 92834 f707c8 92834->92824 92839 f7086d 92835->92839 92877 f7014d 72 API calls 4 library calls 92835->92877 92838 f70866 92838->92839 92840 f7087e 92838->92840 92841 f686ae __wsopen_s 29 API calls 92839->92841 92840->92818 92842 f708fc CloseHandle 92840->92842 92841->92818 92878 f7039a CreateFileW 92842->92878 92844 f70927 92845 f7095d 92844->92845 92846 f70931 GetLastError 92844->92846 92845->92818 92879 f5f2a3 20 API calls __dosmaperr 92846->92879 92848 f7093d 92880 f65333 21 API calls 2 library calls 92848->92880 92850->92798 92851->92803 92852->92803 92854 f6522d ___DestructExceptionObject 92853->92854 92881 f62f5e EnterCriticalSection 92854->92881 92856 f65234 92857 f65259 92856->92857 92862 f652c7 EnterCriticalSection 92856->92862 92865 f6527b 92856->92865 92885 f65000 21 API calls 3 library calls 92857->92885 92860 f652a4 __fread_nolock 92860->92810 92861 f6525e 92861->92865 92886 f65147 EnterCriticalSection 92861->92886 92863 f652d4 LeaveCriticalSection 92862->92863 92862->92865 92863->92856 92882 f6532a 92865->92882 92866->92821 92867->92824 92868->92818 92869->92816 92870->92824 92871->92830 92872->92824 92873->92828 92874->92834 92875->92832 92876->92835 92877->92838 92878->92844 92879->92848 92880->92845 92881->92856 92887 f62fa6 LeaveCriticalSection 92882->92887 92884 f65331 92884->92860 92885->92861 92886->92865 92887->92884 92888 f72402 92891 f31410 92888->92891 92892 f3144f mciSendStringW 92891->92892 92893 f724b8 DestroyWindow 92891->92893 92894 f316c6 92892->92894 92895 f3146b 92892->92895 92906 f724c4 92893->92906 92894->92895 92897 f316d5 UnregisterHotKey 92894->92897 92896 f31479 92895->92896 92895->92906 92924 f3182e 92896->92924 92897->92894 92899 f724e2 FindClose 92899->92906 92900 f724d8 92900->92906 92930 f36246 CloseHandle 92900->92930 92902 f72509 92905 f7251c FreeLibrary 92902->92905 92907 f7252d 92902->92907 92904 f3148e 92904->92907 92912 f3149c 92904->92912 92905->92902 92906->92899 92906->92900 92906->92902 92908 f72541 VirtualFree 92907->92908 92915 f31509 92907->92915 92908->92907 92909 f314f8 OleUninitialize 92909->92915 92910 f31514 92914 f31524 92910->92914 92911 f72589 92917 f72598 messages 92911->92917 92931 fa32eb 6 API calls messages 92911->92931 92912->92909 92928 f31944 VirtualFreeEx CloseHandle 92914->92928 92915->92910 92915->92911 92920 f72627 92917->92920 92932 f964d4 22 API calls messages 92917->92932 92918 f3153a 92918->92917 92921 f3161f 92918->92921 92920->92920 92921->92920 92929 f31876 CloseHandle InternetCloseHandle InternetCloseHandle WaitForSingleObject 92921->92929 92923 f316c1 92926 f3183b 92924->92926 92925 f31480 92925->92902 92925->92904 92926->92925 92933 f9702a 22 API calls 92926->92933 92928->92918 92929->92923 92930->92900 92931->92911 92932->92917 92933->92926 92934 f31044 92939 f310f3 92934->92939 92936 f3104a 92975 f500a3 29 API calls __onexit 92936->92975 92938 f31054 92976 f31398 92939->92976 92943 f3116a 92944 f3a961 22 API calls 92943->92944 92945 f31174 92944->92945 92946 f3a961 22 API calls 92945->92946 92947 f3117e 92946->92947 92948 f3a961 22 API calls 92947->92948 92949 f31188 92948->92949 92950 f3a961 22 API calls 92949->92950 92951 f311c6 92950->92951 92952 f3a961 22 API calls 92951->92952 92953 f31292 92952->92953 92986 f3171c 92953->92986 92957 f312c4 92958 f3a961 22 API calls 92957->92958 92959 f312ce 92958->92959 92960 f41940 9 API calls 92959->92960 92961 f312f9 92960->92961 93007 f31aab 92961->93007 92963 f31315 92964 f31325 GetStdHandle 92963->92964 92965 f72485 92964->92965 92966 f3137a 92964->92966 92965->92966 92967 f7248e 92965->92967 92969 f31387 OleInitialize 92966->92969 92968 f4fddb 22 API calls 92967->92968 92970 f72495 92968->92970 92969->92936 93014 fa011d InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 92970->93014 92972 f7249e 93015 fa0944 CreateThread 92972->93015 92974 f724aa CloseHandle 92974->92966 92975->92938 93016 f313f1 92976->93016 92979 f313f1 22 API calls 92980 f313d0 92979->92980 92981 f3a961 22 API calls 92980->92981 92982 f313dc 92981->92982 92983 f36b57 22 API calls 92982->92983 92984 f31129 92983->92984 92985 f31bc3 6 API calls 92984->92985 92985->92943 92987 f3a961 22 API calls 92986->92987 92988 f3172c 92987->92988 92989 f3a961 22 API calls 92988->92989 92990 f31734 92989->92990 92991 f3a961 22 API calls 92990->92991 92992 f3174f 92991->92992 92993 f4fddb 22 API calls 92992->92993 92994 f3129c 92993->92994 92995 f31b4a 92994->92995 92996 f31b58 92995->92996 92997 f3a961 22 API calls 92996->92997 92998 f31b63 92997->92998 92999 f3a961 22 API calls 92998->92999 93000 f31b6e 92999->93000 93001 f3a961 22 API calls 93000->93001 93002 f31b79 93001->93002 93003 f3a961 22 API calls 93002->93003 93004 f31b84 93003->93004 93005 f4fddb 22 API calls 93004->93005 93006 f31b96 RegisterWindowMessageW 93005->93006 93006->92957 93008 f31abb 93007->93008 93009 f7272d 93007->93009 93011 f4fddb 22 API calls 93008->93011 93023 fa3209 23 API calls 93009->93023 93013 f31ac3 93011->93013 93012 f72738 93013->92963 93014->92972 93015->92974 93024 fa092a 28 API calls 93015->93024 93017 f3a961 22 API calls 93016->93017 93018 f313fc 93017->93018 93019 f3a961 22 API calls 93018->93019 93020 f31404 93019->93020 93021 f3a961 22 API calls 93020->93021 93022 f313c6 93021->93022 93022->92979 93023->93012 93025 f31cad SystemParametersInfoW

                                                                Executed Functions

                                                                Function 00F342DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 0 f342de-f3434d call f3a961 GetVersionExW call f36b57 5 f73617-f7362a 0->5 6 f34353 0->6 7 f7362b-f7362f 5->7 8 f34355-f34357 6->8 9 f73632-f7363e 7->9 10 f73631 7->10 11 f73656 8->11 12 f3435d-f343bc call f393b2 call f337a0 8->12 9->7 13 f73640-f73642 9->13 10->9 16 f7365d-f73660 11->16 28 f343c2-f343c4 12->28 29 f737df-f737e6 12->29 13->8 15 f73648-f7364f 13->15 15->5 19 f73651 15->19 20 f73666-f736a8 16->20 21 f3441b-f34435 GetCurrentProcess IsWow64Process 16->21 19->11 20->21 25 f736ae-f736b1 20->25 23 f34437 21->23 24 f34494-f3449a 21->24 30 f3443d-f34449 23->30 24->30 26 f736b3-f736bd 25->26 27 f736db-f736e5 25->27 31 f736bf-f736c5 26->31 32 f736ca-f736d6 26->32 34 f736e7-f736f3 27->34 35 f736f8-f73702 27->35 28->16 33 f343ca-f343dd 28->33 36 f73806-f73809 29->36 37 f737e8 29->37 38 f73824-f73828 GetSystemInfo 30->38 39 f3444f-f3445e LoadLibraryA 30->39 31->21 32->21 40 f343e3-f343e5 33->40 41 f73726-f7372f 33->41 34->21 43 f73715-f73721 35->43 44 f73704-f73710 35->44 45 f737f4-f737fc 36->45 46 f7380b-f7381a 36->46 42 f737ee 37->42 47 f34460-f3446e GetProcAddress 39->47 48 f3449c-f344a6 GetSystemInfo 39->48 50 f343eb-f343ee 40->50 51 f7374d-f73762 40->51 52 f73731-f73737 41->52 53 f7373c-f73748 41->53 42->45 43->21 44->21 45->36 46->42 54 f7381c-f73822 46->54 47->48 55 f34470-f34474 GetNativeSystemInfo 47->55 49 f34476-f34478 48->49 60 f34481-f34493 49->60 61 f3447a-f3447b FreeLibrary 49->61 56 f73791-f73794 50->56 57 f343f4-f3440f 50->57 58 f73764-f7376a 51->58 59 f7376f-f7377b 51->59 52->21 53->21 54->45 55->49 56->21 62 f7379a-f737c1 56->62 63 f34415 57->63 64 f73780-f7378c 57->64 58->21 59->21 61->60 65 f737c3-f737c9 62->65 66 f737ce-f737da 62->66 63->21 64->21 65->21 66->21
                                                                APIs
                                                                • GetVersionExW.KERNEL32(?), ref: 00F3430D
                                                                  • Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A
                                                                • GetCurrentProcess.KERNEL32(?,00FCCB64,00000000,?,?), ref: 00F34422
                                                                • IsWow64Process.KERNEL32(00000000,?,?), ref: 00F34429
                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00F34454
                                                                • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00F34466
                                                                • GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00F34474
                                                                • FreeLibrary.KERNEL32(00000000,?,?), ref: 00F3447B
                                                                • GetSystemInfo.KERNEL32(?,?,?), ref: 00F344A0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                                • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                                • API String ID: 3290436268-3101561225
                                                                • Opcode ID: 0a5a52d796d63c77a1e206cec95601a674d7ab1e1deb44d5a01dfb9f425ef548
                                                                • Instruction ID: add7625ddb78165541183081c440a07b09569081b8cbdc3b62eb43e7702d08f5
                                                                • Opcode Fuzzy Hash: 0a5a52d796d63c77a1e206cec95601a674d7ab1e1deb44d5a01dfb9f425ef548
                                                                • Instruction Fuzzy Hash: 3DA1B772D0E2C0DFC737C769B4816957FA47B26314F08D4A9E4C5A3A0AD23AD505FBA2
                                                                Function 00F3D85A Relevance: 12.5, APIs: 8, Instructions: 481timeCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 404 f3d85a-f3d87a 405 f3d880-f3d882 404->405 406 f3d888-f3d88c 405->406 407 f3d9fc-f3da02 405->407 408 f3d890-f3d892 406->408 409 f3da04-f3da19 timeGetTime 407->409 410 f3da3d-f3da40 407->410 411 f3d894-f3d89a 408->411 412 f81dc9-f81dcf 409->412 413 f3da1f-f3da25 409->413 410->405 416 f3d8a0-f3d8ae 411->416 417 f3da45-f3da4b 411->417 414 f3da28-f3da2c 412->414 415 f81dd5 412->415 413->414 418 f3da27 413->418 414->410 421 f3da2e 414->421 424 f81dda-f81e10 timeGetTime call f4e300 call fa3a2a 415->424 419 f3d8b4-f3d8ed 416->419 420 f3d9c8-f3d9f9 416->420 422 f3da51-f3da56 417->422 423 f81e15-f81e21 call fa3cb6 417->423 418->414 441 f3d8f3-f3d8f6 419->441 442 f3dbaf-f3dbbe Sleep 419->442 421->424 427 f3da34-f3da37 421->427 422->411 423->408 435 f82742 423->435 424->410 427->410 427->424 439 f8274a-f8275c call f31a05 435->439 446 f82b74-f82b83 Sleep 441->446 447 f3d8fc-f3d8ff 441->447 444 f3dbc0-f3dbcd call f4e551 442->444 445 f3dbdd-f3dbe6 442->445 444->445 462 f3dbcf 444->462 445->420 452 f3dbec-f82a44 445->452 449 f82bb1-f82bc5 446->449 450 f82b85-f82b92 call f4e551 446->450 447->446 453 f3d905-f3d908 447->453 457 f82bef-f82bf2 449->457 458 f82bc7-f82be3 call f9d4dc 449->458 450->449 467 f82b94 450->467 452->420 464 f82a4a 452->464 453->442 454 f3d90e-f3d911 453->454 454->442 460 f3d917-f3d91a 454->460 457->420 465 f82bf8-f82c09 457->465 458->420 489 f82be9-f82bed 458->489 460->442 466 f3d920-f3d923 460->466 468 f3dc56-f3dc5d 462->468 469 f3dbd5-f3dbdb 462->469 471 f82a79-f82a7d call fc2a35 464->471 472 f82a5a-f82a61 call fc29bf 464->472 473 f82a51-f82a58 call fc29bf 464->473 474 f82a63-f82a67 call fc2a35 464->474 475 f82c0b-f82c1f GetExitCodeProcess 465->475 476 f82c51-f82c5d 465->476 466->442 480 f3d929-f3d93e 466->480 483 f82b9e-f82ba6 467->483 484 f82b96-f82b9c 467->484 487 f3dc63-f3dc74 468->487 488 f82a31-f82a39 468->488 469->445 469->468 500 f82a82-f82a86 471->500 498 f82a6c-f82a70 472->498 473->500 474->498 477 f82c21-f82c31 WaitForSingleObject 475->477 478 f82c37-f82c47 CloseHandle 475->478 481 f82c5f-f82c69 476->481 482 f82c86-f82c8d call f3630c 476->482 477->420 477->478 478->476 491 f3d944-f3d946 480->491 492 f82a22-f82a2c 480->492 493 f82c6b 481->493 494 f82c71-f82c84 call fb7e40 481->494 505 f82c92-f82caf Sleep 482->505 483->435 499 f82bac 483->499 484->449 484->483 487->420 488->439 489->465 491->492 501 f3d94c-f3d955 491->501 492->420 493->494 494->505 503 f82a88-f82a96 498->503 504 f82a72 498->504 499->449 500->503 506 f82ad0 500->506 501->492 508 f3d95b-f3d985 501->508 513 f82a98 503->513 514 f82a9b-f82aab 503->514 511 f82ada-f82ae3 504->511 512 f82a74 504->512 505->420 506->420 507 f82ad6-f82ad8 506->507 507->511 515 f82b53-f82b6f call f9e97b 507->515 518 f3da5b-f3da5e 508->518 519 f3d98b-f3d992 call f3dd50 508->519 516 f82aea-f82b4e call f3cfa0 call fb5658 call f3cfa0 511->516 517 f82ae5-f82ae8 511->517 512->420 513->514 520 f82aad 514->520 521 f82ab0-f82ace call f31a05 514->521 515->420 516->515 517->515 517->516 526 f3da60-f3da68 call f3dfd0 518->526 527 f3da7f-f3da83 518->527 533 f3d997-f3d99d 519->533 520->521 521->506 526->533 530 f828ce-f828e2 call f3ec40 527->530 531 f3da89-f3da90 527->531 556 f828e7-f828fb call fa359c 530->556 540 f3da97-f3daa6 call f41310 531->540 541 f3dacd-f3dae6 call f3bf40 531->541 536 f3d9a3-f3d9b2 533->536 537 f3dae8-f3daf3 533->537 544 f3dc79-f3dc7f 536->544 545 f3d9b8-f3d9c0 536->545 548 f3daf9-f3db04 call f4fdcd 537->548 549 f82986-f8299a call f4fe14 call f4fdcd 537->549 554 f3daab-f3daad 540->554 541->554 544->545 553 f3dc85 544->553 545->420 548->442 565 f82a15-f82a1d call f4fdcd 549->565 553->412 554->533 559 f3dab3-f3dac2 554->559 566 f828fd-f82908 556->566 567 f82934-f8293b 556->567 559->533 562 f3dac8 559->562 562->556 565->545 568 f8290a-f8291e call f4fe14 call f4fdcd 566->568 569 f82921-f8292c call f4fdcd 566->569 567->545 571 f82941-f82947 567->571 568->569 569->567 571->545 575 f8294d 571->575 578 f82868-f8286e 575->578 579 f8296a-f82970 575->579 580 f8287f-f82885 575->580 581 f82803-f82818 call f4fe14 575->581 582 f82896-f8289c 575->582 578->545 584 f82874-f8287a call f8fd59 578->584 579->545 583 f82976-f82981 call f3988f 579->583 580->545 585 f8288b-f82891 580->585 581->565 582->545 586 f828a2-f828ac call f3988f 582->586 583->565 584->545 585->545 586->565
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Timetime
                                                                • String ID:
                                                                • API String ID: 17336451-0
                                                                • Opcode ID: 8001686b2b220645dc09e632117253f8c8623c95770647fa18d9862fa4c1d78b
                                                                • Instruction ID: b066f13a4a93ec3373144604c9c9b4ac38eb601dc258d123c45ae1a7019c6795
                                                                • Opcode Fuzzy Hash: 8001686b2b220645dc09e632117253f8c8623c95770647fa18d9862fa4c1d78b
                                                                • Instruction Fuzzy Hash: 7A12EF71A08201DFD728DF24D884BAAB7E1FF85324F148559F89687291D779F844FB82
                                                                Function 00F342A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 598 f342a2-f342ba CreateStreamOnHGlobal 599 f342da-f342dd 598->599 600 f342bc-f342d3 FindResourceExW 598->600 601 f342d9 600->601 602 f735ba-f735c9 LoadResource 600->602 601->599 602->601 603 f735cf-f735dd SizeofResource 602->603 603->601 604 f735e3-f735ee LockResource 603->604 604->601 605 f735f4-f73612 604->605 605->601
                                                                APIs
                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00F350AA,?,?,00000000,00000000), ref: 00F342B2
                                                                • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00F350AA,?,?,00000000,00000000), ref: 00F342C9
                                                                • LoadResource.KERNEL32(?,00000000,?,?,00F350AA,?,?,00000000,00000000,?,?,?,?,?,?,00F34F20), ref: 00F735BE
                                                                • SizeofResource.KERNEL32(?,00000000,?,?,00F350AA,?,?,00000000,00000000,?,?,?,?,?,?,00F34F20), ref: 00F735D3
                                                                • LockResource.KERNEL32(00F350AA,?,?,00F350AA,?,?,00000000,00000000,?,?,?,?,?,?,00F34F20,?), ref: 00F735E6
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                • String ID: SCRIPT
                                                                • API String ID: 3051347437-3967369404
                                                                • Opcode ID: a0aadf03291d813e491f98e1fee12d2a54ac37171b742750b0b338bd98b5822a
                                                                • Instruction ID: b320c983f3fdf10c8e5d0c333f4145b5b0024f30103527a569e19fde8130fe7f
                                                                • Opcode Fuzzy Hash: a0aadf03291d813e491f98e1fee12d2a54ac37171b742750b0b338bd98b5822a
                                                                • Instruction Fuzzy Hash: 4811AC70600305BFD7218BA6DD49F677BBDEBC6B61F148169F41696290DB71EC00AA70
                                                                Function 00F72BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00F32B6B
                                                                  • Part of subcall function 00F33A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,01001418,?,00F32E7F,?,?,?,00000000), ref: 00F33A78
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • GetForegroundWindow.USER32(runas,?,?,?,?,?,00FF2224), ref: 00F72C10
                                                                • ShellExecuteW.SHELL32(00000000,?,?,00FF2224), ref: 00F72C17
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
                                                                • String ID: runas
                                                                • API String ID: 448630720-4000483414
                                                                • Opcode ID: c55015ada0b7aef8c3be1c3b813d9b8196ce7ed713e0cd613c27b191e4493e20
                                                                • Instruction ID: 06dc227dbbce5af65847008605180aeaa04927a10a6eac253831f96ecb3b425c
                                                                • Opcode Fuzzy Hash: c55015ada0b7aef8c3be1c3b813d9b8196ce7ed713e0cd613c27b191e4493e20
                                                                • Instruction Fuzzy Hash: 8511EE316083456AC719FF60DC429BEBBA4AFD1370F44542DF286030A2CFB98A0AF712
                                                                Function 00F9D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 00F9D501
                                                                • Process32FirstW.KERNEL32(00000000,?), ref: 00F9D50F
                                                                • Process32NextW.KERNEL32(00000000,?), ref: 00F9D52F
                                                                • FindCloseChangeNotification.KERNEL32(00000000), ref: 00F9D5DC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
                                                                • String ID:
                                                                • API String ID: 3243318325-0
                                                                • Opcode ID: 2ebc3bda44476cb4995eaabe391839b9d0b2850b133ccec874c7adc05233b6f6
                                                                • Instruction ID: b480a7dcbcd31ad065d48cf73f78da5fd6c4033d5d583559a1c02ec4f9b1769d
                                                                • Opcode Fuzzy Hash: 2ebc3bda44476cb4995eaabe391839b9d0b2850b133ccec874c7adc05233b6f6
                                                                • Instruction Fuzzy Hash: C53193711083009FD700EF54CC81AAFBBE8EFD9364F54092DF585871A1EBB19949EB92
                                                                Function 00F9DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • lstrlenW.KERNEL32(?,00F75222), ref: 00F9DBCE
                                                                • GetFileAttributesW.KERNEL32(?), ref: 00F9DBDD
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 00F9DBEE
                                                                • FindClose.KERNEL32(00000000), ref: 00F9DBFA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FileFind$AttributesCloseFirstlstrlen
                                                                • String ID:
                                                                • API String ID: 2695905019-0
                                                                • Opcode ID: 75fffdaff9b0ad083fba0081a6501b32186d731eaa8d14ec11aadfb397bc611d
                                                                • Instruction ID: 8d47973c52c62b1c523973df89bb50420c6e60a374bc1d33ebbc8db4de432834
                                                                • Opcode Fuzzy Hash: 75fffdaff9b0ad083fba0081a6501b32186d731eaa8d14ec11aadfb397bc611d
                                                                • Instruction Fuzzy Hash: 2BF0E531810918579B206F7CEE0ECAA776C9E01334B244702F83AC30F0EBB05D55EAD5
                                                                Function 00F54CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentProcess.KERNEL32(00F628E9,?,00F54CBE,00F628E9,00FF88B8,0000000C,00F54E15,00F628E9,00000002,00000000,?,00F628E9), ref: 00F54D09
                                                                • TerminateProcess.KERNEL32(00000000,?,00F54CBE,00F628E9,00FF88B8,0000000C,00F54E15,00F628E9,00000002,00000000,?,00F628E9), ref: 00F54D10
                                                                • ExitProcess.KERNEL32 ref: 00F54D22
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$CurrentExitTerminate
                                                                • String ID:
                                                                • API String ID: 1703294689-0
                                                                • Opcode ID: 570357bd04352184225b5c1956ea6cc634ad48091d85f4c342d496ede00e59a4
                                                                • Instruction ID: 8eed791bf6e56a8e43d58c724d6483611a38a1c6b5fa293ec39c1b3ceaf7f569
                                                                • Opcode Fuzzy Hash: 570357bd04352184225b5c1956ea6cc634ad48091d85f4c342d496ede00e59a4
                                                                • Instruction Fuzzy Hash: EFE0B631800148ABCF11AF54EE0AE583B79FB41796B144018FD098B122CB3AED86EA90
                                                                Function 00F32CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • GetSysColorBrush.USER32(0000000F), ref: 00F32D07
                                                                • RegisterClassExW.USER32(00000030), ref: 00F32D31
                                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F32D42
                                                                • InitCommonControlsEx.COMCTL32(?), ref: 00F32D5F
                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F32D6F
                                                                • LoadIconW.USER32(000000A9), ref: 00F32D85
                                                                • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F32D94
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                • API String ID: 2914291525-1005189915
                                                                • Opcode ID: 802c25cefd9cdd853e79b0c48f254e529e5763393423b15a69e23185a39db160
                                                                • Instruction ID: bc9cf779ac6d22711aeb623701922bf92e7c203ce22372a7fcb07c0e9c706fdd
                                                                • Opcode Fuzzy Hash: 802c25cefd9cdd853e79b0c48f254e529e5763393423b15a69e23185a39db160
                                                                • Instruction Fuzzy Hash: DB21EFB1D41308AFDB11DFA4E98AB9DBBB4FB08700F00811AFA55A7290D7BA85449F91
                                                                Function 00F7065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 68 f7065b-f7068b call f7042f 71 f706a6-f706b2 call f65221 68->71 72 f7068d-f70698 call f5f2c6 68->72 78 f706b4-f706c9 call f5f2c6 call f5f2d9 71->78 79 f706cb-f70714 call f7039a 71->79 77 f7069a-f706a1 call f5f2d9 72->77 88 f7097d-f70983 77->88 78->77 86 f70716-f7071f 79->86 87 f70781-f7078a GetFileType 79->87 90 f70756-f7077c GetLastError call f5f2a3 86->90 91 f70721-f70725 86->91 92 f707d3-f707d6 87->92 93 f7078c-f707bd GetLastError call f5f2a3 CloseHandle 87->93 90->77 91->90 97 f70727-f70754 call f7039a 91->97 95 f707df-f707e5 92->95 96 f707d8-f707dd 92->96 93->77 107 f707c3-f707ce call f5f2d9 93->107 100 f707e9-f70837 call f6516a 95->100 101 f707e7 95->101 96->100 97->87 97->90 111 f70847-f7086b call f7014d 100->111 112 f70839-f70845 call f705ab 100->112 101->100 107->77 118 f7087e-f708c1 111->118 119 f7086d 111->119 112->111 117 f7086f-f70879 call f686ae 112->117 117->88 121 f708c3-f708c7 118->121 122 f708e2-f708f0 118->122 119->117 121->122 124 f708c9-f708dd 121->124 125 f708f6-f708fa 122->125 126 f7097b 122->126 124->122 125->126 127 f708fc-f7092f CloseHandle call f7039a 125->127 126->88 130 f70963-f70977 127->130 131 f70931-f7095d GetLastError call f5f2a3 call f65333 127->131 130->126 131->130
                                                                APIs
                                                                  • Part of subcall function 00F7039A: CreateFileW.KERNEL32(00000000,00000000,?,00F70704,?,?,00000000,?,00F70704,00000000,0000000C), ref: 00F703B7
                                                                • GetLastError.KERNEL32 ref: 00F7076F
                                                                • __dosmaperr.LIBCMT ref: 00F70776
                                                                • GetFileType.KERNEL32(00000000), ref: 00F70782
                                                                • GetLastError.KERNEL32 ref: 00F7078C
                                                                • __dosmaperr.LIBCMT ref: 00F70795
                                                                • CloseHandle.KERNEL32(00000000), ref: 00F707B5
                                                                • CloseHandle.KERNEL32(?), ref: 00F708FF
                                                                • GetLastError.KERNEL32 ref: 00F70931
                                                                • __dosmaperr.LIBCMT ref: 00F70938
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                • String ID: H
                                                                • API String ID: 4237864984-2852464175
                                                                • Opcode ID: fcc1eeb2a9753278cf998d619bf9290162a5f14c621780bbcee1e98cde91ff4b
                                                                • Instruction ID: 4aec7dbcd386d61b678fe6049ff4b85c65e0f7bdc02ccffec7d745c14f64a1d0
                                                                • Opcode Fuzzy Hash: fcc1eeb2a9753278cf998d619bf9290162a5f14c621780bbcee1e98cde91ff4b
                                                                • Instruction Fuzzy Hash: 15A12732A101488FDF19AF68DC51BAD3BA0AF46320F14815EF8599B391DB359C17EB92
                                                                Function 00F3344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                  • Part of subcall function 00F33A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,01001418,?,00F32E7F,?,?,?,00000000), ref: 00F33A78
                                                                  • Part of subcall function 00F33357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F33379
                                                                • RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00F3356A
                                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00F7318D
                                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00F731CE
                                                                • RegCloseKey.ADVAPI32(?), ref: 00F73210
                                                                • _wcslen.LIBCMT ref: 00F73277
                                                                • _wcslen.LIBCMT ref: 00F73286
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                                • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                • API String ID: 98802146-2727554177
                                                                • Opcode ID: ffc142775f3302023cfc752b60728745ca165eaba312c8c2a48751562c78aa5f
                                                                • Instruction ID: 815a572f4d887de613ad4c38b979fc2d12872018d7f32451026ac883e5606527
                                                                • Opcode Fuzzy Hash: ffc142775f3302023cfc752b60728745ca165eaba312c8c2a48751562c78aa5f
                                                                • Instruction Fuzzy Hash: 3171E3714083019EC315EF25DC86D5BBBE8FF84350F40882EF589D31A5EB799A48EB52
                                                                Function 00F32B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                APIs
                                                                • GetSysColorBrush.USER32(0000000F), ref: 00F32B8E
                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00F32B9D
                                                                • LoadIconW.USER32(00000063), ref: 00F32BB3
                                                                • LoadIconW.USER32(000000A4), ref: 00F32BC5
                                                                • LoadIconW.USER32(000000A2), ref: 00F32BD7
                                                                • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F32BEF
                                                                • RegisterClassExW.USER32(?), ref: 00F32C40
                                                                  • Part of subcall function 00F32CD4: GetSysColorBrush.USER32(0000000F), ref: 00F32D07
                                                                  • Part of subcall function 00F32CD4: RegisterClassExW.USER32(00000030), ref: 00F32D31
                                                                  • Part of subcall function 00F32CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F32D42
                                                                  • Part of subcall function 00F32CD4: InitCommonControlsEx.COMCTL32(?), ref: 00F32D5F
                                                                  • Part of subcall function 00F32CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F32D6F
                                                                  • Part of subcall function 00F32CD4: LoadIconW.USER32(000000A9), ref: 00F32D85
                                                                  • Part of subcall function 00F32CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F32D94
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                • String ID: #$0$AutoIt v3
                                                                • API String ID: 423443420-4155596026
                                                                • Opcode ID: 81bfc708a1ed330c6bf990dc081238a5c50aa820fac619a40720dbfe4399ca15
                                                                • Instruction ID: 01c68936d0e0e64f103438c93bb2f37c41aa85e246aa7d053951dd92085c4737
                                                                • Opcode Fuzzy Hash: 81bfc708a1ed330c6bf990dc081238a5c50aa820fac619a40720dbfe4399ca15
                                                                • Instruction Fuzzy Hash: 75214970E00318ABDB229FA5ED49BA97FF5FB48B50F04801AF644A7694D7BA8540DF90
                                                                Function 00F33170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 209 f33170-f33185 210 f33187-f3318a 209->210 211 f331e5-f331e7 209->211 212 f331eb 210->212 213 f3318c-f33193 210->213 211->210 214 f331e9 211->214 218 f331f1-f331f6 212->218 219 f72dfb-f72e23 call f318e2 call f4e499 212->219 215 f33265-f3326d PostQuitMessage 213->215 216 f33199-f3319e 213->216 217 f331d0-f331d8 DefWindowProcW 214->217 224 f33219-f3321b 215->224 221 f331a4-f331a8 216->221 222 f72e7c-f72e90 call f9bf30 216->222 223 f331de-f331e4 217->223 225 f331f8-f331fb 218->225 226 f3321d-f33244 SetTimer RegisterWindowMessageW 218->226 254 f72e28-f72e2f 219->254 230 f331ae-f331b3 221->230 231 f72e68-f72e77 call f9c161 221->231 222->224 248 f72e96 222->248 224->223 227 f33201-f3320f KillTimer call f330f2 225->227 228 f72d9c-f72d9f 225->228 226->224 232 f33246-f33251 CreatePopupMenu 226->232 243 f33214 call f33c50 227->243 240 f72dd7-f72df6 MoveWindow 228->240 241 f72da1-f72da5 228->241 237 f72e4d-f72e54 230->237 238 f331b9-f331be 230->238 231->224 232->224 237->217 242 f72e5a-f72e63 call f90ad7 237->242 246 f33253-f33263 call f3326f 238->246 247 f331c4-f331ca 238->247 240->224 249 f72da7-f72daa 241->249 250 f72dc6-f72dd2 SetFocus 241->250 242->217 243->224 246->224 247->217 247->254 248->217 249->247 255 f72db0-f72dc1 call f318e2 249->255 250->224 254->217 258 f72e35-f72e48 call f330f2 call f33837 254->258 255->224 258->217
                                                                APIs
                                                                • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00F3316A,?,?), ref: 00F331D8
                                                                • KillTimer.USER32(?,00000001,?,?,?,?,?,00F3316A,?,?), ref: 00F33204
                                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F33227
                                                                • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00F3316A,?,?), ref: 00F33232
                                                                • CreatePopupMenu.USER32 ref: 00F33246
                                                                • PostQuitMessage.USER32(00000000), ref: 00F33267
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                • String ID: TaskbarCreated
                                                                • API String ID: 129472671-2362178303
                                                                • Opcode ID: 08000c8ddc96b2454aecfac03ca41ce03eef7fd175186ffaba94f259662754ab
                                                                • Instruction ID: c5f0ff3d44bf6a227ba1601ebb7119335279ea7b3fd5110b2a4c083569cbd2c5
                                                                • Opcode Fuzzy Hash: 08000c8ddc96b2454aecfac03ca41ce03eef7fd175186ffaba94f259662754ab
                                                                • Instruction Fuzzy Hash: 48412C32E44204ABEB25AB78DD0EB7A3755FB05370F044119F54AC62D1CB79CE40B7A1
                                                                Function 00F31410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 265 f31410-f31449 266 f3144f-f31465 mciSendStringW 265->266 267 f724b8-f724b9 DestroyWindow 265->267 268 f316c6-f316d3 266->268 269 f3146b-f31473 266->269 270 f724c4-f724d1 267->270 272 f316d5-f316f0 UnregisterHotKey 268->272 273 f316f8-f316ff 268->273 269->270 271 f31479-f31488 call f3182e 269->271 274 f724d3-f724d6 270->274 275 f72500-f72507 270->275 286 f7250e-f7251a 271->286 287 f3148e-f31496 271->287 272->273 277 f316f2-f316f3 call f310d0 272->277 273->269 278 f31705 273->278 279 f724e2-f724e5 FindClose 274->279 280 f724d8-f724e0 call f36246 274->280 275->270 283 f72509 275->283 277->273 278->268 285 f724eb-f724f8 279->285 280->285 283->286 285->275 291 f724fa-f724fb call fa32b1 285->291 288 f72524-f7252b 286->288 289 f7251c-f7251e FreeLibrary 286->289 292 f72532-f7253f 287->292 293 f3149c-f314c1 call f3cfa0 287->293 288->286 294 f7252d 288->294 289->288 291->275 295 f72566-f7256d 292->295 296 f72541-f7255e VirtualFree 292->296 303 f314c3 293->303 304 f314f8-f31503 OleUninitialize 293->304 294->292 295->292 300 f7256f 295->300 296->295 299 f72560-f72561 call fa3317 296->299 299->295 305 f72574-f72578 300->305 307 f314c6-f314f6 call f31a05 call f319ae 303->307 304->305 306 f31509-f3150e 304->306 305->306 311 f7257e-f72584 305->311 309 f31514-f3151e 306->309 310 f72589-f72596 call fa32eb 306->310 307->304 314 f31707-f31714 call f4f80e 309->314 315 f31524-f315a5 call f3988f call f31944 call f317d5 call f4fe14 call f3177c call f3988f call f3cfa0 call f317fe call f4fe14 309->315 323 f72598 310->323 311->306 314->315 325 f3171a 314->325 327 f7259d-f725bf call f4fdcd 315->327 355 f315ab-f315cf call f4fe14 315->355 323->327 325->314 333 f725c1 327->333 337 f725c6-f725e8 call f4fdcd 333->337 343 f725ea 337->343 346 f725ef-f72611 call f4fdcd 343->346 351 f72613 346->351 354 f72618-f72625 call f964d4 351->354 360 f72627 354->360 355->337 361 f315d5-f315f9 call f4fe14 355->361 363 f7262c-f72639 call f4ac64 360->363 361->346 365 f315ff-f31619 call f4fe14 361->365 370 f7263b 363->370 365->354 371 f3161f-f31643 call f317d5 call f4fe14 365->371 373 f72640-f7264d call fa3245 370->373 371->363 380 f31649-f31651 371->380 378 f7264f 373->378 381 f72654-f72661 call fa32cc 378->381 380->373 382 f31657-f31675 call f3988f call f3190a 380->382 387 f72663 381->387 382->381 391 f3167b-f31689 382->391 390 f72668-f72675 call fa32cc 387->390 397 f72677 390->397 391->390 393 f3168f-f316c5 call f3988f * 3 call f31876 391->393 397->397
                                                                APIs
                                                                • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00F31459
                                                                • OleUninitialize.OLE32(?,00000000), ref: 00F314F8
                                                                • UnregisterHotKey.USER32(?), ref: 00F316DD
                                                                • DestroyWindow.USER32(?), ref: 00F724B9
                                                                • FreeLibrary.KERNEL32(?), ref: 00F7251E
                                                                • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F7254B
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                • String ID: close all
                                                                • API String ID: 469580280-3243417748
                                                                • Opcode ID: f217a458d0bca2aec339a5c9d93f6ed6d4567fd9e3f6330994376f2977ac3ee5
                                                                • Instruction ID: 98cc149dda759772c176dfb8e06b24e6958e4f2fda640995b777aea3469ffa16
                                                                • Opcode Fuzzy Hash: f217a458d0bca2aec339a5c9d93f6ed6d4567fd9e3f6330994376f2977ac3ee5
                                                                • Instruction Fuzzy Hash: F4D15D31B01212CFCB19EF15C995B29F7A4BF05720F1482AEE44E6B252DB31AD16EF91
                                                                Function 00F32C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 608 f32c63-f32cd3 CreateWindowExW * 2 ShowWindow * 2
                                                                APIs
                                                                • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F32C91
                                                                • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F32CB2
                                                                • ShowWindow.USER32(00000000,?,?,?,?,?,?,00F31CAD,?), ref: 00F32CC6
                                                                • ShowWindow.USER32(00000000,?,?,?,?,?,?,00F31CAD,?), ref: 00F32CCF
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$CreateShow
                                                                • String ID: AutoIt v3$edit
                                                                • API String ID: 1584632944-3779509399
                                                                • Opcode ID: 743494b336d9ed288f5c775bc16d447da13ae7af1139d9014825c01b9ba89c9a
                                                                • Instruction ID: b58460a7cbc9aef68230e081788b9d6b156555e26e332d7a2c44d0d173499371
                                                                • Opcode Fuzzy Hash: 743494b336d9ed288f5c775bc16d447da13ae7af1139d9014825c01b9ba89c9a
                                                                • Instruction Fuzzy Hash: 6BF0F4755403947AEB320713AC09E673FBDD7C6F50F00801AF904A3594C67A8840EAB0
                                                                Function 00FBAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 723 fbad64-fbad9c call f3a961 call f52340 728 fbad9e-fbadb5 call f37510 723->728 729 fbadd1-fbadd5 723->729 728->729 740 fbadb7-fbadce call f37510 call f37620 728->740 730 fbadf1-fbadf5 729->730 731 fbadd7-fbadee call f37510 call f37620 729->731 734 fbae3a 730->734 735 fbadf7-fbae0e call f37510 730->735 731->730 738 fbae3c-fbae40 734->738 735->738 749 fbae10-fbae21 call f39b47 735->749 742 fbae53-fbaeae call f52340 call f37510 ShellExecuteExW 738->742 743 fbae42-fbae50 call f3b567 738->743 740->729 760 fbaeb0-fbaeb6 call f4fe14 742->760 761 fbaeb7-fbaeb9 742->761 743->742 749->734 759 fbae23-fbae2e call f37510 749->759 759->734 771 fbae30-fbae35 call f3a8c7 759->771 760->761 765 fbaebb-fbaec1 call f4fe14 761->765 766 fbaec2-fbaec6 761->766 765->766 768 fbaf0a-fbaf0e 766->768 769 fbaec8-fbaed6 766->769 776 fbaf1b-fbaf33 call f3cfa0 768->776 777 fbaf10-fbaf19 768->777 774 fbaedb-fbaeeb 769->774 775 fbaed8 769->775 771->734 778 fbaeed 774->778 779 fbaef0-fbaf08 call f3cfa0 774->779 775->774 780 fbaf6d-fbaf7b call f3988f 776->780 787 fbaf35-fbaf46 GetProcessId 776->787 777->780 778->779 779->780 788 fbaf48 787->788 789 fbaf4e-fbaf67 call f3cfa0 CloseHandle 787->789 788->789 789->780
                                                                APIs
                                                                • ShellExecuteExW.SHELL32(0000003C), ref: 00FBAEA3
                                                                  • Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625
                                                                • GetProcessId.KERNEL32(00000000), ref: 00FBAF38
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FBAF67
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseExecuteHandleProcessShell_wcslen
                                                                • String ID: <$@
                                                                • API String ID: 146682121-1426351568
                                                                • Opcode ID: 72598fb65e197461eb2494837bfb7f5dfb18eb39d078a8a2b8f7fcc1e590eccf
                                                                • Instruction ID: b597d7ee9e031a87c508b610e0b9cb2ac27562155db3c3164940831a52da74d6
                                                                • Opcode Fuzzy Hash: 72598fb65e197461eb2494837bfb7f5dfb18eb39d078a8a2b8f7fcc1e590eccf
                                                                • Instruction Fuzzy Hash: FB716975A00619DFCB14EF66C885A9EBBF0BF08320F048499E856AB352C774ED45EF91
                                                                Function 00F33B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                Download Yara Rule

                                                                Control-flow Graph

                                                                • Executed
                                                                • Not Executed
                                                                control_flow_graph 828 f33b1c-f33b27 829 f33b99-f33b9b 828->829 830 f33b29-f33b2e 828->830 832 f33b8c-f33b8f 829->832 830->829 831 f33b30-f33b48 RegOpenKeyExW 830->831 831->829 833 f33b4a-f33b69 RegQueryValueExW 831->833 834 f33b80-f33b8b RegCloseKey 833->834 835 f33b6b-f33b76 833->835 834->832 836 f33b90-f33b97 835->836 837 f33b78-f33b7a 835->837 838 f33b7e 836->838 837->838 838->834
                                                                APIs
                                                                • RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00F33B0F,SwapMouseButtons,00000004,?), ref: 00F33B40
                                                                • RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00F33B0F,SwapMouseButtons,00000004,?), ref: 00F33B61
                                                                • RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00F33B0F,SwapMouseButtons,00000004,?), ref: 00F33B83
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseOpenQueryValue
                                                                • String ID: Control Panel\Mouse
                                                                • API String ID: 3677997916-824357125
                                                                • Opcode ID: dbfccbd7bb190fe72e55d26ab593666458a59fcfaa1b1fac2a756e657481d8aa
                                                                • Instruction ID: 47edc4b4aca99d0688dca13a0d45693a358ac06bd91461119ad2a9b55d091165
                                                                • Opcode Fuzzy Hash: dbfccbd7bb190fe72e55d26ab593666458a59fcfaa1b1fac2a756e657481d8aa
                                                                • Instruction Fuzzy Hash: 94112AB5910208FFDB20CFA5DC45EAEBBB8EF44764F104459E805D7110D2319E40A7A0
                                                                Function 00F33923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00F733A2
                                                                  • Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A
                                                                • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F33A04
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: IconLoadNotifyShell_String_wcslen
                                                                • String ID: Line:
                                                                • API String ID: 2289894680-1585850449
                                                                • Opcode ID: df795f09f5ae5b05a43109a4548aff78c8edac5a1d32b563a38ab60df604e62b
                                                                • Instruction ID: e58e82c0a93e1d15113e30aaebaba8316aac6513067529aec5390da507c601bb
                                                                • Opcode Fuzzy Hash: df795f09f5ae5b05a43109a4548aff78c8edac5a1d32b563a38ab60df604e62b
                                                                • Instruction Fuzzy Hash: 0631A171809304AAD725EB20DC46BEBB7D8AB40734F00852EF5D993195EF789A49E7C2
                                                                Function 00F4FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __CxxThrowException@8.LIBVCRUNTIME ref: 00F50668
                                                                  • Part of subcall function 00F532A4: RaiseException.KERNEL32(?,?,?,00F5068A,?,01001444,?,?,?,?,?,?,00F5068A,00F31129,00FF8738,00F31129), ref: 00F53304
                                                                • __CxxThrowException@8.LIBVCRUNTIME ref: 00F50685
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Exception@8Throw$ExceptionRaise
                                                                • String ID: Unknown exception
                                                                • API String ID: 3476068407-410509341
                                                                • Opcode ID: b460fe843c28f755bc4798e1ba8fa40348233c80bace7a4afc39bf6b3cb8f7a9
                                                                • Instruction ID: d9fb1766352749563eaaffeda941ace99746cba2c94947fb9640f5312614cc91
                                                                • Opcode Fuzzy Hash: b460fe843c28f755bc4798e1ba8fa40348233c80bace7a4afc39bf6b3cb8f7a9
                                                                • Instruction Fuzzy Hash: 07F0FF20D0020D738B00BAA8DC46D9E7B6C5E00361B604430BE18924A2EF75EA6EE991
                                                                Function 00F310F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F31BF4
                                                                  • Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00F31BFC
                                                                  • Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F31C07
                                                                  • Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F31C12
                                                                  • Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00F31C1A
                                                                  • Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00F31C22
                                                                  • Part of subcall function 00F31B4A: RegisterWindowMessageW.USER32(00000004,?,00F312C4), ref: 00F31BA2
                                                                • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00F3136A
                                                                • OleInitialize.OLE32 ref: 00F31388
                                                                • CloseHandle.KERNEL32(00000000,00000000), ref: 00F724AB
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                • String ID:
                                                                • API String ID: 1986988660-0
                                                                • Opcode ID: 3dc149384d17bf620085ccf7039fdef0f371f66758d1ed4d5c99b495565b45b4
                                                                • Instruction ID: 81a72c640c90879aec6effd2fd86dccd6b513776203e2938ce6acf4b1a36e93c
                                                                • Opcode Fuzzy Hash: 3dc149384d17bf620085ccf7039fdef0f371f66758d1ed4d5c99b495565b45b4
                                                                • Instruction Fuzzy Hash: 5071BDB4905201CFD3A6DF79E9456553AE0BB48352F58822EE0CADB299EB3BC601DF41
                                                                Function 00F686AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • FindCloseChangeNotification.KERNEL32(00000000,00000000,?,?,00F685CC,?,00FF8CC8,0000000C), ref: 00F68704
                                                                • GetLastError.KERNEL32(?,00F685CC,?,00FF8CC8,0000000C), ref: 00F6870E
                                                                • __dosmaperr.LIBCMT ref: 00F68739
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ChangeCloseErrorFindLastNotification__dosmaperr
                                                                • String ID:
                                                                • API String ID: 490808831-0
                                                                • Opcode ID: ae6c34b2ab1d96a6af72425d3ae1c45e694899c2026521aa74062b41aac3b9ec
                                                                • Instruction ID: 8e632763ae69413c292c10be25699593f16ae07c272cf332e6a3810d8ed8946a
                                                                • Opcode Fuzzy Hash: ae6c34b2ab1d96a6af72425d3ae1c45e694899c2026521aa74062b41aac3b9ec
                                                                • Instruction Fuzzy Hash: 17012B33E0566016D6356234EC46B7E775A4B81FF4F39031DF9589B1D2DEA68C83B290
                                                                Function 00F41310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __Init_thread_footer.LIBCMT ref: 00F417F6
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Init_thread_footer
                                                                • String ID: CALL
                                                                • API String ID: 1385522511-4196123274
                                                                • Opcode ID: 7446b91a88acef801e3482f27d98f5450834614b3425ed0de54d0498726abd51
                                                                • Instruction ID: 80d2b4b44797fbb8d0bcedbd3c31efa181f4132a16dd3bf9a4ab7ef42954fc0b
                                                                • Opcode Fuzzy Hash: 7446b91a88acef801e3482f27d98f5450834614b3425ed0de54d0498726abd51
                                                                • Instruction Fuzzy Hash: A5229D70A083019FC714DF14C894B6ABBF1BF85314F18891DF89A8B3A1D775E885EB92
                                                                Function 00F32DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetOpenFileNameW.COMDLG32(?), ref: 00F72C8C
                                                                  • Part of subcall function 00F33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F33A97,?,?,00F32E7F,?,?,?,00000000), ref: 00F33AC2
                                                                  • Part of subcall function 00F32DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00F32DC4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Name$Path$FileFullLongOpen
                                                                • String ID: X
                                                                • API String ID: 779396738-3081909835
                                                                • Opcode ID: 863cb8aaea7b5bf0f6d10b248a8bb5d159ddda94a66d77e3397f2e01e58f8844
                                                                • Instruction ID: f463f45a483bca0cf551e467205d2ee05d116a16dc0aabe6437f73c1fe522bfb
                                                                • Opcode Fuzzy Hash: 863cb8aaea7b5bf0f6d10b248a8bb5d159ddda94a66d77e3397f2e01e58f8844
                                                                • Instruction Fuzzy Hash: F2219671A0025C9BCB41EF94CC45BEE7BF8AF49324F00805AE505E7241DBB855899FA1
                                                                Function 00F33837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F33908
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: IconNotifyShell_
                                                                • String ID:
                                                                • API String ID: 1144537725-0
                                                                • Opcode ID: 0fa42009ec33a512e046ae9b80bb50bfa230426ed2fe9022f56018ab8a0af908
                                                                • Instruction ID: e8bd2233c130f8bd63353a330dd5aad0015a9c5f13a37dc633a250dd8d97b386
                                                                • Opcode Fuzzy Hash: 0fa42009ec33a512e046ae9b80bb50bfa230426ed2fe9022f56018ab8a0af908
                                                                • Instruction Fuzzy Hash: A331D271904300DFD721DF24D88579BBBE8FB49329F00092EF5D983280E775AA44DB92
                                                                Function 00F34ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F34E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F34EDD,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E9C
                                                                  • Part of subcall function 00F34E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F34EAE
                                                                  • Part of subcall function 00F34E90: FreeLibrary.KERNEL32(00000000,?,?,00F34EDD,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34EC0
                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34EFD
                                                                  • Part of subcall function 00F34E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F73CDE,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E62
                                                                  • Part of subcall function 00F34E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F34E74
                                                                  • Part of subcall function 00F34E59: FreeLibrary.KERNEL32(00000000,?,?,00F73CDE,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E87
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Library$Load$AddressFreeProc
                                                                • String ID:
                                                                • API String ID: 2632591731-0
                                                                • Opcode ID: 4dc47cfc9dfb025ca06bad3d9a1aa29f5d62b23b873076de0ef040d45e8df871
                                                                • Instruction ID: 68660fb62f2bf9f7d39708997c0d09d5d1ff3b1832b52bb15a7fc5746620a706
                                                                • Opcode Fuzzy Hash: 4dc47cfc9dfb025ca06bad3d9a1aa29f5d62b23b873076de0ef040d45e8df871
                                                                • Instruction Fuzzy Hash: 7A11E732600205AACB14BB74DD12FAD77A59F40B21F14842EF546AB1C1EE78FA45BB50
                                                                Function 00F68402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: __wsopen_s
                                                                • String ID:
                                                                • API String ID: 3347428461-0
                                                                • Opcode ID: f9bc575c94c84168df9a0bd83cccc896ef699e35affb92aece2257d3fb434347
                                                                • Instruction ID: 5c0fea0aca42c7e61c827e34b9f0990598741de2daf00f78a963b6f8c5584909
                                                                • Opcode Fuzzy Hash: f9bc575c94c84168df9a0bd83cccc896ef699e35affb92aece2257d3fb434347
                                                                • Instruction Fuzzy Hash: A311487190410AAFCB05DF58E940ADA7BF4EF48310F104199F808AB302DA31DA22DBA5
                                                                Function 00F5E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                • Instruction ID: 718d14819423378520daf09ab3ee4d0d422975cd17a89ab21a341648368bc2e1
                                                                • Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                                • Instruction Fuzzy Hash: 21F02D32921E149AC7353A69CC05B5A37999F523B3F100715FE21931D1CB78D90AB9A5
                                                                Function 00F63820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: AllocateHeap
                                                                • String ID:
                                                                • API String ID: 1279760036-0
                                                                • Opcode ID: 24842ec7ea6a4e9afa30148df44c0524b4cd87d4be9698ba5e3d336ec35b58aa
                                                                • Instruction ID: dc6557735bf64e6eb3b4105e41d3d008fa7eb09b7bd8ec4a657f5b3868883ed3
                                                                • Opcode Fuzzy Hash: 24842ec7ea6a4e9afa30148df44c0524b4cd87d4be9698ba5e3d336ec35b58aa
                                                                • Instruction Fuzzy Hash: 7FE0653390122456E63126779D05BDA3749AB427B1F190121BD5597581DB25ED01B3E1
                                                                Function 00F34F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FreeLibrary.KERNEL32(?,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34F6D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FreeLibrary
                                                                • String ID:
                                                                • API String ID: 3664257935-0
                                                                • Opcode ID: 33a25b4b502a7275b2753ffae7623dec6568a4dc57d40ac17a102c82aba33ecc
                                                                • Instruction ID: 3b33e3b2d7e9857f41b6cdf2e404f08509f960df77ed4508c4183fc80664881e
                                                                • Opcode Fuzzy Hash: 33a25b4b502a7275b2753ffae7623dec6568a4dc57d40ac17a102c82aba33ecc
                                                                • Instruction Fuzzy Hash: DDF01C71505751CFDB349F75D490912B7E4AF1433971889AEE1EA83611C731B844EF50
                                                                Function 00F330F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • Shell_NotifyIconW.SHELL32(00000002,?), ref: 00F3314E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: IconNotifyShell_
                                                                • String ID:
                                                                • API String ID: 1144537725-0
                                                                • Opcode ID: dc332e4bfa8b864fd79869db6d66787df4547169fc69de51f5894696f5f7a59e
                                                                • Instruction ID: b9e287af4f4bc4addac580b94d4748875d051ed9dfc28d8b4357ba15163a1916
                                                                • Opcode Fuzzy Hash: dc332e4bfa8b864fd79869db6d66787df4547169fc69de51f5894696f5f7a59e
                                                                • Instruction Fuzzy Hash: 6CF037709143189FE763DB24DC4A7D57BBCA701708F0041E5A68897185DB759788CF91
                                                                Function 00F32DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00F32DC4
                                                                  • Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: LongNamePath_wcslen
                                                                • String ID:
                                                                • API String ID: 541455249-0
                                                                • Opcode ID: 1160767055506a78d41c8c47cadf9a53feee97ca3879741c0aa2bdbc8cb5e7f1
                                                                • Instruction ID: 0bb9ea6d82c86d7bfa876251b671c2465bbcfd7f0818c69e262a37bd64e93781
                                                                • Opcode Fuzzy Hash: 1160767055506a78d41c8c47cadf9a53feee97ca3879741c0aa2bdbc8cb5e7f1
                                                                • Instruction Fuzzy Hash: 8CE0CD72A001245BC71092589C06FDA77DDDFC8790F054071FD0DD7248D964AD849691
                                                                Function 00F32B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F33837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F33908
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00F32B6B
                                                                  • Part of subcall function 00F330F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00F3314E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: IconNotifyShell_$CurrentDirectory
                                                                • String ID:
                                                                • API String ID: 2619246295-0
                                                                • Opcode ID: 9ce87d6a41c2e19cfefb18a27b9fff64756535b86563395e7ec453b2e617ba88
                                                                • Instruction ID: 7cba9fef76d9419a4c8eab5d41ce282b3e859ba8708b8b23bb77ac5f91907e7d
                                                                • Opcode Fuzzy Hash: 9ce87d6a41c2e19cfefb18a27b9fff64756535b86563395e7ec453b2e617ba88
                                                                • Instruction Fuzzy Hash: 54E0C23270824807CA09FB74AC529BDF7599BD5375F40153EF286831A3CF7D8A49A352
                                                                Function 00F7039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateFileW.KERNEL32(00000000,00000000,?,00F70704,?,?,00000000,?,00F70704,00000000,0000000C), ref: 00F703B7
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateFile
                                                                • String ID:
                                                                • API String ID: 823142352-0
                                                                • Opcode ID: 7066e603521015cc981bc968a756a9999dd613e4e7d51e9b01758365827cb4c8
                                                                • Instruction ID: db1040b6e8ae096eb3fe68a5d86efb09314944d89bf253344ea7627a283d06ff
                                                                • Opcode Fuzzy Hash: 7066e603521015cc981bc968a756a9999dd613e4e7d51e9b01758365827cb4c8
                                                                • Instruction Fuzzy Hash: EDD06C3204010DBBDF028F85DD06EDA3BAAFB48714F014000FE1856020C732E821AB90
                                                                Function 00F31CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00F31CBC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: InfoParametersSystem
                                                                • String ID:
                                                                • API String ID: 3098949447-0
                                                                • Opcode ID: 767ddd735556f1ac4fefac3ff07a24db44879abf47c7fa3025a9c78a82407216
                                                                • Instruction ID: 2c2704f0bd9474643d1bd0323a23434cc4b21109299ad972a0468de871746e72
                                                                • Opcode Fuzzy Hash: 767ddd735556f1ac4fefac3ff07a24db44879abf47c7fa3025a9c78a82407216
                                                                • Instruction Fuzzy Hash: D2C09236280308EFF3268B80BD4FF107765A348B01F088401F68EAA5D7C7B76861EB94

                                                                Non-executed Functions

                                                                Function 00FC9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2
                                                                • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00FC961A
                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FC965B
                                                                • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00FC969F
                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FC96C9
                                                                • SendMessageW.USER32 ref: 00FC96F2
                                                                • GetKeyState.USER32(00000011), ref: 00FC978B
                                                                • GetKeyState.USER32(00000009), ref: 00FC9798
                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FC97AE
                                                                • GetKeyState.USER32(00000010), ref: 00FC97B8
                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FC97E9
                                                                • SendMessageW.USER32 ref: 00FC9810
                                                                • SendMessageW.USER32(?,00001030,?,00FC7E95), ref: 00FC9918
                                                                • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00FC992E
                                                                • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00FC9941
                                                                • SetCapture.USER32(?), ref: 00FC994A
                                                                • ClientToScreen.USER32(?,?), ref: 00FC99AF
                                                                • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00FC99BC
                                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FC99D6
                                                                • ReleaseCapture.USER32 ref: 00FC99E1
                                                                • GetCursorPos.USER32(?), ref: 00FC9A19
                                                                • ScreenToClient.USER32(?,?), ref: 00FC9A26
                                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00FC9A80
                                                                • SendMessageW.USER32 ref: 00FC9AAE
                                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00FC9AEB
                                                                • SendMessageW.USER32 ref: 00FC9B1A
                                                                • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00FC9B3B
                                                                • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00FC9B4A
                                                                • GetCursorPos.USER32(?), ref: 00FC9B68
                                                                • ScreenToClient.USER32(?,?), ref: 00FC9B75
                                                                • GetParent.USER32(?), ref: 00FC9B93
                                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00FC9BFA
                                                                • SendMessageW.USER32 ref: 00FC9C2B
                                                                • ClientToScreen.USER32(?,?), ref: 00FC9C84
                                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00FC9CB4
                                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00FC9CDE
                                                                • SendMessageW.USER32 ref: 00FC9D01
                                                                • ClientToScreen.USER32(?,?), ref: 00FC9D4E
                                                                • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00FC9D82
                                                                  • Part of subcall function 00F49944: GetWindowLongW.USER32(?,000000EB), ref: 00F49952
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC9E05
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                                • String ID: @GUI_DRAGID$F
                                                                • API String ID: 3429851547-4164748364
                                                                • Opcode ID: 569893073e6c0fda8e2cafa74a96301abfa8b215389fbe9f03484840085997dc
                                                                • Instruction ID: 03699eae7e643aabda349c6524a332903ed8f156269aaa4dd5dd64aa9a1c6343
                                                                • Opcode Fuzzy Hash: 569893073e6c0fda8e2cafa74a96301abfa8b215389fbe9f03484840085997dc
                                                                • Instruction Fuzzy Hash: 32428D31608206AFD725CF24CE4AFAABBE5FF48320F14061DF599872A1D7B1D950EB91
                                                                Function 00FC4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00FC48F3
                                                                • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00FC4908
                                                                • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00FC4927
                                                                • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00FC494B
                                                                • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00FC495C
                                                                • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00FC497B
                                                                • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00FC49AE
                                                                • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00FC49D4
                                                                • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00FC4A0F
                                                                • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00FC4A56
                                                                • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00FC4A7E
                                                                • IsMenu.USER32(?), ref: 00FC4A97
                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FC4AF2
                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FC4B20
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC4B94
                                                                • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00FC4BE3
                                                                • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00FC4C82
                                                                • wsprintfW.USER32 ref: 00FC4CAE
                                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FC4CC9
                                                                • GetWindowTextW.USER32(?,00000000,00000001), ref: 00FC4CF1
                                                                • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00FC4D13
                                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FC4D33
                                                                • GetWindowTextW.USER32(?,00000000,00000001), ref: 00FC4D5A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                                                                • String ID: %d/%02d/%02d
                                                                • API String ID: 4054740463-328681919
                                                                • Opcode ID: 9f53d4f26d484504f965768c1ae74358dfb389e2167df0dd9e98961417d5b4a3
                                                                • Instruction ID: 569443d7e3f5b33a97ad315d7ecbf2645168d6d58de6cf60d25f3de2bf60de2f
                                                                • Opcode Fuzzy Hash: 9f53d4f26d484504f965768c1ae74358dfb389e2167df0dd9e98961417d5b4a3
                                                                • Instruction Fuzzy Hash: A512257190021AABEB248F24CE5AFAE7BF8EF45720F10411DF51ADB2E1D774A940EB50
                                                                Function 00F4F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetForegroundWindow.USER32(?,00000000), ref: 00F4F998
                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F8F474
                                                                • IsIconic.USER32(00000000), ref: 00F8F47D
                                                                • ShowWindow.USER32(00000000,00000009), ref: 00F8F48A
                                                                • SetForegroundWindow.USER32(00000000), ref: 00F8F494
                                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F8F4AA
                                                                • GetCurrentThreadId.KERNEL32 ref: 00F8F4B1
                                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F8F4BD
                                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 00F8F4CE
                                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 00F8F4D6
                                                                • AttachThreadInput.USER32(00000000,?,00000001), ref: 00F8F4DE
                                                                • SetForegroundWindow.USER32(00000000), ref: 00F8F4E1
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F8F4F6
                                                                • keybd_event.USER32(00000012,00000000), ref: 00F8F501
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F8F50B
                                                                • keybd_event.USER32(00000012,00000000), ref: 00F8F510
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F8F519
                                                                • keybd_event.USER32(00000012,00000000), ref: 00F8F51E
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F8F528
                                                                • keybd_event.USER32(00000012,00000000), ref: 00F8F52D
                                                                • SetForegroundWindow.USER32(00000000), ref: 00F8F530
                                                                • AttachThreadInput.USER32(?,?,00000000), ref: 00F8F557
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                • String ID: Shell_TrayWnd
                                                                • API String ID: 4125248594-2988720461
                                                                • Opcode ID: 913ed849ed511c916dcac2ccfa4d350b5baa2547c7d3b5e7240978a1439ad566
                                                                • Instruction ID: 66b94b354b41e1a1a33ae42bf411182ef4e4d23600a58afc0fbb8b98ad124024
                                                                • Opcode Fuzzy Hash: 913ed849ed511c916dcac2ccfa4d350b5baa2547c7d3b5e7240978a1439ad566
                                                                • Instruction Fuzzy Hash: B8315071A4021CBEEB206BB55D4AFBF7E6CEB44B50F140426FA09EB1D1C6B15900BBA0
                                                                Function 00F91201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F916C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F9170D
                                                                  • Part of subcall function 00F916C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F9173A
                                                                  • Part of subcall function 00F916C3: GetLastError.KERNEL32 ref: 00F9174A
                                                                • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00F91286
                                                                • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00F912A8
                                                                • CloseHandle.KERNEL32(?), ref: 00F912B9
                                                                • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00F912D1
                                                                • GetProcessWindowStation.USER32 ref: 00F912EA
                                                                • SetProcessWindowStation.USER32(00000000), ref: 00F912F4
                                                                • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00F91310
                                                                  • Part of subcall function 00F910BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F911FC), ref: 00F910D4
                                                                  • Part of subcall function 00F910BF: CloseHandle.KERNEL32(?,?,00F911FC), ref: 00F910E9
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                                                • String ID: $default$winsta0
                                                                • API String ID: 22674027-1027155976
                                                                • Opcode ID: 5f256af5d3f8c59bd486e58db27121f9d057b9e0f0195947be02d678f77e5b08
                                                                • Instruction ID: 534511dd67dbfaed8130fe2ad68ad1bc4081947cfdb4c9fe9fcdc7bfa6173b78
                                                                • Opcode Fuzzy Hash: 5f256af5d3f8c59bd486e58db27121f9d057b9e0f0195947be02d678f77e5b08
                                                                • Instruction Fuzzy Hash: 98819E71D0020AABEF10DFA8DD49FEE7BB9FF09714F044129FA14A61A0C7358954EB60
                                                                Function 00F90B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F910F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F91114
                                                                  • Part of subcall function 00F910F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91120
                                                                  • Part of subcall function 00F910F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F9112F
                                                                  • Part of subcall function 00F910F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91136
                                                                  • Part of subcall function 00F910F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F9114D
                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F90BCC
                                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F90C00
                                                                • GetLengthSid.ADVAPI32(?), ref: 00F90C17
                                                                • GetAce.ADVAPI32(?,00000000,?), ref: 00F90C51
                                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F90C6D
                                                                • GetLengthSid.ADVAPI32(?), ref: 00F90C84
                                                                • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00F90C8C
                                                                • HeapAlloc.KERNEL32(00000000), ref: 00F90C93
                                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F90CB4
                                                                • CopySid.ADVAPI32(00000000), ref: 00F90CBB
                                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F90CEA
                                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F90D0C
                                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F90D1E
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90D45
                                                                • HeapFree.KERNEL32(00000000), ref: 00F90D4C
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90D55
                                                                • HeapFree.KERNEL32(00000000), ref: 00F90D5C
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90D65
                                                                • HeapFree.KERNEL32(00000000), ref: 00F90D6C
                                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 00F90D78
                                                                • HeapFree.KERNEL32(00000000), ref: 00F90D7F
                                                                  • Part of subcall function 00F91193: GetProcessHeap.KERNEL32(00000008,00F90BB1,?,00000000,?,00F90BB1,?), ref: 00F911A1
                                                                  • Part of subcall function 00F91193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00F90BB1,?), ref: 00F911A8
                                                                  • Part of subcall function 00F91193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00F90BB1,?), ref: 00F911B7
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                • String ID:
                                                                • API String ID: 4175595110-0
                                                                • Opcode ID: fdc5efa5f37bb8cbe081b1409070b53ebbfce131e8420d66f424ef408294f2b0
                                                                • Instruction ID: 2c5628d3e8a78c255399cba5f805be21554b4a02120895d2eb56ef3fe84ed4ca
                                                                • Opcode Fuzzy Hash: fdc5efa5f37bb8cbe081b1409070b53ebbfce131e8420d66f424ef408294f2b0
                                                                • Instruction Fuzzy Hash: 96715972D0020AAFEF109FA5DD45FAEBBBCBF04314F044515E918E7291DB75A905EBA0
                                                                Function 00FAEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • OpenClipboard.USER32(00FCCC08), ref: 00FAEB29
                                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 00FAEB37
                                                                • GetClipboardData.USER32(0000000D), ref: 00FAEB43
                                                                • CloseClipboard.USER32 ref: 00FAEB4F
                                                                • GlobalLock.KERNEL32(00000000), ref: 00FAEB87
                                                                • CloseClipboard.USER32 ref: 00FAEB91
                                                                • GlobalUnlock.KERNEL32(00000000,00000000), ref: 00FAEBBC
                                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 00FAEBC9
                                                                • GetClipboardData.USER32(00000001), ref: 00FAEBD1
                                                                • GlobalLock.KERNEL32(00000000), ref: 00FAEBE2
                                                                • GlobalUnlock.KERNEL32(00000000,?), ref: 00FAEC22
                                                                • IsClipboardFormatAvailable.USER32(0000000F), ref: 00FAEC38
                                                                • GetClipboardData.USER32(0000000F), ref: 00FAEC44
                                                                • GlobalLock.KERNEL32(00000000), ref: 00FAEC55
                                                                • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00FAEC77
                                                                • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00FAEC94
                                                                • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00FAECD2
                                                                • GlobalUnlock.KERNEL32(00000000,?,?), ref: 00FAECF3
                                                                • CountClipboardFormats.USER32 ref: 00FAED14
                                                                • CloseClipboard.USER32 ref: 00FAED59
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                                • String ID:
                                                                • API String ID: 420908878-0
                                                                • Opcode ID: 7ad2b238354473658119414eda9b9f1fbcc78891afb35a3d2ef01ef6013c0353
                                                                • Instruction ID: 401867b89ef2be3a35334e9ce4f8fbcb2032bcdd99ec595356ace42521f577a0
                                                                • Opcode Fuzzy Hash: 7ad2b238354473658119414eda9b9f1fbcc78891afb35a3d2ef01ef6013c0353
                                                                • Instruction Fuzzy Hash: 50610175204306AFD300EF20CD89F6AB7A4AF85764F14441DF85A872A2CB71DD06EBA2
                                                                Function 00FA698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 00FA69BE
                                                                • FindClose.KERNEL32(00000000), ref: 00FA6A12
                                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FA6A4E
                                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FA6A75
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00FA6AB2
                                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00FA6ADF
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                                                • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                                • API String ID: 3830820486-3289030164
                                                                • Opcode ID: 108612fb7c021735c0400c8c0b04df359be105cbc1a2cb29f6fbbf66184f9aad
                                                                • Instruction ID: a4512fbb2d151209966a2b84d20d6ab7dc2a81c7b0999f1288b4cb6ef4112b2d
                                                                • Opcode Fuzzy Hash: 108612fb7c021735c0400c8c0b04df359be105cbc1a2cb29f6fbbf66184f9aad
                                                                • Instruction Fuzzy Hash: FFD185B2508304AFC314EBA0CD85EABB7ECAF89714F44491DF589D7151EB78DA04DB62
                                                                Function 00FA9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FA9663
                                                                • GetFileAttributesW.KERNEL32(?), ref: 00FA96A1
                                                                • SetFileAttributesW.KERNEL32(?,?), ref: 00FA96BB
                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00FA96D3
                                                                • FindClose.KERNEL32(00000000), ref: 00FA96DE
                                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00FA96FA
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00FA974A
                                                                • SetCurrentDirectoryW.KERNEL32(00FF6B7C), ref: 00FA9768
                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00FA9772
                                                                • FindClose.KERNEL32(00000000), ref: 00FA977F
                                                                • FindClose.KERNEL32(00000000), ref: 00FA978F
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                • String ID: *.*
                                                                • API String ID: 1409584000-438819550
                                                                • Opcode ID: fddc28b1b18f32b89e12057ec3f86f788145ae9278b4ee576d12a2d21aea8d3a
                                                                • Instruction ID: 3e724c934f26e5c69ba7210438ba08ebd6a2ff2254e9da7aaadeaf3062dc6fe3
                                                                • Opcode Fuzzy Hash: fddc28b1b18f32b89e12057ec3f86f788145ae9278b4ee576d12a2d21aea8d3a
                                                                • Instruction Fuzzy Hash: 7E31E27290420D6ADF10EFB4ED09EEE77AC9F4A320F1040A5FA18E31A0DB74D944AE60
                                                                Function 00FA979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FA97BE
                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00FA9819
                                                                • FindClose.KERNEL32(00000000), ref: 00FA9824
                                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00FA9840
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00FA9890
                                                                • SetCurrentDirectoryW.KERNEL32(00FF6B7C), ref: 00FA98AE
                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00FA98B8
                                                                • FindClose.KERNEL32(00000000), ref: 00FA98C5
                                                                • FindClose.KERNEL32(00000000), ref: 00FA98D5
                                                                  • Part of subcall function 00F9DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F9DB00
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                • String ID: *.*
                                                                • API String ID: 2640511053-438819550
                                                                • Opcode ID: b729705b0e19e12b443814714582942f4bc860658ee7b18565003aafd9071aed
                                                                • Instruction ID: 683f03b214e84b412490dfbb79b6152c1d8145e5db5689572f755bff1fff1463
                                                                • Opcode Fuzzy Hash: b729705b0e19e12b443814714582942f4bc860658ee7b18565003aafd9071aed
                                                                • Instruction Fuzzy Hash: 2F31C37290421D6ADB10EFB4EC49EEE77AC9F47330F5041A5E914E30A0DBB8D945EB60
                                                                Function 00FBBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00FBC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FBB6AE,?,?), ref: 00FBC9B5
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBC9F1
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA68
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA9E
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBBF3E
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00FBBFA9
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00FBBFCD
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00FBC02C
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00FBC0E7
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00FBC154
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00FBC1E9
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00FBC23A
                                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00FBC2E3
                                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00FBC382
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00FBC38F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                                • String ID:
                                                                • API String ID: 3102970594-0
                                                                • Opcode ID: 6e68334c180b8f60cee0a7e4e5bf4053bbc1dfc917975283c3eef8e03d5ee7fb
                                                                • Instruction ID: caeb6d2617d56eca89b4920ffa1d8d5e41bc986afe137168bd7eac8f28405e05
                                                                • Opcode Fuzzy Hash: 6e68334c180b8f60cee0a7e4e5bf4053bbc1dfc917975283c3eef8e03d5ee7fb
                                                                • Instruction Fuzzy Hash: D5025B71604200AFC714DF29C891E6ABBE5AF89318F58849DF84ADB2A2D731EC45DF91
                                                                Function 00FA8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLocalTime.KERNEL32(?), ref: 00FA8257
                                                                • SystemTimeToFileTime.KERNEL32(?,?), ref: 00FA8267
                                                                • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00FA8273
                                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FA8310
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8324
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8356
                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00FA838C
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8395
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CurrentDirectoryTime$File$Local$System
                                                                • String ID: *.*
                                                                • API String ID: 1464919966-438819550
                                                                • Opcode ID: 37825269ef1e855fba01f60e208668ee6d289bf34000b041fbaee4c4ec31ebad
                                                                • Instruction ID: bf71991163eede01e58258ccf49e5ef5aa8fc3107ad5d29bcac5c57266d25b20
                                                                • Opcode Fuzzy Hash: 37825269ef1e855fba01f60e208668ee6d289bf34000b041fbaee4c4ec31ebad
                                                                • Instruction Fuzzy Hash: BD618DB25083059FCB10EF60C841AAEB3E8FF89360F04491EF989D7251DB75E946DB92
                                                                Function 00F9D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F33A97,?,?,00F32E7F,?,?,?,00000000), ref: 00F33AC2
                                                                  • Part of subcall function 00F9E199: GetFileAttributesW.KERNEL32(?,00F9CF95), ref: 00F9E19A
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 00F9D122
                                                                • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00F9D1DD
                                                                • MoveFileW.KERNEL32(?,?), ref: 00F9D1F0
                                                                • DeleteFileW.KERNEL32(?,?,?,?), ref: 00F9D20D
                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F9D237
                                                                  • Part of subcall function 00F9D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00F9D21C,?,?), ref: 00F9D2B2
                                                                • FindClose.KERNEL32(00000000,?,?,?), ref: 00F9D253
                                                                • FindClose.KERNEL32(00000000), ref: 00F9D264
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                                • String ID: \*.*
                                                                • API String ID: 1946585618-1173974218
                                                                • Opcode ID: 93cedabef000a39a38fe3a00d352f22c9982e6571aec1978d63f8750e059673a
                                                                • Instruction ID: 895fff2caea2a56d673fd1de845b39729cbbdb5c94e15afb2e793249bd0fd341
                                                                • Opcode Fuzzy Hash: 93cedabef000a39a38fe3a00d352f22c9982e6571aec1978d63f8750e059673a
                                                                • Instruction Fuzzy Hash: AB617C31C0510DAADF05EBE0CE929EDB7B5AF54320F704065E442B71A1EB78AF09EB60
                                                                Function 00FAED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                • String ID:
                                                                • API String ID: 1737998785-0
                                                                • Opcode ID: f936661ce0d9d7d87428582a5f07f749d5c323930f3530bacf1f55a2be0a2600
                                                                • Instruction ID: 6b87a5878e411813d747dbac8365415b5949abe794322030a38a804b69c15d87
                                                                • Opcode Fuzzy Hash: f936661ce0d9d7d87428582a5f07f749d5c323930f3530bacf1f55a2be0a2600
                                                                • Instruction Fuzzy Hash: 2941EC75604211AFE320CF25D989F19BBE0EF05329F05C09DE4198B662C735EC42EBD0
                                                                Function 00F9E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F916C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F9170D
                                                                  • Part of subcall function 00F916C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F9173A
                                                                  • Part of subcall function 00F916C3: GetLastError.KERNEL32 ref: 00F9174A
                                                                • ExitWindowsEx.USER32(?,00000000), ref: 00F9E932
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                • String ID: $ $@$SeShutdownPrivilege
                                                                • API String ID: 2234035333-3163812486
                                                                • Opcode ID: 8b2c127e45420fd496b25820c647ee7f388b6e2327181da1bf35342dbd00b877
                                                                • Instruction ID: b1410a36289ed5971e17b6e3aee559f1343b4637550da814c13f20a0bf600ccb
                                                                • Opcode Fuzzy Hash: 8b2c127e45420fd496b25820c647ee7f388b6e2327181da1bf35342dbd00b877
                                                                • Instruction Fuzzy Hash: 6101D673E10215ABFF64A6B49D86FBB726CAB14760F150821FD03E31D1D9A55C40B1D0
                                                                Function 00FB1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00FB1276
                                                                • WSAGetLastError.WSOCK32 ref: 00FB1283
                                                                • bind.WSOCK32(00000000,?,00000010), ref: 00FB12BA
                                                                • WSAGetLastError.WSOCK32 ref: 00FB12C5
                                                                • closesocket.WSOCK32(00000000), ref: 00FB12F4
                                                                • listen.WSOCK32(00000000,00000005), ref: 00FB1303
                                                                • WSAGetLastError.WSOCK32 ref: 00FB130D
                                                                • closesocket.WSOCK32(00000000), ref: 00FB133C
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$closesocket$bindlistensocket
                                                                • String ID:
                                                                • API String ID: 540024437-0
                                                                • Opcode ID: 69b3b0daaa46edfc03d0bbd8a1bf990f09bb794ba62f828967c76ad39a539a54
                                                                • Instruction ID: 8edb029f9820aa30f8cadd1204946c8129908ad36132d78382e1f93b45b9d465
                                                                • Opcode Fuzzy Hash: 69b3b0daaa46edfc03d0bbd8a1bf990f09bb794ba62f828967c76ad39a539a54
                                                                • Instruction Fuzzy Hash: 8641D131A001009FD710DF25C999B6ABBE5BF46328F588088E85A8F2D2C731EC81DFE0
                                                                Function 00F9D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F33A97,?,?,00F32E7F,?,?,?,00000000), ref: 00F33AC2
                                                                  • Part of subcall function 00F9E199: GetFileAttributesW.KERNEL32(?,00F9CF95), ref: 00F9E19A
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 00F9D420
                                                                • DeleteFileW.KERNEL32(?,?,?,?), ref: 00F9D470
                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00F9D481
                                                                • FindClose.KERNEL32(00000000), ref: 00F9D498
                                                                • FindClose.KERNEL32(00000000), ref: 00F9D4A1
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                • String ID: \*.*
                                                                • API String ID: 2649000838-1173974218
                                                                • Opcode ID: 16e5b4b157de8dd438049e9870f68b1f3f672f519cb3ae38a8c2e48c2a9a8f59
                                                                • Instruction ID: 4684b7dbbdf799868627d98a0aab3a09d11fa2b9e2a0d0ee3be0098cea873a51
                                                                • Opcode Fuzzy Hash: 16e5b4b157de8dd438049e9870f68b1f3f672f519cb3ae38a8c2e48c2a9a8f59
                                                                • Instruction Fuzzy Hash: 5331AE3140C3459BC704EF64DD929AFB7A8AE91324F504A1DF4D5931A1EB34EA09EBA3
                                                                Function 00F6E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: __floor_pentium4
                                                                • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                • API String ID: 4168288129-2761157908
                                                                • Opcode ID: fc7635dacc55c666b1f99923e768132e3c4a565d0d225f4c840f9764bec82cb6
                                                                • Instruction ID: 6e9f9d183786c1314d3eefc0c32bea864f6d68523aef12fb186d5ec723408137
                                                                • Opcode Fuzzy Hash: fc7635dacc55c666b1f99923e768132e3c4a565d0d225f4c840f9764bec82cb6
                                                                • Instruction Fuzzy Hash: 60C25D72E046288FDB25CF28DD407EAB7B5EB45315F1441EAD80EE7241E778AE85AF40
                                                                Function 00FA648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _wcslen.LIBCMT ref: 00FA64DC
                                                                • CoInitialize.OLE32(00000000), ref: 00FA6639
                                                                • CoCreateInstance.OLE32(00FCFCF8,00000000,00000001,00FCFB68,?), ref: 00FA6650
                                                                • CoUninitialize.OLE32 ref: 00FA68D4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                • String ID: .lnk
                                                                • API String ID: 886957087-24824748
                                                                • Opcode ID: a807a3e25635b64fe1b65b468b9535fb546300655e68038722060574964c9747
                                                                • Instruction ID: 260c9c6e996505db9fbd9bde3f07dab6cb9d67b1c0d06f697b0399aaa6066e53
                                                                • Opcode Fuzzy Hash: a807a3e25635b64fe1b65b468b9535fb546300655e68038722060574964c9747
                                                                • Instruction Fuzzy Hash: A8D149B1508301AFC314EF24C881A6BB7E8FF99714F04496DF595CB2A1EB74E909DB92
                                                                Function 00FB22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetForegroundWindow.USER32(?,?,00000000), ref: 00FB22E8
                                                                  • Part of subcall function 00FAE4EC: GetWindowRect.USER32(?,?), ref: 00FAE504
                                                                • GetDesktopWindow.USER32 ref: 00FB2312
                                                                • GetWindowRect.USER32(00000000), ref: 00FB2319
                                                                • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00FB2355
                                                                • GetCursorPos.USER32(?), ref: 00FB2381
                                                                • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00FB23DF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                                • String ID:
                                                                • API String ID: 2387181109-0
                                                                • Opcode ID: 04585feceee80c063956bbdcad973534db269b35056c5f27c130b63949e155bb
                                                                • Instruction ID: d313c1f98dbfdf9dcb920968b91fd3a18ff19216bc8e56dbaaba6f8340e1f867
                                                                • Opcode Fuzzy Hash: 04585feceee80c063956bbdcad973534db269b35056c5f27c130b63949e155bb
                                                                • Instruction Fuzzy Hash: 6531BE72504319ABDB20DF55CC49F9BB7E9FF88310F040919F98997191DB34E909DB92
                                                                Function 00FA9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00FA9B78
                                                                • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00FA9C8B
                                                                  • Part of subcall function 00FA3874: GetInputState.USER32 ref: 00FA38CB
                                                                  • Part of subcall function 00FA3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FA3966
                                                                • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00FA9BA8
                                                                • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00FA9C75
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                                • String ID: *.*
                                                                • API String ID: 1972594611-438819550
                                                                • Opcode ID: 9dd74fb6eae7ee452db06a2875d77958681f175b8d1732b0ac1d5901921ca754
                                                                • Instruction ID: 2bf99127ac93f0e4897ea5a521d6af9ba03f46a13c2d1ff7eeb493589ee77eb2
                                                                • Opcode Fuzzy Hash: 9dd74fb6eae7ee452db06a2875d77958681f175b8d1732b0ac1d5901921ca754
                                                                • Instruction Fuzzy Hash: 1641B3B1D0860A9FCF14DFA4CD45AEE7BB4EF46320F104065E915A3191DB709E44EF60
                                                                Function 00F4997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2
                                                                • DefDlgProcW.USER32(?,?,?,?,?), ref: 00F49A4E
                                                                • GetSysColor.USER32(0000000F), ref: 00F49B23
                                                                • SetBkColor.GDI32(?,00000000), ref: 00F49B36
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Color$LongProcWindow
                                                                • String ID:
                                                                • API String ID: 3131106179-0
                                                                • Opcode ID: db31dd9fc1accd064f11d40895757f1db21b6ef810f5592c50597c01dbad6590
                                                                • Instruction ID: 339451f0320c5facff4b5e6b4148a86d8d17b4cee7d2b723625e697445a7cd91
                                                                • Opcode Fuzzy Hash: db31dd9fc1accd064f11d40895757f1db21b6ef810f5592c50597c01dbad6590
                                                                • Instruction Fuzzy Hash: 99A1D67170C554AEE725BA288C49FBF3E9DDB82360F240209F902C6595CAADDE41F371
                                                                Function 00FB1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00FB304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FB307A
                                                                  • Part of subcall function 00FB304E: _wcslen.LIBCMT ref: 00FB309B
                                                                • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00FB185D
                                                                • WSAGetLastError.WSOCK32 ref: 00FB1884
                                                                • bind.WSOCK32(00000000,?,00000010), ref: 00FB18DB
                                                                • WSAGetLastError.WSOCK32 ref: 00FB18E6
                                                                • closesocket.WSOCK32(00000000), ref: 00FB1915
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                                • String ID:
                                                                • API String ID: 1601658205-0
                                                                • Opcode ID: fcc3d2ae6d6b87370b0ba4f01ea0bc22a9fedf2ee5207b2adc48c8d90dfe25c1
                                                                • Instruction ID: 24c6fd9b955d982b44c1d9fbaa13e3269262d48b75391c13e7f73230532a0965
                                                                • Opcode Fuzzy Hash: fcc3d2ae6d6b87370b0ba4f01ea0bc22a9fedf2ee5207b2adc48c8d90dfe25c1
                                                                • Instruction Fuzzy Hash: F351A375A00200AFDB10EF24C896F6A77E5AB44728F488458FA09AF3D3D775ED419BE1
                                                                Function 00FC1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                • String ID:
                                                                • API String ID: 292994002-0
                                                                • Opcode ID: 186291802796267f917c9ab62d101c8fc0cbd8d89286f3934bcd4ad89a395543
                                                                • Instruction ID: 1640b8f4fd94a481fbd33643fd6fc65a1982e3c68eb92eb268071997955093bf
                                                                • Opcode Fuzzy Hash: 186291802796267f917c9ab62d101c8fc0cbd8d89286f3934bcd4ad89a395543
                                                                • Instruction Fuzzy Hash: AB219131B402125FD720CF2AC986F667BA5FF86325F19805CE84A8B252C775D852EB90
                                                                Function 00F38060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                                • API String ID: 0-1546025612
                                                                • Opcode ID: ee52fa150b0d321bfdb7a40187e847aa1df6fa56cd09dbe25d69c2a65509f32b
                                                                • Instruction ID: ccb206e368d3a2de535de7a2017c52432a152b50cb44cab20740162e0ee78aa5
                                                                • Opcode Fuzzy Hash: ee52fa150b0d321bfdb7a40187e847aa1df6fa56cd09dbe25d69c2a65509f32b
                                                                • Instruction Fuzzy Hash: 2BA29371E0061ACBDF24CF58C8417ADB7B1BF44760F2481AAE819A7385DB749D82EF91
                                                                Function 00F9AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00F9AAAC
                                                                • SetKeyboardState.USER32(00000080), ref: 00F9AAC8
                                                                • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00F9AB36
                                                                • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00F9AB88
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: KeyboardState$InputMessagePostSend
                                                                • String ID:
                                                                • API String ID: 432972143-0
                                                                • Opcode ID: f5d18c84b19043642d570f376c1c0d9fa022b954b63eff00ee03375952a034cf
                                                                • Instruction ID: 84b26512794eea4bbef3bfcd3afc16b8fcbea11d98860e4f2d26e1f7e0b090a1
                                                                • Opcode Fuzzy Hash: f5d18c84b19043642d570f376c1c0d9fa022b954b63eff00ee03375952a034cf
                                                                • Instruction Fuzzy Hash: 59312430E40608AFFF358F698C05BFA7BA6AB84324F04421AF185921D1D7798981F7E2
                                                                Function 00F6BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _free.LIBCMT ref: 00F6BB7F
                                                                  • Part of subcall function 00F629C8: HeapFree.KERNEL32(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
                                                                  • Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0
                                                                • GetTimeZoneInformation.KERNEL32 ref: 00F6BB91
                                                                • WideCharToMultiByte.KERNEL32(00000000,?,0100121C,000000FF,?,0000003F,?,?), ref: 00F6BC09
                                                                • WideCharToMultiByte.KERNEL32(00000000,?,01001270,000000FF,?,0000003F,?,?,?,0100121C,000000FF,?,0000003F,?,?), ref: 00F6BC36
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
                                                                • String ID:
                                                                • API String ID: 806657224-0
                                                                • Opcode ID: 3a3393a00e8615118f91c5e83397b1771ac243358cd2ee72d5b2f8c92ceaee43
                                                                • Instruction ID: a760362af1c38ac17ff297b0b86d7cf4ed79384dc4f4143c063475f2ad4df88d
                                                                • Opcode Fuzzy Hash: 3a3393a00e8615118f91c5e83397b1771ac243358cd2ee72d5b2f8c92ceaee43
                                                                • Instruction Fuzzy Hash: 743125B1D04205EFCB22DF69CC8193DBBB8FF45360B14426AE090DB2A1C7319E90EB50
                                                                Function 00FACE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetReadFile.WININET(?,?,00000400,?), ref: 00FACE89
                                                                • GetLastError.KERNEL32(?,00000000), ref: 00FACEEA
                                                                • SetEvent.KERNEL32(?,?,00000000), ref: 00FACEFE
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorEventFileInternetLastRead
                                                                • String ID:
                                                                • API String ID: 234945975-0
                                                                • Opcode ID: 4fdcdeada9c955c20d6ce8d5213ac447a6dc19ecd271715da858741cb98082b5
                                                                • Instruction ID: b600487fd7936f17155f0743db1ac62cf8d19f33793b144bb68377d82d91f49a
                                                                • Opcode Fuzzy Hash: 4fdcdeada9c955c20d6ce8d5213ac447a6dc19ecd271715da858741cb98082b5
                                                                • Instruction Fuzzy Hash: 43219DB1900305AFEB20DF65C989BA677F8EF41364F10442EE646D2151EB74EE08EBE0
                                                                Function 00F98298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00F982AA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: lstrlen
                                                                • String ID: ($|
                                                                • API String ID: 1659193697-1631851259
                                                                • Opcode ID: 25180d7439e4d51d554d68ec3962593f1305081ef00b64fea1d7723eb5289f43
                                                                • Instruction ID: 0cdc97bb4d5d29443912151404a34bf28db9f072396bfb275a3c25cc152b1610
                                                                • Opcode Fuzzy Hash: 25180d7439e4d51d554d68ec3962593f1305081ef00b64fea1d7723eb5289f43
                                                                • Instruction Fuzzy Hash: E6324575A007059FDB28CF59C480A6AB7F0FF48760B15C46EE49ADB3A1EB70E942DB40
                                                                Function 00FA5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 00FA5CC1
                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00FA5D17
                                                                • FindClose.KERNEL32(?), ref: 00FA5D5F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$File$CloseFirstNext
                                                                • String ID:
                                                                • API String ID: 3541575487-0
                                                                • Opcode ID: ecb704bafbf10ad635824e8f082d231a8a333c6e577a9ceadff19d42659c8934
                                                                • Instruction ID: f02920a7837386bc3212e0bf5300015ba264873835c4f688e01561c97bd87b0b
                                                                • Opcode Fuzzy Hash: ecb704bafbf10ad635824e8f082d231a8a333c6e577a9ceadff19d42659c8934
                                                                • Instruction Fuzzy Hash: A6519AB5A046019FC714CF28C894E96B7E4FF4A324F14855DE99A8B3A2CB30ED05DF91
                                                                Function 00F62622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • IsDebuggerPresent.KERNEL32 ref: 00F6271A
                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F62724
                                                                • UnhandledExceptionFilter.KERNEL32(?), ref: 00F62731
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                • String ID:
                                                                • API String ID: 3906539128-0
                                                                • Opcode ID: cdf737d026b92135263f75efab4f4f6bcc9c507a7eb3e68a87698a4ad58b6377
                                                                • Instruction ID: aa50f0e8ea0ae37ae49c27ff518e97c8f8771975117eb63e6f47ee331c601a5f
                                                                • Opcode Fuzzy Hash: cdf737d026b92135263f75efab4f4f6bcc9c507a7eb3e68a87698a4ad58b6377
                                                                • Instruction Fuzzy Hash: A131C474D0121C9BCB61DF64DD89BD8B7B8AF08310F5041EAE80CA7260EB349F859F84
                                                                Function 00FA51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetErrorMode.KERNEL32(00000001), ref: 00FA51DA
                                                                • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00FA5238
                                                                • SetErrorMode.KERNEL32(00000000), ref: 00FA52A1
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$DiskFreeSpace
                                                                • String ID:
                                                                • API String ID: 1682464887-0
                                                                • Opcode ID: 6359fc18905a1f505a57147ead1fffdae33d494a7169f398c26ac87118af7034
                                                                • Instruction ID: 25308d00f9d389e5db33958872251870396adf2caadd8542dde3d59c72c643cc
                                                                • Opcode Fuzzy Hash: 6359fc18905a1f505a57147ead1fffdae33d494a7169f398c26ac87118af7034
                                                                • Instruction Fuzzy Hash: E5313A75A00518DFDB00DF55D884EADBBB4FF49318F088099E809AB362DB35E856DBA0
                                                                Function 00F916C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F4FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00F50668
                                                                  • Part of subcall function 00F4FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00F50685
                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F9170D
                                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F9173A
                                                                • GetLastError.KERNEL32 ref: 00F9174A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                                • String ID:
                                                                • API String ID: 577356006-0
                                                                • Opcode ID: 68c88d44bd8c519b8a6c4dd5d41d3ac4a6631e6c9c07142a9019b492131f5a83
                                                                • Instruction ID: 1d73f5e0a609695443ed52554b5a6938f32c067dc32830fb674ef069f4d237cc
                                                                • Opcode Fuzzy Hash: 68c88d44bd8c519b8a6c4dd5d41d3ac4a6631e6c9c07142a9019b492131f5a83
                                                                • Instruction Fuzzy Hash: 4011C4B2800309AFE7189F54DC86D6ABBB9FF44714B24852EE45A53241EB70BC419A60
                                                                Function 00F9D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F9D608
                                                                • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00F9D645
                                                                • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F9D650
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseControlCreateDeviceFileHandle
                                                                • String ID:
                                                                • API String ID: 33631002-0
                                                                • Opcode ID: 1fa91a21925db4634610c38ed7c7f2d9a9150e5d9e9e3b1ef4d52b183993a902
                                                                • Instruction ID: 82710b4f6cba75c2fae74ca30833235fc0d938af2c221553868c2f7bda83094f
                                                                • Opcode Fuzzy Hash: 1fa91a21925db4634610c38ed7c7f2d9a9150e5d9e9e3b1ef4d52b183993a902
                                                                • Instruction Fuzzy Hash: 66115E75E05228BFEB108F95ED45FAFBBBCEB45B60F108115F908E7290D6704A059BE1
                                                                Function 00F91663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00F9168C
                                                                • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F916A1
                                                                • FreeSid.ADVAPI32(?), ref: 00F916B1
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                • String ID:
                                                                • API String ID: 3429775523-0
                                                                • Opcode ID: 0529607bfb9d72f8595a7e4e500431417560792c2ffd438632801ec39053edff
                                                                • Instruction ID: 203dfa4fc99da7a89ff49698e5287be191b9e1af6ca1893c29c269716ebed428
                                                                • Opcode Fuzzy Hash: 0529607bfb9d72f8595a7e4e500431417560792c2ffd438632801ec39053edff
                                                                • Instruction Fuzzy Hash: 19F0F471D9030DFBEF00DFE49D8AEAEBBBCFB08604F504565E901E2181E774AA449A94
                                                                Function 00F8D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetUserNameW.ADVAPI32(?,?), ref: 00F8D28C
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: NameUser
                                                                • String ID: X64
                                                                • API String ID: 2645101109-893830106
                                                                • Opcode ID: 3fa63bfafea569ae8f68cd65697c7dec05111c013a0c5c4c7c9d7ecfd28ccd59
                                                                • Instruction ID: 8affc8792f5aa33faeba8ff73963a464c8ab88c62b45b373dcb90dfedea52fe6
                                                                • Opcode Fuzzy Hash: 3fa63bfafea569ae8f68cd65697c7dec05111c013a0c5c4c7c9d7ecfd28ccd59
                                                                • Instruction Fuzzy Hash: 36D0CAB680112DEACB94DBA0EC89EDAB7BCBB04305F100292F50AE2040DB309648AF20
                                                                Function 00F5CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                • Instruction ID: 53e11532cc5bffaa92608796a89bfb0d3eefd482cd5f151d3e5ad8e2eeb07810
                                                                • Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                                • Instruction Fuzzy Hash: 92022D71E002199FDF14CFA9C8806ADBBF1EF48325F25816AD91AE7380D731AA45DBD0
                                                                Function 00FA68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindFirstFileW.KERNEL32(?,?), ref: 00FA6918
                                                                • FindClose.KERNEL32(00000000), ref: 00FA6961
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Find$CloseFileFirst
                                                                • String ID:
                                                                • API String ID: 2295610775-0
                                                                • Opcode ID: 6e5a2ea2020aa0e1fa7b3ca92c6fd3114713f3c41d38b0dbf2c762599cf29d6f
                                                                • Instruction ID: b440da97c987798acfe0d4217469125397ef1408ad72631ca1f5205f208f438f
                                                                • Opcode Fuzzy Hash: 6e5a2ea2020aa0e1fa7b3ca92c6fd3114713f3c41d38b0dbf2c762599cf29d6f
                                                                • Instruction Fuzzy Hash: 391190756042009FC710DF29D889A16BBE5FF89328F19C699E4698F6A2CB34EC05DBD1
                                                                Function 00FA37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00FB4891,?,?,00000035,?), ref: 00FA37E4
                                                                • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00FB4891,?,?,00000035,?), ref: 00FA37F4
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorFormatLastMessage
                                                                • String ID:
                                                                • API String ID: 3479602957-0
                                                                • Opcode ID: e6fb443bbc6874027ea47ee164e6835f36383902ed750b087bc5e83f9d6b0f50
                                                                • Instruction ID: 186bd173f8de30a037d8943a0a617b0de1436a2dbe76103e62f59a3658dbee96
                                                                • Opcode Fuzzy Hash: e6fb443bbc6874027ea47ee164e6835f36383902ed750b087bc5e83f9d6b0f50
                                                                • Instruction Fuzzy Hash: 2AF0E5B16083292AE72057669C4DFEB3AAEEFC5771F000165F50DD3281D9A09904D6F0
                                                                Function 00F9B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00F9B25D
                                                                • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00F9B270
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: InputSendkeybd_event
                                                                • String ID:
                                                                • API String ID: 3536248340-0
                                                                • Opcode ID: f70912de191e22726b971de77cc032a313982c01ba9d507813fc5c2cb273f007
                                                                • Instruction ID: 095445b84ff9a808050496ba57074bbc00f0a1a0cbfd93a5eada5d0fa99c56fa
                                                                • Opcode Fuzzy Hash: f70912de191e22726b971de77cc032a313982c01ba9d507813fc5c2cb273f007
                                                                • Instruction Fuzzy Hash: 6FF06D7180424DABEF058FA0C806BAE7BB0FF04305F00800AF955A6191C3798201AF94
                                                                Function 00F910BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F911FC), ref: 00F910D4
                                                                • CloseHandle.KERNEL32(?,?,00F911FC), ref: 00F910E9
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: AdjustCloseHandlePrivilegesToken
                                                                • String ID:
                                                                • API String ID: 81990902-0
                                                                • Opcode ID: 28eb333c6ad9da0fdb0a236b14d6f2d25be47bde77bdd9891a30592eeb5fb016
                                                                • Instruction ID: 94ef9995e96c1322fdc4169d3f848e2dc2477998fda235c94d9ee14a8570df20
                                                                • Opcode Fuzzy Hash: 28eb333c6ad9da0fdb0a236b14d6f2d25be47bde77bdd9891a30592eeb5fb016
                                                                • Instruction Fuzzy Hash: 3FE04F32404600AEF7252B11FD06E737BA9FB04320B14882DF8AA814B1DB626C90FB50
                                                                Function 00F3CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                • Variable is not of type 'Object'., xrefs: 00F80C40
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: Variable is not of type 'Object'.
                                                                • API String ID: 0-1840281001
                                                                • Opcode ID: f2af5f673f3ae9fe4f1e1148bf485cf1e2ab5f8d1e8d284eadda00553fc02a92
                                                                • Instruction ID: 085123a96a1dbe96973f7ed86b3b036869eb82dbd4223379f0519aae45861312
                                                                • Opcode Fuzzy Hash: f2af5f673f3ae9fe4f1e1148bf485cf1e2ab5f8d1e8d284eadda00553fc02a92
                                                                • Instruction Fuzzy Hash: B832BE35D00218DBCF14EF94C885BEDB7B5BF05324F548059E806BB292DB79AD49EBA0
                                                                Function 00F6676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F66766,?,?,00000008,?,?,00F6FEFE,00000000), ref: 00F66998
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ExceptionRaise
                                                                • String ID:
                                                                • API String ID: 3997070919-0
                                                                • Opcode ID: 59df2218c0b081d387816f73ea2a629e1059bff8c75c314c7d54a755f44f353c
                                                                • Instruction ID: 00b12ad79de2b50be961b6d601fee8a84e142033f36bbb95643e2300e9ddfcd6
                                                                • Opcode Fuzzy Hash: 59df2218c0b081d387816f73ea2a629e1059bff8c75c314c7d54a755f44f353c
                                                                • Instruction Fuzzy Hash: 14B12B32A10609DFD719CF28C48AB657BE0FF45364F298658E899CF2A2C735E991DB40
                                                                Function 00F4B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID: 0-3916222277
                                                                • Opcode ID: 270566680d017628e8b518a002b3efb9227ba676a96b725a6ba5dfd5d088e012
                                                                • Instruction ID: fb80c71abb233f13bcbf9e7b15aaaec826656c41d927b7e4368a4d5a816650f7
                                                                • Opcode Fuzzy Hash: 270566680d017628e8b518a002b3efb9227ba676a96b725a6ba5dfd5d088e012
                                                                • Instruction Fuzzy Hash: B8126071D002299BDB14DF58C8817EEBBB5FF48710F54819AE849EB252DB349E81EB90
                                                                Function 00FAEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • BlockInput.USER32(00000001), ref: 00FAEABD
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: BlockInput
                                                                • String ID:
                                                                • API String ID: 3456056419-0
                                                                • Opcode ID: fef0bc0a11e18e4d4922d2d1ba156fe79f57e3f94747abed20775f4fcd4e0406
                                                                • Instruction ID: a11397f7d31d0ebb43f08428c9c3635026f12abedef3f44a0f0e21c70bb6e7b2
                                                                • Opcode Fuzzy Hash: fef0bc0a11e18e4d4922d2d1ba156fe79f57e3f94747abed20775f4fcd4e0406
                                                                • Instruction Fuzzy Hash: 59E04F762002049FC710EF69D805E9AF7E9AF99770F00841AFD49DB351DB74EC40ABA0
                                                                Function 00F509D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00F503EE), ref: 00F509DA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ExceptionFilterUnhandled
                                                                • String ID:
                                                                • API String ID: 3192549508-0
                                                                • Opcode ID: 5157a7beacb02eb715061046f38e2089e4fe336aa7a375b2a62594e3bcb19a7e
                                                                • Instruction ID: fada75bd749f0a14cee2ba4346b6865cfc1e244b74d9559c94e70a1662f1b379
                                                                • Opcode Fuzzy Hash: 5157a7beacb02eb715061046f38e2089e4fe336aa7a375b2a62594e3bcb19a7e
                                                                • Instruction Fuzzy Hash:
                                                                Function 00F5781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: 0
                                                                • API String ID: 0-4108050209
                                                                • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                • Instruction ID: 7ca8006ddbb72bebf824a7218cef32f4ebfdd5efc998caa8230a32d7101dde20
                                                                • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                                • Instruction Fuzzy Hash: 68516A72E0CB055BDB387528A85D7BF63859B12363F280509DF82D7692C619DE0EF361
                                                                Function 00F66DD9 Relevance: .6, Instructions: 637COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4b7a73798764c0114fbf470992fa2e2ad1ec736c6baf2f5ad112361ec32afb16
                                                                • Instruction ID: 9ce41943db2bb6b3d906f9ecbe0288824c9628d047b7a2ade852174bd5917f8d
                                                                • Opcode Fuzzy Hash: 4b7a73798764c0114fbf470992fa2e2ad1ec736c6baf2f5ad112361ec32afb16
                                                                • Instruction Fuzzy Hash: 88324622D2AF414DD723A634CC22335634AAFB73D9F14C737F81AB59A5EB29C4836140
                                                                Function 00F4CC39 Relevance: .6, Instructions: 635COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4c02b9e24f49f6ad4655dc17f9fad17ea7c3f4830a75a66fb7b8cf8e57729b02
                                                                • Instruction ID: 753009225e8c38a4174f339edfc0fc9569c3eb96040b52d9fb67618baa161ac5
                                                                • Opcode Fuzzy Hash: 4c02b9e24f49f6ad4655dc17f9fad17ea7c3f4830a75a66fb7b8cf8e57729b02
                                                                • Instruction Fuzzy Hash: 7D320832E001558BDF28EF29C4D46FD7BA1EF45320F28856ADA599B291D234DD81FBE0
                                                                Function 00F37920 Relevance: .6, Instructions: 563COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0e8af0a48ba8500c53a787801d233bdbb6ecea89c15691ca09d1dab4ba39defc
                                                                • Instruction ID: e6a708b933df47b1ada736e8f6e7ce9b65109f61f0685da2893a61080ac4c913
                                                                • Opcode Fuzzy Hash: 0e8af0a48ba8500c53a787801d233bdbb6ecea89c15691ca09d1dab4ba39defc
                                                                • Instruction Fuzzy Hash: CF22E2B0E0460ADFDF14DF64C841BAEB7B5FF44320F208129E816A7291EB79AD14EB51
                                                                Function 00F391C0 Relevance: .5, Instructions: 475COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 712209e190bb022b8f8c043d4dcd127443fe80b0b85526416c540c4147cc70d7
                                                                • Instruction ID: 5feda049f2ab20929efd7eed60457e27b45a77e5447ca5741f2b497885658801
                                                                • Opcode Fuzzy Hash: 712209e190bb022b8f8c043d4dcd127443fe80b0b85526416c540c4147cc70d7
                                                                • Instruction Fuzzy Hash: E302C9B1E00109EBDF05DF54D841AAEBBB5FF48310F10816AE81A9B291EB75ED14EB91
                                                                Function 00F69EEE Relevance: .3, Instructions: 294COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 183b1a66db54233ae572f645c5f14f8257c2ede333676d8de1ca35153c6a171a
                                                                • Instruction ID: c8d02267ac7aa0af9556d7be5a6ae5c0a6aa267f864302ac815fdca454af1fee
                                                                • Opcode Fuzzy Hash: 183b1a66db54233ae572f645c5f14f8257c2ede333676d8de1ca35153c6a171a
                                                                • Instruction Fuzzy Hash: 25B11120E2AF444DD32396398931336B75DAFBB2D5F92D31BFC2674D22EB2286835141
                                                                Function 00F51C77 Relevance: .3, Instructions: 254COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                • Instruction ID: 8cab826f732e3b511f41c46b7e0c8a15c8c6172b9a10cb92c4d75a7c111c9462
                                                                • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                                • Instruction Fuzzy Hash: A29177339080A34ADB294639853567EFFF16A523B371A079DDDF2CA1C1EE10A95CF620
                                                                Function 00F51F32 Relevance: .2, Instructions: 244COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                • Instruction ID: 58b162f89e6c1fcba77c3c6dd79732bba49fd1b010679bcb440f887914c64b3f
                                                                • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                                • Instruction Fuzzy Hash: 18916373A094A309DBA94239847413EFFE15A933B371A079DDEF2CA1C5EE24955CF620
                                                                Function 00F519B0 Relevance: .2, Instructions: 240COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                • Instruction ID: 9a22468c55fccbea025610127bad335e4c079c62c04e1f49bf4afe5371d5a7ea
                                                                • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                                • Instruction Fuzzy Hash: 759177736090A349DB2E427A857427DFFE16A923B331A079DD9F2CA1C1FD14A55CF620
                                                                Function 00F57A4A Relevance: .2, Instructions: 237COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fb0caf91f67bcedb3ed14278e37c6a83261d41d4c8386aaa09e8710d298fe3e2
                                                                • Instruction ID: a1a9275cb07d36afcc7641ca0b947f7ffcdc2762c2cbdbc294570726c008b332
                                                                • Opcode Fuzzy Hash: fb0caf91f67bcedb3ed14278e37c6a83261d41d4c8386aaa09e8710d298fe3e2
                                                                • Instruction Fuzzy Hash: 45617831A0870966DA34B928BC99BBE3384DF81363F140919EF43DB295DA199E4FB315
                                                                Function 00F57CA7 Relevance: .2, Instructions: 237COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: dbbaa452d3aaa45e5720b6d1cc5760d33cddaecc180d5e0053b8748e02df844c
                                                                • Instruction ID: f5d9c42dea02fc2af633262cefb09e8eb07d5e54e33c8bb89093d969778b7b00
                                                                • Opcode Fuzzy Hash: dbbaa452d3aaa45e5720b6d1cc5760d33cddaecc180d5e0053b8748e02df844c
                                                                • Instruction Fuzzy Hash: 88619B31E0870957DA3879287C56BBF33A89F41763F100959EF43DB281EA16AD4FB251
                                                                Function 00F51706 Relevance: .2, Instructions: 232COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                • Instruction ID: 52ced95e8dffbc645951d4de2489d1e0430ec2f7b9a9ebba00e7f7988bb47f9d
                                                                • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                                • Instruction Fuzzy Hash: D48156739090A309DB69423D853467EFFE17A923B371A079DD9F2CA1C1EE14A55CF620
                                                                Function 00FA2046 Relevance: .1, Instructions: 72COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4d0f79772ac88e6f2a3c1afb829d6d1061d357a38b5b19be355ecb2ba845e236
                                                                • Instruction ID: 96f9727f363dc6c91deba2dc8c13041258782de077c4565a6ccaca3bdb7c763c
                                                                • Opcode Fuzzy Hash: 4d0f79772ac88e6f2a3c1afb829d6d1061d357a38b5b19be355ecb2ba845e236
                                                                • Instruction Fuzzy Hash: 6621B7727206118BD728CF79C92367E73E5AB54320F15862EE4A7C37C5DE7AA904DB80
                                                                Function 00FB2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DeleteObject.GDI32(00000000), ref: 00FB2B30
                                                                • DeleteObject.GDI32(00000000), ref: 00FB2B43
                                                                • DestroyWindow.USER32 ref: 00FB2B52
                                                                • GetDesktopWindow.USER32 ref: 00FB2B6D
                                                                • GetWindowRect.USER32(00000000), ref: 00FB2B74
                                                                • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00FB2CA3
                                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00FB2CB1
                                                                • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2CF8
                                                                • GetClientRect.USER32(00000000,?), ref: 00FB2D04
                                                                • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00FB2D40
                                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2D62
                                                                • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2D75
                                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2D80
                                                                • GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2D89
                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2D98
                                                                • GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2DA1
                                                                • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2DA8
                                                                • GlobalFree.KERNEL32(00000000), ref: 00FB2DB3
                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2DC5
                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00FCFC38,00000000), ref: 00FB2DDB
                                                                • GlobalFree.KERNEL32(00000000), ref: 00FB2DEB
                                                                • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00FB2E11
                                                                • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00FB2E30
                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2E52
                                                                • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB303F
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                • String ID: $AutoIt v3$DISPLAY$static
                                                                • API String ID: 2211948467-2373415609
                                                                • Opcode ID: 10556a92cca5b9ff756b9c5180eb3d51d234f9f5011ae7c713ead71d3e318f4d
                                                                • Instruction ID: e1cdc61f8c6ca3d39b99cba0674b06e384a9396d30d75ffe4e17439e92ca3be4
                                                                • Opcode Fuzzy Hash: 10556a92cca5b9ff756b9c5180eb3d51d234f9f5011ae7c713ead71d3e318f4d
                                                                • Instruction Fuzzy Hash: A2025071900209AFDB14DF65CD89EAE7BB9EF48720F048558F919AB2A1CB74DD01EF60
                                                                Function 00FC70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetTextColor.GDI32(?,00000000), ref: 00FC712F
                                                                • GetSysColorBrush.USER32(0000000F), ref: 00FC7160
                                                                • GetSysColor.USER32(0000000F), ref: 00FC716C
                                                                • SetBkColor.GDI32(?,000000FF), ref: 00FC7186
                                                                • SelectObject.GDI32(?,?), ref: 00FC7195
                                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00FC71C0
                                                                • GetSysColor.USER32(00000010), ref: 00FC71C8
                                                                • CreateSolidBrush.GDI32(00000000), ref: 00FC71CF
                                                                • FrameRect.USER32(?,?,00000000), ref: 00FC71DE
                                                                • DeleteObject.GDI32(00000000), ref: 00FC71E5
                                                                • InflateRect.USER32(?,000000FE,000000FE), ref: 00FC7230
                                                                • FillRect.USER32(?,?,?), ref: 00FC7262
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC7284
                                                                  • Part of subcall function 00FC73E8: GetSysColor.USER32(00000012), ref: 00FC7421
                                                                  • Part of subcall function 00FC73E8: SetTextColor.GDI32(?,?), ref: 00FC7425
                                                                  • Part of subcall function 00FC73E8: GetSysColorBrush.USER32(0000000F), ref: 00FC743B
                                                                  • Part of subcall function 00FC73E8: GetSysColor.USER32(0000000F), ref: 00FC7446
                                                                  • Part of subcall function 00FC73E8: GetSysColor.USER32(00000011), ref: 00FC7463
                                                                  • Part of subcall function 00FC73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FC7471
                                                                  • Part of subcall function 00FC73E8: SelectObject.GDI32(?,00000000), ref: 00FC7482
                                                                  • Part of subcall function 00FC73E8: SetBkColor.GDI32(?,00000000), ref: 00FC748B
                                                                  • Part of subcall function 00FC73E8: SelectObject.GDI32(?,?), ref: 00FC7498
                                                                  • Part of subcall function 00FC73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00FC74B7
                                                                  • Part of subcall function 00FC73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FC74CE
                                                                  • Part of subcall function 00FC73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00FC74DB
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                                • String ID:
                                                                • API String ID: 4124339563-0
                                                                • Opcode ID: bb08421c1d8e95a2fa0d2c6c6f1e9116f097efd3eceb5b5924a7f1ff2d6edfaa
                                                                • Instruction ID: e55dcfcc280f93c5d21d12e0eeacc1eedb1c538e374d915b2179c4cbf6ad0353
                                                                • Opcode Fuzzy Hash: bb08421c1d8e95a2fa0d2c6c6f1e9116f097efd3eceb5b5924a7f1ff2d6edfaa
                                                                • Instruction Fuzzy Hash: ACA1AE72408306AFD700AF60DE4AF5B7BA9FB89320F140A19F966971E1D731E944EF91
                                                                Function 00F48D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DestroyWindow.USER32(?,?), ref: 00F48E14
                                                                • SendMessageW.USER32(?,00001308,?,00000000), ref: 00F86AC5
                                                                • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00F86AFE
                                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00F86F43
                                                                  • Part of subcall function 00F48F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F48BE8,?,00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F48FC5
                                                                • SendMessageW.USER32(?,00001053), ref: 00F86F7F
                                                                • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00F86F96
                                                                • ImageList_Destroy.COMCTL32(00000000,?), ref: 00F86FAC
                                                                • ImageList_Destroy.COMCTL32(00000000,?), ref: 00F86FB7
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                                • String ID: 0
                                                                • API String ID: 2760611726-4108050209
                                                                • Opcode ID: b6a49ede93b3c7fe607014f88b787c4917c13d1245d6b083e9ae1158801c304d
                                                                • Instruction ID: feb7b183bce0b994a37ca0324ea98b18cc397280fc53e756ba12c4c4774e179e
                                                                • Opcode Fuzzy Hash: b6a49ede93b3c7fe607014f88b787c4917c13d1245d6b083e9ae1158801c304d
                                                                • Instruction Fuzzy Hash: 4912AD31A00201EFDB25EF14C945BEABBE5FB45320F144469F999CB251CB36EC92EB91
                                                                Function 00FB2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DestroyWindow.USER32(00000000), ref: 00FB273E
                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00FB286A
                                                                • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00FB28A9
                                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00FB28B9
                                                                • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00FB2900
                                                                • GetClientRect.USER32(00000000,?), ref: 00FB290C
                                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00FB2955
                                                                • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00FB2964
                                                                • GetStockObject.GDI32(00000011), ref: 00FB2974
                                                                • SelectObject.GDI32(00000000,00000000), ref: 00FB2978
                                                                • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00FB2988
                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FB2991
                                                                • DeleteDC.GDI32(00000000), ref: 00FB299A
                                                                • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00FB29C6
                                                                • SendMessageW.USER32(00000030,00000000,00000001), ref: 00FB29DD
                                                                • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00FB2A1D
                                                                • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00FB2A31
                                                                • SendMessageW.USER32(00000404,00000001,00000000), ref: 00FB2A42
                                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00FB2A77
                                                                • GetStockObject.GDI32(00000011), ref: 00FB2A82
                                                                • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00FB2A8D
                                                                • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00FB2A97
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                                • API String ID: 2910397461-517079104
                                                                • Opcode ID: a19e29bf816f70cb41ff88a3ea916a11489904107cca888bc437343128d78804
                                                                • Instruction ID: e1c11f037eb9c8d5df01b31244f52ecb49b458781bd7aaed6b9c39d3f5754524
                                                                • Opcode Fuzzy Hash: a19e29bf816f70cb41ff88a3ea916a11489904107cca888bc437343128d78804
                                                                • Instruction Fuzzy Hash: 21B16FB1A00209AFEB24DF69CD4AFAE7BA9EB48710F148115F914E72D0DB74ED40DB94
                                                                Function 00FA4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetErrorMode.KERNEL32(00000001), ref: 00FA4AED
                                                                • GetDriveTypeW.KERNEL32(?,00FCCB68,?,\\.\,00FCCC08), ref: 00FA4BCA
                                                                • SetErrorMode.KERNEL32(00000000,00FCCB68,?,\\.\,00FCCC08), ref: 00FA4D36
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$DriveType
                                                                • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                • API String ID: 2907320926-4222207086
                                                                • Opcode ID: ec71fc57c768452d7dbef71e11587e7680cdf96e33d4e9b3882fed144ccbd1c0
                                                                • Instruction ID: cb75527d09e51b625944fd92ccccae06e69da24c196a3c73379e7f64bd76f09f
                                                                • Opcode Fuzzy Hash: ec71fc57c768452d7dbef71e11587e7680cdf96e33d4e9b3882fed144ccbd1c0
                                                                • Instruction Fuzzy Hash: 8B61A7B160520A9BCB04DF14CA81A7C77B0AF86760B244415F90AEB6A1DFF5FD41FB52
                                                                Function 00FC73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetSysColor.USER32(00000012), ref: 00FC7421
                                                                • SetTextColor.GDI32(?,?), ref: 00FC7425
                                                                • GetSysColorBrush.USER32(0000000F), ref: 00FC743B
                                                                • GetSysColor.USER32(0000000F), ref: 00FC7446
                                                                • CreateSolidBrush.GDI32(?), ref: 00FC744B
                                                                • GetSysColor.USER32(00000011), ref: 00FC7463
                                                                • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FC7471
                                                                • SelectObject.GDI32(?,00000000), ref: 00FC7482
                                                                • SetBkColor.GDI32(?,00000000), ref: 00FC748B
                                                                • SelectObject.GDI32(?,?), ref: 00FC7498
                                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00FC74B7
                                                                • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FC74CE
                                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00FC74DB
                                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FC752A
                                                                • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00FC7554
                                                                • InflateRect.USER32(?,000000FD,000000FD), ref: 00FC7572
                                                                • DrawFocusRect.USER32(?,?), ref: 00FC757D
                                                                • GetSysColor.USER32(00000011), ref: 00FC758E
                                                                • SetTextColor.GDI32(?,00000000), ref: 00FC7596
                                                                • DrawTextW.USER32(?,00FC70F5,000000FF,?,00000000), ref: 00FC75A8
                                                                • SelectObject.GDI32(?,?), ref: 00FC75BF
                                                                • DeleteObject.GDI32(?), ref: 00FC75CA
                                                                • SelectObject.GDI32(?,?), ref: 00FC75D0
                                                                • DeleteObject.GDI32(?), ref: 00FC75D5
                                                                • SetTextColor.GDI32(?,?), ref: 00FC75DB
                                                                • SetBkColor.GDI32(?,?), ref: 00FC75E5
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                • String ID:
                                                                • API String ID: 1996641542-0
                                                                • Opcode ID: 932cd6b77026b315c68e1d7a664bfed89f7ddf9d6c60809801254fb9c50f57c5
                                                                • Instruction ID: e908876455d3fc1e72ba01ed9b9b6e6050f07d05821e18987fedec8a2a1730a6
                                                                • Opcode Fuzzy Hash: 932cd6b77026b315c68e1d7a664bfed89f7ddf9d6c60809801254fb9c50f57c5
                                                                • Instruction Fuzzy Hash: AC617D72D00219AFDF009FA4DD4AEEEBFB9EB08320F144515F919AB2A1D7719940EF90
                                                                Function 00FC0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCursorPos.USER32(?), ref: 00FC1128
                                                                • GetDesktopWindow.USER32 ref: 00FC113D
                                                                • GetWindowRect.USER32(00000000), ref: 00FC1144
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC1199
                                                                • DestroyWindow.USER32(?), ref: 00FC11B9
                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00FC11ED
                                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FC120B
                                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FC121D
                                                                • SendMessageW.USER32(00000000,00000421,?,?), ref: 00FC1232
                                                                • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00FC1245
                                                                • IsWindowVisible.USER32(00000000), ref: 00FC12A1
                                                                • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00FC12BC
                                                                • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00FC12D0
                                                                • GetWindowRect.USER32(00000000,?), ref: 00FC12E8
                                                                • MonitorFromPoint.USER32(?,?,00000002), ref: 00FC130E
                                                                • GetMonitorInfoW.USER32(00000000,?), ref: 00FC1328
                                                                • CopyRect.USER32(?,?), ref: 00FC133F
                                                                • SendMessageW.USER32(00000000,00000412,00000000), ref: 00FC13AA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                • String ID: ($0$tooltips_class32
                                                                • API String ID: 698492251-4156429822
                                                                • Opcode ID: a4f9cdc81bda229b62aa4df36acd3fa0a26d646c16bde4ecd2eba6672ba65050
                                                                • Instruction ID: 8d3d0e814b6086cbe759c3f6f430da6540a252a9311d5c9846af09a7c2a4031d
                                                                • Opcode Fuzzy Hash: a4f9cdc81bda229b62aa4df36acd3fa0a26d646c16bde4ecd2eba6672ba65050
                                                                • Instruction Fuzzy Hash: C6B1AE71A08341AFD700DF64CA86F6ABBE4FF85314F00891CF9999B262C771E854EB91
                                                                Function 00F90D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F910F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F91114
                                                                  • Part of subcall function 00F910F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91120
                                                                  • Part of subcall function 00F910F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F9112F
                                                                  • Part of subcall function 00F910F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91136
                                                                  • Part of subcall function 00F910F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F9114D
                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F90DF5
                                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F90E29
                                                                • GetLengthSid.ADVAPI32(?), ref: 00F90E40
                                                                • GetAce.ADVAPI32(?,00000000,?), ref: 00F90E7A
                                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F90E96
                                                                • GetLengthSid.ADVAPI32(?), ref: 00F90EAD
                                                                • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00F90EB5
                                                                • HeapAlloc.KERNEL32(00000000), ref: 00F90EBC
                                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F90EDD
                                                                • CopySid.ADVAPI32(00000000), ref: 00F90EE4
                                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F90F13
                                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F90F35
                                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F90F47
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90F6E
                                                                • HeapFree.KERNEL32(00000000), ref: 00F90F75
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90F7E
                                                                • HeapFree.KERNEL32(00000000), ref: 00F90F85
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90F8E
                                                                • HeapFree.KERNEL32(00000000), ref: 00F90F95
                                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 00F90FA1
                                                                • HeapFree.KERNEL32(00000000), ref: 00F90FA8
                                                                  • Part of subcall function 00F91193: GetProcessHeap.KERNEL32(00000008,00F90BB1,?,00000000,?,00F90BB1,?), ref: 00F911A1
                                                                  • Part of subcall function 00F91193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00F90BB1,?), ref: 00F911A8
                                                                  • Part of subcall function 00F91193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00F90BB1,?), ref: 00F911B7
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                                • String ID:
                                                                • API String ID: 4175595110-0
                                                                • Opcode ID: 9eb9af8f8a8ade3411cb128ef6c4ce60af3fd81f638c43bb7b7f3c399ce58ce7
                                                                • Instruction ID: a3fc36f41eb12a3c7a06c85312fe3eab98b7e6b9081018f0dc024f2268bb5177
                                                                • Opcode Fuzzy Hash: 9eb9af8f8a8ade3411cb128ef6c4ce60af3fd81f638c43bb7b7f3c399ce58ce7
                                                                • Instruction Fuzzy Hash: 6D714B7290020AAFEF209FA5DD45FAEBBB8FF04314F044125F919E7191DB319A05EBA0
                                                                Function 00FBC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBC4BD
                                                                • RegCreateKeyExW.ADVAPI32(?,?,00000000,00FCCC08,00000000,?,00000000,?,?), ref: 00FBC544
                                                                • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00FBC5A4
                                                                • _wcslen.LIBCMT ref: 00FBC5F4
                                                                • _wcslen.LIBCMT ref: 00FBC66F
                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00FBC6B2
                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00FBC7C1
                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00FBC84D
                                                                • RegCloseKey.ADVAPI32(?), ref: 00FBC881
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00FBC88E
                                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00FBC960
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                                • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                • API String ID: 9721498-966354055
                                                                • Opcode ID: 6f071788d331d08b5ff3e46bb184386d0a3b7ba11cf3d4d7d94ab01bcc476485
                                                                • Instruction ID: cbaabcb3d7b0f250eef16801d0df621c554b431f794cc139e4fc665506da5669
                                                                • Opcode Fuzzy Hash: 6f071788d331d08b5ff3e46bb184386d0a3b7ba11cf3d4d7d94ab01bcc476485
                                                                • Instruction Fuzzy Hash: FD126B756042019FDB14DF15C881A6AB7E5EF88724F18885CF88A9B3A2DB35FD41EF81
                                                                Function 00FC091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CharUpperBuffW.USER32(?,?), ref: 00FC09C6
                                                                • _wcslen.LIBCMT ref: 00FC0A01
                                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FC0A54
                                                                • _wcslen.LIBCMT ref: 00FC0A8A
                                                                • _wcslen.LIBCMT ref: 00FC0B06
                                                                • _wcslen.LIBCMT ref: 00FC0B81
                                                                  • Part of subcall function 00F4F9F2: _wcslen.LIBCMT ref: 00F4F9FD
                                                                  • Part of subcall function 00F92BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F92BFA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$MessageSend$BuffCharUpper
                                                                • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                • API String ID: 1103490817-4258414348
                                                                • Opcode ID: b507728c92a0df4dec8a9752b92f6054985f83a105e5eb2f11d4e3963b9509a6
                                                                • Instruction ID: d6c15008b1e6e7a526085bd417a93c92bfcce61d72bb9921094873e5e486ca1a
                                                                • Opcode Fuzzy Hash: b507728c92a0df4dec8a9752b92f6054985f83a105e5eb2f11d4e3963b9509a6
                                                                • Instruction Fuzzy Hash: 2FE18E36608302DFCB14EF24C951A2AB7E1BF94324F14495CF89697362DB35ED46EB81
                                                                Function 00FBC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharUpper
                                                                • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                • API String ID: 1256254125-909552448
                                                                • Opcode ID: 3e560894d8cf7475ee522e759cb1c04aceef3457eace07187ae319e30fe60b87
                                                                • Instruction ID: 9cb8c3907a784f9755f8d602f05838abea83baee2ba9340d4f213dfc1b599ed6
                                                                • Opcode Fuzzy Hash: 3e560894d8cf7475ee522e759cb1c04aceef3457eace07187ae319e30fe60b87
                                                                • Instruction Fuzzy Hash: 85710533A0016A8BCB20EE2ACC516FF37959FA0774B214128FC559B295E638CD44BBE0
                                                                Function 00FC833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _wcslen.LIBCMT ref: 00FC835A
                                                                • _wcslen.LIBCMT ref: 00FC836E
                                                                • _wcslen.LIBCMT ref: 00FC8391
                                                                • _wcslen.LIBCMT ref: 00FC83B4
                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00FC83F2
                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000032), ref: 00FC844E
                                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FC8487
                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00FC84CA
                                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FC8501
                                                                • FreeLibrary.KERNEL32(?), ref: 00FC850D
                                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FC851D
                                                                • DestroyIcon.USER32(?), ref: 00FC852C
                                                                • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00FC8549
                                                                • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00FC8555
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                                • String ID: .dll$.exe$.icl
                                                                • API String ID: 799131459-1154884017
                                                                • Opcode ID: dc9cdc1252d02316bd7191c25e36761a1ebc75c1c6325182a25932f5d8d9a501
                                                                • Instruction ID: 380161ba1c99d7085f43142495bf64f78b0e59c7a85f9f97196aeb4be1537fe6
                                                                • Opcode Fuzzy Hash: dc9cdc1252d02316bd7191c25e36761a1ebc75c1c6325182a25932f5d8d9a501
                                                                • Instruction Fuzzy Hash: 6A61D17194021ABAEB18DF64CD42FFE77A8BF04761F10450AF915D70D1DBB4A981EBA0
                                                                Function 00F37778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                • API String ID: 0-1645009161
                                                                • Opcode ID: 07544cfd68641fd6d5d38e525923591bef869ab314bb9274e3d23ae4023fc80a
                                                                • Instruction ID: a84ec6fc7c7f0fe7d6a197115242a1aa9e2640a9afead965ab15f28e706ab996
                                                                • Opcode Fuzzy Hash: 07544cfd68641fd6d5d38e525923591bef869ab314bb9274e3d23ae4023fc80a
                                                                • Instruction Fuzzy Hash: E481F8B1A04305BBDB20BF60CC43FAE7BA4AF14760F044025FD09AA192EBB4D915F792
                                                                Function 00FA3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CharLowerBuffW.USER32(?,?), ref: 00FA3EF8
                                                                • _wcslen.LIBCMT ref: 00FA3F03
                                                                • _wcslen.LIBCMT ref: 00FA3F5A
                                                                • _wcslen.LIBCMT ref: 00FA3F98
                                                                • GetDriveTypeW.KERNEL32(?), ref: 00FA3FD6
                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FA401E
                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FA4059
                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FA4087
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                                • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                • API String ID: 1839972693-4113822522
                                                                • Opcode ID: 6defe51fbd53e519bb3fdb4e5f63c059c12814f394984a62d3d35c73ed84c1e8
                                                                • Instruction ID: c1e972f4b3355ca5a41505009d972899e98cad9da24b62c9972ac018f5b6740f
                                                                • Opcode Fuzzy Hash: 6defe51fbd53e519bb3fdb4e5f63c059c12814f394984a62d3d35c73ed84c1e8
                                                                • Instruction Fuzzy Hash: 2771F1B2A042059FC310EF34C88186AB7F4EF95768F10892DF996D7261EB34ED45EB91
                                                                Function 00F95A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadIconW.USER32(00000063), ref: 00F95A2E
                                                                • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00F95A40
                                                                • SetWindowTextW.USER32(?,?), ref: 00F95A57
                                                                • GetDlgItem.USER32(?,000003EA), ref: 00F95A6C
                                                                • SetWindowTextW.USER32(00000000,?), ref: 00F95A72
                                                                • GetDlgItem.USER32(?,000003E9), ref: 00F95A82
                                                                • SetWindowTextW.USER32(00000000,?), ref: 00F95A88
                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00F95AA9
                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00F95AC3
                                                                • GetWindowRect.USER32(?,?), ref: 00F95ACC
                                                                • _wcslen.LIBCMT ref: 00F95B33
                                                                • SetWindowTextW.USER32(?,?), ref: 00F95B6F
                                                                • GetDesktopWindow.USER32 ref: 00F95B75
                                                                • GetWindowRect.USER32(00000000), ref: 00F95B7C
                                                                • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00F95BD3
                                                                • GetClientRect.USER32(?,?), ref: 00F95BE0
                                                                • PostMessageW.USER32(?,00000005,00000000,?), ref: 00F95C05
                                                                • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00F95C2F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                                • String ID:
                                                                • API String ID: 895679908-0
                                                                • Opcode ID: bd7d5e7c448d1f2d2df73926b493b9dafa9c9a56abdd9347780085d896dad067
                                                                • Instruction ID: be1150821d3602bda9881e389f3f206f8de8891c4aad724cbc3feafdc4c5ba96
                                                                • Opcode Fuzzy Hash: bd7d5e7c448d1f2d2df73926b493b9dafa9c9a56abdd9347780085d896dad067
                                                                • Instruction Fuzzy Hash: AB717D31900A099FEB21DFA8CE86E6EBBF5FF48B14F104518E586A35A0D775E940EB50
                                                                Function 00FAFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadCursorW.USER32(00000000,00007F89), ref: 00FAFE27
                                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 00FAFE32
                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00FAFE3D
                                                                • LoadCursorW.USER32(00000000,00007F03), ref: 00FAFE48
                                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 00FAFE53
                                                                • LoadCursorW.USER32(00000000,00007F01), ref: 00FAFE5E
                                                                • LoadCursorW.USER32(00000000,00007F81), ref: 00FAFE69
                                                                • LoadCursorW.USER32(00000000,00007F88), ref: 00FAFE74
                                                                • LoadCursorW.USER32(00000000,00007F80), ref: 00FAFE7F
                                                                • LoadCursorW.USER32(00000000,00007F86), ref: 00FAFE8A
                                                                • LoadCursorW.USER32(00000000,00007F83), ref: 00FAFE95
                                                                • LoadCursorW.USER32(00000000,00007F85), ref: 00FAFEA0
                                                                • LoadCursorW.USER32(00000000,00007F82), ref: 00FAFEAB
                                                                • LoadCursorW.USER32(00000000,00007F84), ref: 00FAFEB6
                                                                • LoadCursorW.USER32(00000000,00007F04), ref: 00FAFEC1
                                                                • LoadCursorW.USER32(00000000,00007F02), ref: 00FAFECC
                                                                • GetCursorInfo.USER32(?), ref: 00FAFEDC
                                                                • GetLastError.KERNEL32 ref: 00FAFF1E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Cursor$Load$ErrorInfoLast
                                                                • String ID:
                                                                • API String ID: 3215588206-0
                                                                • Opcode ID: 505ed4a2adf25ca910e8f29a05ddae1dac348ad8dac4d39909af35960b9684eb
                                                                • Instruction ID: e8e5c6ac02071980a931e482eeb162708c007547ec666296f0dfbfd7e29a6485
                                                                • Opcode Fuzzy Hash: 505ed4a2adf25ca910e8f29a05ddae1dac348ad8dac4d39909af35960b9684eb
                                                                • Instruction Fuzzy Hash: 0A4153B0D043196FDB109FBA8C85C5EBFE8FF05364B50462AE11DEB281DB7899019F91
                                                                Function 00F500C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00F500C6
                                                                  • Part of subcall function 00F500ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0100070C,00000FA0,E0750CBA,?,?,?,?,00F723B3,000000FF), ref: 00F5011C
                                                                  • Part of subcall function 00F500ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00F723B3,000000FF), ref: 00F50127
                                                                  • Part of subcall function 00F500ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00F723B3,000000FF), ref: 00F50138
                                                                  • Part of subcall function 00F500ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00F5014E
                                                                  • Part of subcall function 00F500ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00F5015C
                                                                  • Part of subcall function 00F500ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00F5016A
                                                                  • Part of subcall function 00F500ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F50195
                                                                  • Part of subcall function 00F500ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F501A0
                                                                • ___scrt_fastfail.LIBCMT ref: 00F500E7
                                                                  • Part of subcall function 00F500A3: __onexit.LIBCMT ref: 00F500A9
                                                                Strings
                                                                • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00F50122
                                                                • SleepConditionVariableCS, xrefs: 00F50154
                                                                • InitializeConditionVariable, xrefs: 00F50148
                                                                • kernel32.dll, xrefs: 00F50133
                                                                • WakeAllConditionVariable, xrefs: 00F50162
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                                • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                • API String ID: 66158676-1714406822
                                                                • Opcode ID: 4acd2b02cc7a8bb834b82a4c6a113fc258165372590a0722b089bb0c404f1184
                                                                • Instruction ID: d0c265db2c2697ad45573fbd77fc5cff02eba1a9d7faa3c91d59fd085d86330f
                                                                • Opcode Fuzzy Hash: 4acd2b02cc7a8bb834b82a4c6a113fc258165372590a0722b089bb0c404f1184
                                                                • Instruction Fuzzy Hash: 54212932E40B156BE7215B64AD07F6A7794EB04B62F04013AFD0A972C1DF788808BAD2
                                                                Function 00F930F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen
                                                                • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                • API String ID: 176396367-1603158881
                                                                • Opcode ID: 213b8210681e746af9b23e2ccd1a06c955995ec56b88f0f262deb1af20cf1307
                                                                • Instruction ID: 2fde87fc10329123395a966cb27b32b83a89e27edbe8fc7a558f10eb5729715f
                                                                • Opcode Fuzzy Hash: 213b8210681e746af9b23e2ccd1a06c955995ec56b88f0f262deb1af20cf1307
                                                                • Instruction Fuzzy Hash: F1E1E532E00516ABDF18DFA8C841BFDBBB0BF44720F558119E956E7250DB30AE89B790
                                                                Function 00FA44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CharLowerBuffW.USER32(00000000,00000000,00FCCC08), ref: 00FA4527
                                                                • _wcslen.LIBCMT ref: 00FA453B
                                                                • _wcslen.LIBCMT ref: 00FA4599
                                                                • _wcslen.LIBCMT ref: 00FA45F4
                                                                • _wcslen.LIBCMT ref: 00FA463F
                                                                • _wcslen.LIBCMT ref: 00FA46A7
                                                                  • Part of subcall function 00F4F9F2: _wcslen.LIBCMT ref: 00F4F9FD
                                                                • GetDriveTypeW.KERNEL32(?,00FF6BF0,00000061), ref: 00FA4743
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharDriveLowerType
                                                                • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                • API String ID: 2055661098-1000479233
                                                                • Opcode ID: 1e8c691230f5e28235f2dbe1093497a327eac7fd65c8cb68caf52e857a148589
                                                                • Instruction ID: 8debabd50ec9d430ac24d090e94d07a30bd45bf3e8f557fd2b3600ef20f4a8a9
                                                                • Opcode Fuzzy Hash: 1e8c691230f5e28235f2dbe1093497a327eac7fd65c8cb68caf52e857a148589
                                                                • Instruction Fuzzy Hash: DEB1F3B1A083029FC710DF28C891A6AB7E5AFD6720F50491DF596C7291D7B4E844EB52
                                                                Function 00FBAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _wcslen.LIBCMT ref: 00FBB198
                                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FBB1B0
                                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FBB1D4
                                                                • _wcslen.LIBCMT ref: 00FBB200
                                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FBB214
                                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FBB236
                                                                • _wcslen.LIBCMT ref: 00FBB332
                                                                  • Part of subcall function 00FA05A7: GetStdHandle.KERNEL32(000000F6), ref: 00FA05C6
                                                                • _wcslen.LIBCMT ref: 00FBB34B
                                                                • _wcslen.LIBCMT ref: 00FBB366
                                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FBB3B6
                                                                • GetLastError.KERNEL32(00000000), ref: 00FBB407
                                                                • CloseHandle.KERNEL32(?), ref: 00FBB439
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FBB44A
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FBB45C
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FBB46E
                                                                • CloseHandle.KERNEL32(?), ref: 00FBB4E3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                                • String ID:
                                                                • API String ID: 2178637699-0
                                                                • Opcode ID: 1dd2417d2ea9de6b56db0d7d48280f087c25b0ba98c8189cf6ce00eb4a916bf3
                                                                • Instruction ID: 6ab12c387c357484ad5410bcbe329366d93a58aa8c4e0962813b340e5e65857e
                                                                • Opcode Fuzzy Hash: 1dd2417d2ea9de6b56db0d7d48280f087c25b0ba98c8189cf6ce00eb4a916bf3
                                                                • Instruction Fuzzy Hash: 10F19F719083409FC714EF25C891B6EBBE1AF85324F18855DF8998B2A2CB75EC44EF52
                                                                Function 00FB3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00FCCC08), ref: 00FB40BB
                                                                • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00FB40CD
                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00FCCC08), ref: 00FB40F2
                                                                • FreeLibrary.KERNEL32(00000000,?,00FCCC08), ref: 00FB413E
                                                                • StringFromGUID2.OLE32(?,?,00000028,?,00FCCC08), ref: 00FB41A8
                                                                • SysFreeString.OLEAUT32(00000009), ref: 00FB4262
                                                                • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00FB42C8
                                                                • SysFreeString.OLEAUT32(?), ref: 00FB42F2
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                                • String ID: GetModuleHandleExW$kernel32.dll
                                                                • API String ID: 354098117-199464113
                                                                • Opcode ID: 497ef0101a77e3297b6811868fce23313b6cc535d0c727b527dad5ec2af79d09
                                                                • Instruction ID: 59587c4ee8c120b881d554fde51683c10f44e456e8ae9788f19254292173befd
                                                                • Opcode Fuzzy Hash: 497ef0101a77e3297b6811868fce23313b6cc535d0c727b527dad5ec2af79d09
                                                                • Instruction Fuzzy Hash: F7125A75A00109EFDB14DF95C984EAEBBB5FF45314F288098E9099B252C731ED42EFA0
                                                                Function 00F3326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemCount.USER32(01001990), ref: 00F72F8D
                                                                • GetMenuItemCount.USER32(01001990), ref: 00F7303D
                                                                • GetCursorPos.USER32(?), ref: 00F73081
                                                                • SetForegroundWindow.USER32(00000000), ref: 00F7308A
                                                                • TrackPopupMenuEx.USER32(01001990,00000000,?,00000000,00000000,00000000), ref: 00F7309D
                                                                • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F730A9
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                                                • String ID: 0
                                                                • API String ID: 36266755-4108050209
                                                                • Opcode ID: 77acea96d7fef41114f157a8e47bbc307b7866c8bab19cd60e13c3d89f0d29ca
                                                                • Instruction ID: 75e578a325d3afbe5ae1d335def2b58f5f5d15f71d4a771b4a82e8a5a66d1752
                                                                • Opcode Fuzzy Hash: 77acea96d7fef41114f157a8e47bbc307b7866c8bab19cd60e13c3d89f0d29ca
                                                                • Instruction Fuzzy Hash: 9A71F831A44205BEFB218F24DD49F9ABF64FF05374F248216F5186A1D0C7B1A910FB92
                                                                Function 00FC6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DestroyWindow.USER32(00000000,?), ref: 00FC6DEB
                                                                  • Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A
                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00FC6E5F
                                                                • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00FC6E81
                                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FC6E94
                                                                • DestroyWindow.USER32(?), ref: 00FC6EB5
                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00F30000,00000000), ref: 00FC6EE4
                                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FC6EFD
                                                                • GetDesktopWindow.USER32 ref: 00FC6F16
                                                                • GetWindowRect.USER32(00000000), ref: 00FC6F1D
                                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FC6F35
                                                                • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00FC6F4D
                                                                  • Part of subcall function 00F49944: GetWindowLongW.USER32(?,000000EB), ref: 00F49952
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                                • String ID: 0$tooltips_class32
                                                                • API String ID: 2429346358-3619404913
                                                                • Opcode ID: 801f489f7bb0161b933c6e35af0360377dc7ffe417e39a74dcba22fc91282842
                                                                • Instruction ID: 1ac532e1532bc993db52865d9d0ed51d7e739ddfafeaaee443c12884164b1ae3
                                                                • Opcode Fuzzy Hash: 801f489f7bb0161b933c6e35af0360377dc7ffe417e39a74dcba22fc91282842
                                                                • Instruction Fuzzy Hash: C5718870908245AFDB21CF18DA49FAABBE9FF88314F04041EF989C7261D775E906EB15
                                                                Function 00FC911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2
                                                                • DragQueryPoint.SHELL32(?,?), ref: 00FC9147
                                                                  • Part of subcall function 00FC7674: ClientToScreen.USER32(?,?), ref: 00FC769A
                                                                  • Part of subcall function 00FC7674: GetWindowRect.USER32(?,?), ref: 00FC7710
                                                                  • Part of subcall function 00FC7674: PtInRect.USER32(?,?,00FC8B89), ref: 00FC7720
                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00FC91B0
                                                                • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00FC91BB
                                                                • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00FC91DE
                                                                • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00FC9225
                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00FC923E
                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00FC9255
                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00FC9277
                                                                • DragFinish.SHELL32(?), ref: 00FC927E
                                                                • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00FC9371
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                                • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                • API String ID: 221274066-3440237614
                                                                • Opcode ID: 8fbd0b3f14f5deb6153dc172c0242e2202049d0c90da3aedc42f3116ca0b279b
                                                                • Instruction ID: 254f8717566e425b96ba3570ad7bf024f611cacf55ecc7d044f58885e51eeb45
                                                                • Opcode Fuzzy Hash: 8fbd0b3f14f5deb6153dc172c0242e2202049d0c90da3aedc42f3116ca0b279b
                                                                • Instruction Fuzzy Hash: 4B616D71108305AFD701DF64DD86EAFBBE8EF88760F00091DF595931A0DBB49A49EB92
                                                                Function 00FAC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FAC4B0
                                                                • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00FAC4C3
                                                                • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00FAC4D7
                                                                • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00FAC4F0
                                                                • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00FAC533
                                                                • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00FAC549
                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FAC554
                                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FAC584
                                                                • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00FAC5DC
                                                                • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00FAC5F0
                                                                • InternetCloseHandle.WININET(00000000), ref: 00FAC5FB
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                                • String ID:
                                                                • API String ID: 3800310941-3916222277
                                                                • Opcode ID: 4f389247796b208d338d8cb5a91ce61f60fb8aab64bfa0c6a07ec65cf1b21406
                                                                • Instruction ID: f917366a960b87665276e6bcbc479fd0cdd8e82de3894f9f853ddb018840593b
                                                                • Opcode Fuzzy Hash: 4f389247796b208d338d8cb5a91ce61f60fb8aab64bfa0c6a07ec65cf1b21406
                                                                • Instruction Fuzzy Hash: 45513AB1900609BFDB219F64C989AAA7BFCEF09754F044419F94A97610DB34E944ABE0
                                                                Function 00FC856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00FC8592
                                                                • GetFileSize.KERNEL32(00000000,00000000), ref: 00FC85A2
                                                                • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00FC85AD
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FC85BA
                                                                • GlobalLock.KERNEL32(00000000), ref: 00FC85C8
                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00FC85D7
                                                                • GlobalUnlock.KERNEL32(00000000), ref: 00FC85E0
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FC85E7
                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00FC85F8
                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00FCFC38,?), ref: 00FC8611
                                                                • GlobalFree.KERNEL32(00000000), ref: 00FC8621
                                                                • GetObjectW.GDI32(?,00000018,000000FF), ref: 00FC8641
                                                                • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00FC8671
                                                                • DeleteObject.GDI32(00000000), ref: 00FC8699
                                                                • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00FC86AF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                • String ID:
                                                                • API String ID: 3840717409-0
                                                                • Opcode ID: 3e87838f3414c94749df61304f5d79f6060fe3c669c4ea693d5b6d5ae0f2d35c
                                                                • Instruction ID: bbf36b35a1350d7c7cb4fc6188b693d26294457e46557b364a2204e984bc4f06
                                                                • Opcode Fuzzy Hash: 3e87838f3414c94749df61304f5d79f6060fe3c669c4ea693d5b6d5ae0f2d35c
                                                                • Instruction Fuzzy Hash: 5A414C71600209AFDB11CFA5CE4AEAA7BB8FF89761F14405CF909E7260DB709D01EB60
                                                                Function 00FA14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(00000000), ref: 00FA1502
                                                                • VariantCopy.OLEAUT32(?,?), ref: 00FA150B
                                                                • VariantClear.OLEAUT32(?), ref: 00FA1517
                                                                • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00FA15FB
                                                                • VarR8FromDec.OLEAUT32(?,?), ref: 00FA1657
                                                                • VariantInit.OLEAUT32(?), ref: 00FA1708
                                                                • SysFreeString.OLEAUT32(?), ref: 00FA178C
                                                                • VariantClear.OLEAUT32(?), ref: 00FA17D8
                                                                • VariantClear.OLEAUT32(?), ref: 00FA17E7
                                                                • VariantInit.OLEAUT32(00000000), ref: 00FA1823
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                                                                • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                • API String ID: 1234038744-3931177956
                                                                • Opcode ID: 08175971e3eddb8c40077de06d83599298f636467c970381c103aef223e1d47d
                                                                • Instruction ID: 6acd70143e4e90f734995a71b2826e453f5a1f2977e7f9b6ca71089110e48e83
                                                                • Opcode Fuzzy Hash: 08175971e3eddb8c40077de06d83599298f636467c970381c103aef223e1d47d
                                                                • Instruction Fuzzy Hash: 70D121B2E00505DFDB00DFA5D895B79B7B0BF46710F1A805AE84AAB180DB34DC04FBA1
                                                                Function 00FBB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00FBC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FBB6AE,?,?), ref: 00FBC9B5
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBC9F1
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA68
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA9E
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBB6F4
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FBB772
                                                                • RegDeleteValueW.ADVAPI32(?,?), ref: 00FBB80A
                                                                • RegCloseKey.ADVAPI32(?), ref: 00FBB87E
                                                                • RegCloseKey.ADVAPI32(?), ref: 00FBB89C
                                                                • LoadLibraryA.KERNEL32(advapi32.dll), ref: 00FBB8F2
                                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FBB904
                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00FBB922
                                                                • FreeLibrary.KERNEL32(00000000), ref: 00FBB983
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00FBB994
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                                • API String ID: 146587525-4033151799
                                                                • Opcode ID: 5c5784204634ac1aade661c74f33eff46d759cb9faf3be0c6ec681ae171ed315
                                                                • Instruction ID: af39a60c11e986a985d3903d6effe1b6a1b964355b1b74d5088338a1c740f40c
                                                                • Opcode Fuzzy Hash: 5c5784204634ac1aade661c74f33eff46d759cb9faf3be0c6ec681ae171ed315
                                                                • Instruction Fuzzy Hash: 6EC19E35608201AFD710DF15C895F6ABBE1FF84328F14845CE49A8B2A2CBB5EC45EF91
                                                                Function 00FB255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDC.USER32(00000000), ref: 00FB25D8
                                                                • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00FB25E8
                                                                • CreateCompatibleDC.GDI32(?), ref: 00FB25F4
                                                                • SelectObject.GDI32(00000000,?), ref: 00FB2601
                                                                • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00FB266D
                                                                • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00FB26AC
                                                                • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00FB26D0
                                                                • SelectObject.GDI32(?,?), ref: 00FB26D8
                                                                • DeleteObject.GDI32(?), ref: 00FB26E1
                                                                • DeleteDC.GDI32(?), ref: 00FB26E8
                                                                • ReleaseDC.USER32(00000000,?), ref: 00FB26F3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                • String ID: (
                                                                • API String ID: 2598888154-3887548279
                                                                • Opcode ID: 9b1197c55663269a47f7be80f8a6cec26b9d10553d09f75a69f3c342f242b9d8
                                                                • Instruction ID: eb68bea57e184fe44dd51f09d2220d1630d1022774bc6c07dec81793a3c52cc9
                                                                • Opcode Fuzzy Hash: 9b1197c55663269a47f7be80f8a6cec26b9d10553d09f75a69f3c342f242b9d8
                                                                • Instruction Fuzzy Hash: 696101B5D00219EFCF04CFA9C985EAEBBB6FF48310F248529E959A7250D734A941DF90
                                                                Function 00F6DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • ___free_lconv_mon.LIBCMT ref: 00F6DAA1
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D659
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D66B
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D67D
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D68F
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6A1
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6B3
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6C5
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6D7
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6E9
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6FB
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D70D
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D71F
                                                                  • Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D731
                                                                • _free.LIBCMT ref: 00F6DA96
                                                                  • Part of subcall function 00F629C8: HeapFree.KERNEL32(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
                                                                  • Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0
                                                                • _free.LIBCMT ref: 00F6DAB8
                                                                • _free.LIBCMT ref: 00F6DACD
                                                                • _free.LIBCMT ref: 00F6DAD8
                                                                • _free.LIBCMT ref: 00F6DAFA
                                                                • _free.LIBCMT ref: 00F6DB0D
                                                                • _free.LIBCMT ref: 00F6DB1B
                                                                • _free.LIBCMT ref: 00F6DB26
                                                                • _free.LIBCMT ref: 00F6DB5E
                                                                • _free.LIBCMT ref: 00F6DB65
                                                                • _free.LIBCMT ref: 00F6DB82
                                                                • _free.LIBCMT ref: 00F6DB9A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                • String ID:
                                                                • API String ID: 161543041-0
                                                                • Opcode ID: 78c0c0fe0a2a59f2e4f4b39e4dd74ce4d560f06dc434dfc6e657a4835ae38283
                                                                • Instruction ID: 149657d1e4e543c7087c729544c4d2274dfc451570661603e17bf4def5e265cd
                                                                • Opcode Fuzzy Hash: 78c0c0fe0a2a59f2e4f4b39e4dd74ce4d560f06dc434dfc6e657a4835ae38283
                                                                • Instruction Fuzzy Hash: F7317831F046049FEB25AA78EC41B6AB7F9FF80360F154529E048D7192DB38AC80FB20
                                                                Function 00F9365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetClassNameW.USER32(?,?,00000100), ref: 00F9369C
                                                                • _wcslen.LIBCMT ref: 00F936A7
                                                                • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00F93797
                                                                • GetClassNameW.USER32(?,?,00000400), ref: 00F9380C
                                                                • GetDlgCtrlID.USER32(?), ref: 00F9385D
                                                                • GetWindowRect.USER32(?,?), ref: 00F93882
                                                                • GetParent.USER32(?), ref: 00F938A0
                                                                • ScreenToClient.USER32(00000000), ref: 00F938A7
                                                                • GetClassNameW.USER32(?,?,00000100), ref: 00F93921
                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 00F9395D
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                                                                • String ID: %s%u
                                                                • API String ID: 4010501982-679674701
                                                                • Opcode ID: 350f32c68f281133a9fc180abf8ab1b370edeffdf0b0947acf7958bc67352964
                                                                • Instruction ID: 4eec8736a8089507d306a7dc9e624f13af24040caa394f733c4756bfdd595125
                                                                • Opcode Fuzzy Hash: 350f32c68f281133a9fc180abf8ab1b370edeffdf0b0947acf7958bc67352964
                                                                • Instruction Fuzzy Hash: 5D910671604306AFEB19DF64C885FAAF7A9FF44350F004529F999C2190DB34EA49EBD1
                                                                Function 00F94954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetClassNameW.USER32(?,?,00000400), ref: 00F94994
                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 00F949DA
                                                                • _wcslen.LIBCMT ref: 00F949EB
                                                                • CharUpperBuffW.USER32(?,00000000), ref: 00F949F7
                                                                • _wcsstr.LIBVCRUNTIME ref: 00F94A2C
                                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 00F94A64
                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 00F94A9D
                                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 00F94AE6
                                                                • GetClassNameW.USER32(?,?,00000400), ref: 00F94B20
                                                                • GetWindowRect.USER32(?,?), ref: 00F94B8B
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                                • String ID: ThumbnailClass
                                                                • API String ID: 1311036022-1241985126
                                                                • Opcode ID: a2cadb11b4b01b3b6542ec490fc612561f9a86c37a8c721be4e29aa7f47dc50f
                                                                • Instruction ID: fa9a739ea90c5a9bf6338f18c58e6ce1b5fa3ec96dba76236b3040a5e5ccdead
                                                                • Opcode Fuzzy Hash: a2cadb11b4b01b3b6542ec490fc612561f9a86c37a8c721be4e29aa7f47dc50f
                                                                • Instruction Fuzzy Hash: B491B1714082099FEF04CF14C981FAA77E8FF94324F048469FD899A196DB34ED46EBA1
                                                                Function 00F9BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemInfoW.USER32(01001990,000000FF,00000000,00000030), ref: 00F9BFAC
                                                                • SetMenuItemInfoW.USER32(01001990,00000004,00000000,00000030), ref: 00F9BFE1
                                                                • Sleep.KERNEL32(000001F4), ref: 00F9BFF3
                                                                • GetMenuItemCount.USER32(?), ref: 00F9C039
                                                                • GetMenuItemID.USER32(?,00000000), ref: 00F9C056
                                                                • GetMenuItemID.USER32(?,-00000001), ref: 00F9C082
                                                                • GetMenuItemID.USER32(?,?), ref: 00F9C0C9
                                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F9C10F
                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F9C124
                                                                • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F9C145
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                                • String ID: 0
                                                                • API String ID: 1460738036-4108050209
                                                                • Opcode ID: ae0fef001974b704517279c5f6ab7dff65051a6b5d970f2a39b5ca669ea72430
                                                                • Instruction ID: 2ade1a41726cfccdd9cdcc679a9cc390de183425fa41e97849b3a35b0e4d2318
                                                                • Opcode Fuzzy Hash: ae0fef001974b704517279c5f6ab7dff65051a6b5d970f2a39b5ca669ea72430
                                                                • Instruction Fuzzy Hash: C461B0B090024AAFEF15CF64DE88EEE7BB8EB05354F044155F945E3292C735AD45EBA0
                                                                Function 00FBCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00FBCC64
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00FBCC8D
                                                                • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00FBCD48
                                                                  • Part of subcall function 00FBCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00FBCCAA
                                                                  • Part of subcall function 00FBCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00FBCCBD
                                                                  • Part of subcall function 00FBCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FBCCCF
                                                                  • Part of subcall function 00FBCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00FBCD05
                                                                  • Part of subcall function 00FBCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00FBCD28
                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00FBCCF3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                                • API String ID: 2734957052-4033151799
                                                                • Opcode ID: 3a6be05363cd40b892ce73a6cce3aede31eeeaf6237daa19828a6d860ae7a155
                                                                • Instruction ID: c04407a8eb1e671e596d15bc7a804c4a72e70d178c1dc79ace12d29e72ec2033
                                                                • Opcode Fuzzy Hash: 3a6be05363cd40b892ce73a6cce3aede31eeeaf6237daa19828a6d860ae7a155
                                                                • Instruction Fuzzy Hash: 49318BB5D0112DBBDB208B52DC89EFFBB7CEF55750F000165E909E3200DA309A45BAE0
                                                                Function 00FA3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00FA3D40
                                                                • _wcslen.LIBCMT ref: 00FA3D6D
                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00FA3D9D
                                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00FA3DBE
                                                                • RemoveDirectoryW.KERNEL32(?), ref: 00FA3DCE
                                                                • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00FA3E55
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FA3E60
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FA3E6B
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                                • String ID: :$\$\??\%s
                                                                • API String ID: 1149970189-3457252023
                                                                • Opcode ID: 1f8cf21eb2fdd0d3c2e5b6459728ecd50cb8fc9b451cc6169a34cd7e8b28ca2a
                                                                • Instruction ID: 31576d08b160e98a608794492a132caece0a75883f14cd6dc2508215c0837392
                                                                • Opcode Fuzzy Hash: 1f8cf21eb2fdd0d3c2e5b6459728ecd50cb8fc9b451cc6169a34cd7e8b28ca2a
                                                                • Instruction Fuzzy Hash: D631B2B290020DABDB219BA0DC49FEF37BCEF89750F1041B5FA09D6060EB749744AB64
                                                                Function 00F9E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F9EA5D
                                                                • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F9EA73
                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F9EA84
                                                                • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F9EA96
                                                                • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F9EAA7
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: SendString$_wcslen
                                                                • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                • API String ID: 2420728520-1007645807
                                                                • Opcode ID: f838091cd4ca58ffd68aa3c102fc88985350e031c5218c9dccdee7b7d285a97f
                                                                • Instruction ID: 0d16d2f6821b76aa03174a0553aff53207717314eb875158d68bb9dfa45ad78c
                                                                • Opcode Fuzzy Hash: f838091cd4ca58ffd68aa3c102fc88985350e031c5218c9dccdee7b7d285a97f
                                                                • Instruction Fuzzy Hash: 3B114231A9021D79EB20E761DC4AEFB7A7CEFD1B50F4004297901E20E1DEB45905E6B1
                                                                Function 00F99F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetKeyboardState.USER32(?), ref: 00F9A012
                                                                • SetKeyboardState.USER32(?), ref: 00F9A07D
                                                                • GetAsyncKeyState.USER32(000000A0), ref: 00F9A09D
                                                                • GetKeyState.USER32(000000A0), ref: 00F9A0B4
                                                                • GetAsyncKeyState.USER32(000000A1), ref: 00F9A0E3
                                                                • GetKeyState.USER32(000000A1), ref: 00F9A0F4
                                                                • GetAsyncKeyState.USER32(00000011), ref: 00F9A120
                                                                • GetKeyState.USER32(00000011), ref: 00F9A12E
                                                                • GetAsyncKeyState.USER32(00000012), ref: 00F9A157
                                                                • GetKeyState.USER32(00000012), ref: 00F9A165
                                                                • GetAsyncKeyState.USER32(0000005B), ref: 00F9A18E
                                                                • GetKeyState.USER32(0000005B), ref: 00F9A19C
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: State$Async$Keyboard
                                                                • String ID:
                                                                • API String ID: 541375521-0
                                                                • Opcode ID: 4dd174d6e3051018583d459eae3181ac5751eb9e2d57c67e67dc794fdaed1209
                                                                • Instruction ID: 722a90fc3e3f5705a1ac8274fa2aa14fe1a7c0d73a7a4236c6eb4bd5c822751f
                                                                • Opcode Fuzzy Hash: 4dd174d6e3051018583d459eae3181ac5751eb9e2d57c67e67dc794fdaed1209
                                                                • Instruction Fuzzy Hash: D151FB30D0878829FF35DB6489117EAFFB49F11394F08459DD5C2571C2DA949A8CEBE2
                                                                Function 00F95CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDlgItem.USER32(?,00000001), ref: 00F95CE2
                                                                • GetWindowRect.USER32(00000000,?), ref: 00F95CFB
                                                                • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00F95D59
                                                                • GetDlgItem.USER32(?,00000002), ref: 00F95D69
                                                                • GetWindowRect.USER32(00000000,?), ref: 00F95D7B
                                                                • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00F95DCF
                                                                • GetDlgItem.USER32(?,000003E9), ref: 00F95DDD
                                                                • GetWindowRect.USER32(00000000,?), ref: 00F95DEF
                                                                • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00F95E31
                                                                • GetDlgItem.USER32(?,000003EA), ref: 00F95E44
                                                                • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00F95E5A
                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00F95E67
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ItemMoveRect$Invalidate
                                                                • String ID:
                                                                • API String ID: 3096461208-0
                                                                • Opcode ID: f14ac7661052388b3e2c61a4018b02128c28d633f8629c26d0d508b824478e48
                                                                • Instruction ID: 77c97003e24e40ea0a6cc76c17049d4f120765b6a5043d0db858789ce951dd90
                                                                • Opcode Fuzzy Hash: f14ac7661052388b3e2c61a4018b02128c28d633f8629c26d0d508b824478e48
                                                                • Instruction Fuzzy Hash: BC511FB1E00609AFDF18DF68CE8AEAE7BB5EB48710F108129F519E7290D7709E04DB50
                                                                Function 00F48BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F48F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F48BE8,?,00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F48FC5
                                                                • DestroyWindow.USER32(?), ref: 00F48C81
                                                                • KillTimer.USER32(00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F48D1B
                                                                • DestroyAcceleratorTable.USER32(00000000), ref: 00F86973
                                                                • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F869A1
                                                                • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F869B8
                                                                • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00F48BBA,00000000), ref: 00F869D4
                                                                • DeleteObject.GDI32(00000000), ref: 00F869E6
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                • String ID:
                                                                • API String ID: 641708696-0
                                                                • Opcode ID: d60af06578d1413c3beea4aa0c6798d023df6ea3d52a193ccb52717d3a7c6819
                                                                • Instruction ID: 8b2bec7a2a3d9ecba77412f0685ee46f6885bc830bee73bc0a97ce58cb277266
                                                                • Opcode Fuzzy Hash: d60af06578d1413c3beea4aa0c6798d023df6ea3d52a193ccb52717d3a7c6819
                                                                • Instruction Fuzzy Hash: 1061CE31902611DFDB369F14DA89B697BF1FB40362F104518E5829B5A0CB3AE982FF90
                                                                Function 00F49838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49944: GetWindowLongW.USER32(?,000000EB), ref: 00F49952
                                                                • GetSysColor.USER32(0000000F), ref: 00F49862
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ColorLongWindow
                                                                • String ID:
                                                                • API String ID: 259745315-0
                                                                • Opcode ID: 827ceba26f481ba5122201670c8a62472622292cc01698b3ff839e8707c19894
                                                                • Instruction ID: e318cc86b52e3b8e0dc3d376120a4fb58b3416926d5fc30b4b06804c795a8eb1
                                                                • Opcode Fuzzy Hash: 827ceba26f481ba5122201670c8a62472622292cc01698b3ff839e8707c19894
                                                                • Instruction Fuzzy Hash: FA4193316086449FDB209F3C9C49FBA3B65AB46330F684615FDA68B1E1D771D842FB50
                                                                Function 00F996E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00F7F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00F99717
                                                                • LoadStringW.USER32(00000000,?,00F7F7F8,00000001), ref: 00F99720
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00F7F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00F99742
                                                                • LoadStringW.USER32(00000000,?,00F7F7F8,00000001), ref: 00F99745
                                                                • MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00F99866
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: HandleLoadModuleString$Message_wcslen
                                                                • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                • API String ID: 747408836-2268648507
                                                                • Opcode ID: 5eb3bcd8a39cbaae61690e69bdcb45d6b74be6308f93bb52b243a1ba5899db33
                                                                • Instruction ID: 81b5d27c674b5df8ad07d555ca5ed1410481daf934987e2d2c4f18e9c5e4705b
                                                                • Opcode Fuzzy Hash: 5eb3bcd8a39cbaae61690e69bdcb45d6b74be6308f93bb52b243a1ba5899db33
                                                                • Instruction Fuzzy Hash: C8414172804119AADF04FBE4CE46EEE7778AF55350F504029F605B2092EFB95F48EB61
                                                                Function 00F906DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A
                                                                • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00F907A2
                                                                • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00F907BE
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00F907DA
                                                                • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00F90804
                                                                • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00F9082C
                                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F90837
                                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F9083C
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                                • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                • API String ID: 323675364-22481851
                                                                • Opcode ID: 36d52a45ca7ec39a08d1b54ceb1ef8f9a659e7d9433dda86edaca25872f79a22
                                                                • Instruction ID: e2e7311fc196e056edeac4c3c5979f9af5878f0b929ec3d9d5fd3ebb172ac72b
                                                                • Opcode Fuzzy Hash: 36d52a45ca7ec39a08d1b54ceb1ef8f9a659e7d9433dda86edaca25872f79a22
                                                                • Instruction Fuzzy Hash: 14411572C1022DAFDF25EBA4DC85CEDB778BF44760F444129E905A31A1EB749E04EBA0
                                                                Function 00FC3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00FC403B
                                                                • CreateCompatibleDC.GDI32(00000000), ref: 00FC4042
                                                                • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00FC4055
                                                                • SelectObject.GDI32(00000000,00000000), ref: 00FC405D
                                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 00FC4068
                                                                • DeleteDC.GDI32(00000000), ref: 00FC4072
                                                                • GetWindowLongW.USER32(?,000000EC), ref: 00FC407C
                                                                • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00FC4092
                                                                • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00FC409E
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                • String ID: static
                                                                • API String ID: 2559357485-2160076837
                                                                • Opcode ID: 2e197a870bf7502f297ecf4982768d2301d9d448a1f95c5de50e76138a49e232
                                                                • Instruction ID: e843e4a6ef1f803dcd292e6e2072158d18896d244257aad96374b06369c69eb9
                                                                • Opcode Fuzzy Hash: 2e197a870bf7502f297ecf4982768d2301d9d448a1f95c5de50e76138a49e232
                                                                • Instruction Fuzzy Hash: 1631603254121AAFDF219FA4CE46FDA3B68FF0D360F110215FA58E61A0C775D811EB90
                                                                Function 00FB3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(?), ref: 00FB3C5C
                                                                • CoInitialize.OLE32(00000000), ref: 00FB3C8A
                                                                • CoUninitialize.OLE32 ref: 00FB3C94
                                                                • _wcslen.LIBCMT ref: 00FB3D2D
                                                                • GetRunningObjectTable.OLE32(00000000,?), ref: 00FB3DB1
                                                                • SetErrorMode.KERNEL32(00000001,00000029), ref: 00FB3ED5
                                                                • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00FB3F0E
                                                                • CoGetObject.OLE32(?,00000000,00FCFB98,?), ref: 00FB3F2D
                                                                • SetErrorMode.KERNEL32(00000000), ref: 00FB3F40
                                                                • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00FB3FC4
                                                                • VariantClear.OLEAUT32(?), ref: 00FB3FD8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                                • String ID:
                                                                • API String ID: 429561992-0
                                                                • Opcode ID: a8a848bd030888a968ff1a96b289fee350a62a0f38528c94a69070af192f4e58
                                                                • Instruction ID: 6b8d1f27818f3c5a2f7047111b86d1f82f512a49871e8fc4a0e99594e8050edf
                                                                • Opcode Fuzzy Hash: a8a848bd030888a968ff1a96b289fee350a62a0f38528c94a69070af192f4e58
                                                                • Instruction Fuzzy Hash: 93C16571A083059FC700DF6AC98496BBBE9FF88754F14491DF98A9B250DB30EE05DB92
                                                                Function 00FA7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CoInitialize.OLE32(00000000), ref: 00FA7AF3
                                                                • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00FA7B8F
                                                                • SHGetDesktopFolder.SHELL32(?), ref: 00FA7BA3
                                                                • CoCreateInstance.OLE32(00FCFD08,00000000,00000001,00FF6E6C,?), ref: 00FA7BEF
                                                                • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00FA7C74
                                                                • CoTaskMemFree.OLE32(?,?), ref: 00FA7CCC
                                                                • SHBrowseForFolderW.SHELL32(?), ref: 00FA7D57
                                                                • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00FA7D7A
                                                                • CoTaskMemFree.OLE32(00000000), ref: 00FA7D81
                                                                • CoTaskMemFree.OLE32(00000000), ref: 00FA7DD6
                                                                • CoUninitialize.OLE32 ref: 00FA7DDC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                                • String ID:
                                                                • API String ID: 2762341140-0
                                                                • Opcode ID: 2cb36311257c8489b53bdf49d0bca9cd5eef7aba2ccc73dd8b698d82e7c6dfff
                                                                • Instruction ID: 45b851ece2dabaa4f9660431b8692bbfb352127f642e35c6f91edf2660dc90b5
                                                                • Opcode Fuzzy Hash: 2cb36311257c8489b53bdf49d0bca9cd5eef7aba2ccc73dd8b698d82e7c6dfff
                                                                • Instruction Fuzzy Hash: A6C12AB5A04209AFCB14DF64C884DAEBBF9FF49314F148499E81ADB261D730ED45DB90
                                                                Function 00FC541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00FC5504
                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FC5515
                                                                • CharNextW.USER32(00000158), ref: 00FC5544
                                                                • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00FC5585
                                                                • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00FC559B
                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FC55AC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$CharNext
                                                                • String ID:
                                                                • API String ID: 1350042424-0
                                                                • Opcode ID: a2211eb8d84b397c2f2fc48326b85ea64a963300dbaa9d34a2dd2c8c315a18fb
                                                                • Instruction ID: 12315f7587b12d2d6a6bdcdf005a06aa7a6685f7133302051bbdbcac9e2f6568
                                                                • Opcode Fuzzy Hash: a2211eb8d84b397c2f2fc48326b85ea64a963300dbaa9d34a2dd2c8c315a18fb
                                                                • Instruction Fuzzy Hash: E5618C3190060AABDF10DF54CE86FFE7B79AB05B24F104549F529AB290D774AA80FB60
                                                                Function 00F8FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00F8FAAF
                                                                • SafeArrayAllocData.OLEAUT32(?), ref: 00F8FB08
                                                                • VariantInit.OLEAUT32(?), ref: 00F8FB1A
                                                                • SafeArrayAccessData.OLEAUT32(?,?), ref: 00F8FB3A
                                                                • VariantCopy.OLEAUT32(?,?), ref: 00F8FB8D
                                                                • SafeArrayUnaccessData.OLEAUT32(?), ref: 00F8FBA1
                                                                • VariantClear.OLEAUT32(?), ref: 00F8FBB6
                                                                • SafeArrayDestroyData.OLEAUT32(?), ref: 00F8FBC3
                                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F8FBCC
                                                                • VariantClear.OLEAUT32(?), ref: 00F8FBDE
                                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F8FBE9
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                • String ID:
                                                                • API String ID: 2706829360-0
                                                                • Opcode ID: 778c0629e75a9e59f533a16dedd576b1dab48ab3b41209ac9ffd1d17a0837369
                                                                • Instruction ID: 49f29a5b5c426a335b05a4a283f50cb6861d5fb6bf7db8f0a9a453ec613672cb
                                                                • Opcode Fuzzy Hash: 778c0629e75a9e59f533a16dedd576b1dab48ab3b41209ac9ffd1d17a0837369
                                                                • Instruction Fuzzy Hash: D9413E35A002199FCB04EF64CC55DEEBBB9FF48354F008069E95AA7261DB34A949DFA0
                                                                Function 00F99C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetKeyboardState.USER32(?), ref: 00F99CA1
                                                                • GetAsyncKeyState.USER32(000000A0), ref: 00F99D22
                                                                • GetKeyState.USER32(000000A0), ref: 00F99D3D
                                                                • GetAsyncKeyState.USER32(000000A1), ref: 00F99D57
                                                                • GetKeyState.USER32(000000A1), ref: 00F99D6C
                                                                • GetAsyncKeyState.USER32(00000011), ref: 00F99D84
                                                                • GetKeyState.USER32(00000011), ref: 00F99D96
                                                                • GetAsyncKeyState.USER32(00000012), ref: 00F99DAE
                                                                • GetKeyState.USER32(00000012), ref: 00F99DC0
                                                                • GetAsyncKeyState.USER32(0000005B), ref: 00F99DD8
                                                                • GetKeyState.USER32(0000005B), ref: 00F99DEA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: State$Async$Keyboard
                                                                • String ID:
                                                                • API String ID: 541375521-0
                                                                • Opcode ID: 70262764f96fb4e6db3467ff1b609c9f216945bcb30152afe092db66e2b2a953
                                                                • Instruction ID: 28dfbae6ecd68f4c5b64f4fdcb2206f03fd6a22bd98bdd821e419fce05e7bf42
                                                                • Opcode Fuzzy Hash: 70262764f96fb4e6db3467ff1b609c9f216945bcb30152afe092db66e2b2a953
                                                                • Instruction Fuzzy Hash: 4241FB30D0C7CA69FF31976889443B5BEA06F12364F09405EC9C6575C1EBE559C8EBA2
                                                                Function 00FB055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • WSAStartup.WSOCK32(00000101,?), ref: 00FB05BC
                                                                • inet_addr.WSOCK32(?), ref: 00FB061C
                                                                • gethostbyname.WSOCK32(?), ref: 00FB0628
                                                                • IcmpCreateFile.IPHLPAPI ref: 00FB0636
                                                                • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00FB06C6
                                                                • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00FB06E5
                                                                • IcmpCloseHandle.IPHLPAPI(?), ref: 00FB07B9
                                                                • WSACleanup.WSOCK32 ref: 00FB07BF
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                • String ID: Ping
                                                                • API String ID: 1028309954-2246546115
                                                                • Opcode ID: fd3f3fcd6db7b52ef5ed1801b990ef36e8401ff976a607bf9342b1ff9ca9e332
                                                                • Instruction ID: 049ea33b6bbbc06ecf263832ea710dacdae9f9177335b61f5eb384826478eac4
                                                                • Opcode Fuzzy Hash: fd3f3fcd6db7b52ef5ed1801b990ef36e8401ff976a607bf9342b1ff9ca9e332
                                                                • Instruction Fuzzy Hash: 539190359042019FD720DF16C989F5BBBE0EF44328F1885A9F4698B6A2CB34EC45EF91
                                                                Function 00FB8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharLower
                                                                • String ID: cdecl$none$stdcall$winapi
                                                                • API String ID: 707087890-567219261
                                                                • Opcode ID: 9fbd70ee54cc8b8a5b4103ae8e829ec7aa7382f93b2d11c43d96368431e75ee5
                                                                • Instruction ID: 1e7d594a5d76813f62bd2c5120aa038ab9ce5733999bae18bdb0cbe033a58d9d
                                                                • Opcode Fuzzy Hash: 9fbd70ee54cc8b8a5b4103ae8e829ec7aa7382f93b2d11c43d96368431e75ee5
                                                                • Instruction Fuzzy Hash: AB51B431A041169BCB14DFA9C9419FEB7A9BFA4364B204229E916E7284DF34DD42EB90
                                                                Function 00FB372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CoInitialize.OLE32 ref: 00FB3774
                                                                • CoUninitialize.OLE32 ref: 00FB377F
                                                                • CoCreateInstance.OLE32(?,00000000,00000017,00FCFB78,?), ref: 00FB37D9
                                                                • IIDFromString.OLE32(?,?), ref: 00FB384C
                                                                • VariantInit.OLEAUT32(?), ref: 00FB38E4
                                                                • VariantClear.OLEAUT32(?), ref: 00FB3936
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                                • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                • API String ID: 636576611-1287834457
                                                                • Opcode ID: befa0de3a7d5d0248a58a822fd10e4bca1516988b846c3d81fccc0a92f6bb5de
                                                                • Instruction ID: 71203e1948a633ae1b964c811771d907e82e5d04f393c8e22586653aaeb84f1a
                                                                • Opcode Fuzzy Hash: befa0de3a7d5d0248a58a822fd10e4bca1516988b846c3d81fccc0a92f6bb5de
                                                                • Instruction Fuzzy Hash: 3B61A072648301AFD710DF55C889FAABBE8EF44710F104809F98597291DB74EE48EF92
                                                                Function 00FA3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00FA33CF
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00FA33F0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: LoadString$_wcslen
                                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                                • API String ID: 4099089115-3080491070
                                                                • Opcode ID: 3db9bf5284ec299a4178235bdbf994389a53bf5aef737b1c5997afea289b71f1
                                                                • Instruction ID: abc96c998d0a60460aa83cef109a2984c73a7ead069de1c2744ce0c9ab345738
                                                                • Opcode Fuzzy Hash: 3db9bf5284ec299a4178235bdbf994389a53bf5aef737b1c5997afea289b71f1
                                                                • Instruction Fuzzy Hash: 6A51AF72C0420AAADF15EBA0CD42EEEB778EF04350F148065F505B2062EB796F58FB61
                                                                Function 00F9B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharUpper
                                                                • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                                • API String ID: 1256254125-769500911
                                                                • Opcode ID: 15c678affaf7e9dd1d3683b260248f96aa16453c259ec714e60f54862508eaf0
                                                                • Instruction ID: 07a26ffc8577a8d7c52217ee75912d7809c62f8561b482f97eae0f952e396c99
                                                                • Opcode Fuzzy Hash: 15c678affaf7e9dd1d3683b260248f96aa16453c259ec714e60f54862508eaf0
                                                                • Instruction Fuzzy Hash: 74412933E0002A9BDF206F7DDE905BE77A5AFA0774B244269E521D7280E735EC81E790
                                                                Function 00FA5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetErrorMode.KERNEL32(00000001), ref: 00FA53A0
                                                                • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00FA5416
                                                                • GetLastError.KERNEL32 ref: 00FA5420
                                                                • SetErrorMode.KERNEL32(00000000,READY), ref: 00FA54A7
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Error$Mode$DiskFreeLastSpace
                                                                • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                • API String ID: 4194297153-14809454
                                                                • Opcode ID: bb3865c5d1271ec33d5025df8f147470122dbe883347dfcd756c25e93168de0e
                                                                • Instruction ID: 48f67fac31e8f2fd4aca3afd361f8e45e7e3de4b273941e06446c0127d511585
                                                                • Opcode Fuzzy Hash: bb3865c5d1271ec33d5025df8f147470122dbe883347dfcd756c25e93168de0e
                                                                • Instruction Fuzzy Hash: E231F6B5E006089FC710DF68C894FAD7BB4EF4A715F188055E905CB262DB75ED82EB90
                                                                Function 00FC3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateMenu.USER32 ref: 00FC3C79
                                                                • SetMenu.USER32(?,00000000), ref: 00FC3C88
                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FC3D10
                                                                • IsMenu.USER32(?), ref: 00FC3D24
                                                                • CreatePopupMenu.USER32 ref: 00FC3D2E
                                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FC3D5B
                                                                • DrawMenuBar.USER32 ref: 00FC3D63
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                                • String ID: 0$F
                                                                • API String ID: 161812096-3044882817
                                                                • Opcode ID: d684f56ae8d796371fa051afbd8c64b1041bd40fc93df12d7311be71491d5b1a
                                                                • Instruction ID: 6ff02fe79cb447c9b7e60be39fb78189235908ce49de8dd603f53e31d95b2ae6
                                                                • Opcode Fuzzy Hash: d684f56ae8d796371fa051afbd8c64b1041bd40fc93df12d7311be71491d5b1a
                                                                • Instruction Fuzzy Hash: 2F416B75A0120AAFDB14CF64D945FAA7BB5FF49350F14442CF946A7350D731AA10EF90
                                                                Function 00F91EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA
                                                                • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00F91F64
                                                                • GetDlgCtrlID.USER32 ref: 00F91F6F
                                                                • GetParent.USER32 ref: 00F91F8B
                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 00F91F8E
                                                                • GetDlgCtrlID.USER32(?), ref: 00F91F97
                                                                • GetParent.USER32(?), ref: 00F91FAB
                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 00F91FAE
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 711023334-1403004172
                                                                • Opcode ID: 7b8f06b1f26041458dd8ec0875ed9102810f30b0ae6b9414a3e47052a5eae302
                                                                • Instruction ID: 16432aff97d5b140d1b1fb6071863736ba5e691a06ad26cc1183d4a399ab4ccf
                                                                • Opcode Fuzzy Hash: 7b8f06b1f26041458dd8ec0875ed9102810f30b0ae6b9414a3e47052a5eae302
                                                                • Instruction Fuzzy Hash: 0421A171900118ABDF05AFA0DD45DEEBBA4AF05354F000115F959A72A1CBB95908FB60
                                                                Function 00F91FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA
                                                                • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00F92043
                                                                • GetDlgCtrlID.USER32 ref: 00F9204E
                                                                • GetParent.USER32 ref: 00F9206A
                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 00F9206D
                                                                • GetDlgCtrlID.USER32(?), ref: 00F92076
                                                                • GetParent.USER32(?), ref: 00F9208A
                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 00F9208D
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 711023334-1403004172
                                                                • Opcode ID: 274e2ea72996d73d00af598608b44fc35f602e0950107b456470d65a4b5ae87e
                                                                • Instruction ID: cc254eb822844e6668c6ebd7ace859d9749f7d0c9121d1d0cdf3aa23bb4b8907
                                                                • Opcode Fuzzy Hash: 274e2ea72996d73d00af598608b44fc35f602e0950107b456470d65a4b5ae87e
                                                                • Instruction Fuzzy Hash: 8521C675D00218BBDF10AFA0DD85EFEBBB8EF05350F004015FA59A72A1DAB98915FB60
                                                                Function 00FC3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00FC3A9D
                                                                • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00FC3AA0
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC3AC7
                                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FC3AEA
                                                                • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00FC3B62
                                                                • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00FC3BAC
                                                                • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00FC3BC7
                                                                • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00FC3BE2
                                                                • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00FC3BF6
                                                                • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00FC3C13
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$LongWindow
                                                                • String ID:
                                                                • API String ID: 312131281-0
                                                                • Opcode ID: 5ac84ca32a61a6abc052ab2544124e4ebd15d4fbae1892689e0a7b84d14b3f3e
                                                                • Instruction ID: 562e3ed2c662157bec28f26f5ffd456e94c87504aeea7e43eb0124f541e90559
                                                                • Opcode Fuzzy Hash: 5ac84ca32a61a6abc052ab2544124e4ebd15d4fbae1892689e0a7b84d14b3f3e
                                                                • Instruction Fuzzy Hash: 82618A75900209AFDB21DFA8CD82FEE77F8EB49310F104099FA15A7291C774AE41EB60
                                                                Function 00F9B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentThreadId.KERNEL32 ref: 00F9B151
                                                                • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B165
                                                                • GetWindowThreadProcessId.USER32(00000000), ref: 00F9B16C
                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B17B
                                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00F9B18D
                                                                • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B1A6
                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B1B8
                                                                • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B1FD
                                                                • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B212
                                                                • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B21D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                • String ID:
                                                                • API String ID: 2156557900-0
                                                                • Opcode ID: ced843a24019cee4a9af76562f8f2b805da9b8b9515d148408b338a8acd65a5d
                                                                • Instruction ID: 443fe473f319dad72ee74a8c4a2b268f7df20070dab4c1542467327f6268bd77
                                                                • Opcode Fuzzy Hash: ced843a24019cee4a9af76562f8f2b805da9b8b9515d148408b338a8acd65a5d
                                                                • Instruction Fuzzy Hash: C5318E71900208AFEF27DF25EE59F6D7BA9FB51321F104005FA49DB180D7B9A941AF60
                                                                Function 00F62C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _free.LIBCMT ref: 00F62C94
                                                                  • Part of subcall function 00F629C8: HeapFree.KERNEL32(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
                                                                  • Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0
                                                                • _free.LIBCMT ref: 00F62CA0
                                                                • _free.LIBCMT ref: 00F62CAB
                                                                • _free.LIBCMT ref: 00F62CB6
                                                                • _free.LIBCMT ref: 00F62CC1
                                                                • _free.LIBCMT ref: 00F62CCC
                                                                • _free.LIBCMT ref: 00F62CD7
                                                                • _free.LIBCMT ref: 00F62CE2
                                                                • _free.LIBCMT ref: 00F62CED
                                                                • _free.LIBCMT ref: 00F62CFB
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast
                                                                • String ID:
                                                                • API String ID: 776569668-0
                                                                • Opcode ID: fff07eedab689fd0cc18de3ad0e1491b5924cd43b6e445a17670f7b9e4301654
                                                                • Instruction ID: f4c6f0741a3caaf91430f43c648b3d966ee635c43ef3545d57da6ec4f3d05347
                                                                • Opcode Fuzzy Hash: fff07eedab689fd0cc18de3ad0e1491b5924cd43b6e445a17670f7b9e4301654
                                                                • Instruction Fuzzy Hash: CA119376600508AFCB86EF58DC82CDD3BB5FF45390F4144A5FA489B222DA35EA50BB90
                                                                Function 00FA7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FA7FAD
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00FA7FC1
                                                                • GetFileAttributesW.KERNEL32(?), ref: 00FA7FEB
                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00FA8005
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8017
                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8060
                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00FA80B0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CurrentDirectory$AttributesFile
                                                                • String ID: *.*
                                                                • API String ID: 769691225-438819550
                                                                • Opcode ID: 87a11d616ef409676957c124201c1c7117acc867b9fcaf7292f16c363aa5c555
                                                                • Instruction ID: 4a9232e54d78c92b1787c806c9f0d3bd0253001d78927372218881dfb484f70d
                                                                • Opcode Fuzzy Hash: 87a11d616ef409676957c124201c1c7117acc867b9fcaf7292f16c363aa5c555
                                                                • Instruction Fuzzy Hash: 8C81B6B29083459BCB24EF14CC84E6AB3E8BF86360F144C5EF885D7250DB75DD45AB92
                                                                Function 00F35BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetWindowLongW.USER32(?,000000EB), ref: 00F35C7A
                                                                  • Part of subcall function 00F35D0A: GetClientRect.USER32(?,?), ref: 00F35D30
                                                                  • Part of subcall function 00F35D0A: GetWindowRect.USER32(?,?), ref: 00F35D71
                                                                  • Part of subcall function 00F35D0A: ScreenToClient.USER32(?,?), ref: 00F35D99
                                                                • GetDC.USER32 ref: 00F746F5
                                                                • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00F74708
                                                                • SelectObject.GDI32(00000000,00000000), ref: 00F74716
                                                                • SelectObject.GDI32(00000000,00000000), ref: 00F7472B
                                                                • ReleaseDC.USER32(?,00000000), ref: 00F74733
                                                                • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00F747C4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                • String ID: U
                                                                • API String ID: 4009187628-3372436214
                                                                • Opcode ID: 9b21069ce189c107668efe47718cd70e7c7972419e81fc03463c65be25d90e6f
                                                                • Instruction ID: 1bb59ce9ead5bb54b22e4679ee97f02ac37ca840790558e85ab75d0b45f876e2
                                                                • Opcode Fuzzy Hash: 9b21069ce189c107668efe47718cd70e7c7972419e81fc03463c65be25d90e6f
                                                                • Instruction Fuzzy Hash: 1671E331800205DFCF268F64C985AB97BB5FF4A374F14822AED595A166C335A842FF52
                                                                Function 00FA359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00FA35E4
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • LoadStringW.USER32(01002390,?,00000FFF,?), ref: 00FA360A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: LoadString$_wcslen
                                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                • API String ID: 4099089115-2391861430
                                                                • Opcode ID: 51c99bd79b5922a0b19f7ffa0352812e3c8ca2c27c78610fac24b7f9f8e9a639
                                                                • Instruction ID: 6e0e56901b1e43a64bbaa6e88a36b814de6e3df7cea12e50b2aa92a2c6b34d09
                                                                • Opcode Fuzzy Hash: 51c99bd79b5922a0b19f7ffa0352812e3c8ca2c27c78610fac24b7f9f8e9a639
                                                                • Instruction Fuzzy Hash: 12517FB1C0421ABADF15EBA0CC42EEDBB38EF05310F144125F505721A1EB795B99EFA1
                                                                Function 00FAC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FAC272
                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FAC29A
                                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FAC2CA
                                                                • GetLastError.KERNEL32 ref: 00FAC322
                                                                • SetEvent.KERNEL32(?), ref: 00FAC336
                                                                • InternetCloseHandle.WININET(00000000), ref: 00FAC341
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                • String ID:
                                                                • API String ID: 3113390036-3916222277
                                                                • Opcode ID: 00222de189e2b816f14e23de31e6652af7be13e2aedf4931ebb30c30315c2930
                                                                • Instruction ID: f212d4c8f5f657b54561bae51e2178dd62098b8ebbeb9eafaf745ceb07e03215
                                                                • Opcode Fuzzy Hash: 00222de189e2b816f14e23de31e6652af7be13e2aedf4931ebb30c30315c2930
                                                                • Instruction Fuzzy Hash: F2313CB1900708AFDB219F649D89AAB7AECEF4A754B14851AE44AD3200DB34D905ABE1
                                                                Function 00F9989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00F73AAF,?,?,Bad directive syntax error,00FCCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00F998BC
                                                                • LoadStringW.USER32(00000000,?,00F73AAF,?), ref: 00F998C3
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00F99987
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: HandleLoadMessageModuleString_wcslen
                                                                • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                • API String ID: 858772685-4153970271
                                                                • Opcode ID: b8cdc8a700ec38246cb773ca7b7fcd75961c2627a0dae64ef504ff4b6989699b
                                                                • Instruction ID: 480f5deb6655b149ee8326a176b243bccef97857bde37e65dd447420bab6984c
                                                                • Opcode Fuzzy Hash: b8cdc8a700ec38246cb773ca7b7fcd75961c2627a0dae64ef504ff4b6989699b
                                                                • Instruction Fuzzy Hash: 25217E3284421EABDF15EF90CC06EEE7775FF18710F044419F619660A2EBB99618FB51
                                                                Function 00F9209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetParent.USER32 ref: 00F920AB
                                                                • GetClassNameW.USER32(00000000,?,00000100), ref: 00F920C0
                                                                • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00F9214D
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameParentSend
                                                                • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                • API String ID: 1290815626-3381328864
                                                                • Opcode ID: 9ef880bb506e650a2689cccfb7f93859b9148fb661d004e7b1cb0724a8a2d801
                                                                • Instruction ID: 8620007239390e547cb34bb8bc4017937f3e3a070a92d0bf2b03d9565582689e
                                                                • Opcode Fuzzy Hash: 9ef880bb506e650a2689cccfb7f93859b9148fb661d004e7b1cb0724a8a2d801
                                                                • Instruction Fuzzy Hash: C6112C7768870ABAFE412620DC07DF6379CCF04725F200016FB08A50F1FE65A8957654
                                                                Function 00F68D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4cbbfc3ee2fbf46e8f2ea3fd00cc842ebea1264cd3dd59781647abf3e0f80705
                                                                • Instruction ID: e935344005c3f2e9405047e801188d56d7b8a4183ce383118d470873bd3706fa
                                                                • Opcode Fuzzy Hash: 4cbbfc3ee2fbf46e8f2ea3fd00cc842ebea1264cd3dd59781647abf3e0f80705
                                                                • Instruction Fuzzy Hash: 3CC12475D08249AFCF11DFA8C841BADBBB4EF09360F044199F915A7392CB758946EB60
                                                                Function 00F6CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                                • String ID:
                                                                • API String ID: 1282221369-0
                                                                • Opcode ID: e6faf591e812ae849dc287e2793ad1217cf242627fa8b3c42681de3ba016fe9d
                                                                • Instruction ID: 8b097932f773483763a6a941e9d9163f722cabdda4b0d3cb024eeb82f30e4dd4
                                                                • Opcode Fuzzy Hash: e6faf591e812ae849dc287e2793ad1217cf242627fa8b3c42681de3ba016fe9d
                                                                • Instruction Fuzzy Hash: 71611471E04201AFDB25AFB49C81B7E7BA5AF05360F04416EF9C597286DB3A9901B7F0
                                                                Function 00FC50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00FC5186
                                                                • ShowWindow.USER32(?,00000000), ref: 00FC51C7
                                                                • ShowWindow.USER32(?,00000005,?,00000000), ref: 00FC51CD
                                                                • SetFocus.USER32(?,?,00000005,?,00000000), ref: 00FC51D1
                                                                  • Part of subcall function 00FC6FBA: DeleteObject.GDI32(00000000), ref: 00FC6FE6
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC520D
                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FC521A
                                                                • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00FC524D
                                                                • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00FC5287
                                                                • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00FC5296
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                                • String ID:
                                                                • API String ID: 3210457359-0
                                                                • Opcode ID: de6fce36560383631556a80dde7c62efd7c4b849d4d2720910e98973b9df669f
                                                                • Instruction ID: 69b27162bb7fadfa40e1169b71e1c7a93656fe00b9e9c27203b0018bb28b23a5
                                                                • Opcode Fuzzy Hash: de6fce36560383631556a80dde7c62efd7c4b849d4d2720910e98973b9df669f
                                                                • Instruction Fuzzy Hash: 97519E30E40A0ABEEB209F24CE4BFD93BA5EB05B24F584009F519962E1C375B9C0FB40
                                                                Function 00F48B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00F86890
                                                                • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00F868A9
                                                                • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00F868B9
                                                                • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00F868D1
                                                                • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00F868F2
                                                                • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00F48874,00000000,00000000,00000000,000000FF,00000000), ref: 00F86901
                                                                • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00F8691E
                                                                • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00F48874,00000000,00000000,00000000,000000FF,00000000), ref: 00F8692D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                • String ID:
                                                                • API String ID: 1268354404-0
                                                                • Opcode ID: a91ba30bdeef007cbd74a9d76a10ac04f58d78544bd00eeea10bf5bdaaeef7dc
                                                                • Instruction ID: bf2628e696e8e071abaa49ecee489cc53f579910cff3b8689a848d4febb3d969
                                                                • Opcode Fuzzy Hash: a91ba30bdeef007cbd74a9d76a10ac04f58d78544bd00eeea10bf5bdaaeef7dc
                                                                • Instruction Fuzzy Hash: BC515970A00209EFDB20DF24CD46FAA7BB5EF88760F104518F95AD72A0DB75E991EB50
                                                                Function 00FAC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FAC182
                                                                • GetLastError.KERNEL32 ref: 00FAC195
                                                                • SetEvent.KERNEL32(?), ref: 00FAC1A9
                                                                  • Part of subcall function 00FAC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FAC272
                                                                  • Part of subcall function 00FAC253: GetLastError.KERNEL32 ref: 00FAC322
                                                                  • Part of subcall function 00FAC253: SetEvent.KERNEL32(?), ref: 00FAC336
                                                                  • Part of subcall function 00FAC253: InternetCloseHandle.WININET(00000000), ref: 00FAC341
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                                • String ID:
                                                                • API String ID: 337547030-0
                                                                • Opcode ID: e4ba750544614502097c1c7d6ea8f41dcbd64d00c53f0cbe6a37bf2a70831f24
                                                                • Instruction ID: fef2b9b27d6cb90788aa66820ddd76754683bf261d03f1c927f879a7a0c5b3ef
                                                                • Opcode Fuzzy Hash: e4ba750544614502097c1c7d6ea8f41dcbd64d00c53f0cbe6a37bf2a70831f24
                                                                • Instruction Fuzzy Hash: 42319EB1600609AFDB219FA5DE44BA6BBF8FF5A310B04441EF95A83610D731E814FBE0
                                                                Function 00F925A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F93A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F93A57
                                                                  • Part of subcall function 00F93A3D: GetCurrentThreadId.KERNEL32 ref: 00F93A5E
                                                                  • Part of subcall function 00F93A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F925B3), ref: 00F93A65
                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00F925BD
                                                                • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00F925DB
                                                                • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00F925DF
                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00F925E9
                                                                • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00F92601
                                                                • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00F92605
                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00F9260F
                                                                • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00F92623
                                                                • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00F92627
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                • String ID:
                                                                • API String ID: 2014098862-0
                                                                • Opcode ID: d405738c91864bc60abce1fe172088f1197b9e11d18e9f6b71cb0829ecda509e
                                                                • Instruction ID: 06e3e566138b5313533b337b893cf5c0ee6e0568f8dde6f5255fa5047e2e5b9b
                                                                • Opcode Fuzzy Hash: d405738c91864bc60abce1fe172088f1197b9e11d18e9f6b71cb0829ecda509e
                                                                • Instruction Fuzzy Hash: 2F01D431790214BBFB20676A9C8BF593F59DB4EB12F110001F31CAF1D2C9F22444AAA9
                                                                Function 00F91803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00F91449,?,?,00000000), ref: 00F9180C
                                                                • HeapAlloc.KERNEL32(00000000,?,00F91449,?,?,00000000), ref: 00F91813
                                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F91449,?,?,00000000), ref: 00F91828
                                                                • GetCurrentProcess.KERNEL32(?,00000000,?,00F91449,?,?,00000000), ref: 00F91830
                                                                • DuplicateHandle.KERNEL32(00000000,?,00F91449,?,?,00000000), ref: 00F91833
                                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F91449,?,?,00000000), ref: 00F91843
                                                                • GetCurrentProcess.KERNEL32(00F91449,00000000,?,00F91449,?,?,00000000), ref: 00F9184B
                                                                • DuplicateHandle.KERNEL32(00000000,?,00F91449,?,?,00000000), ref: 00F9184E
                                                                • CreateThread.KERNEL32(00000000,00000000,00F91874,00000000,00000000,00000000), ref: 00F91868
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                • String ID:
                                                                • API String ID: 1957940570-0
                                                                • Opcode ID: a6ff852a584debf8b280a1b93f07f61544b7bf7f27ea8643a0dac64e7113351d
                                                                • Instruction ID: ce7ccccbcb21f1b545234fb10912bfb16a0afcd3dacd343759382562c9b13e96
                                                                • Opcode Fuzzy Hash: a6ff852a584debf8b280a1b93f07f61544b7bf7f27ea8643a0dac64e7113351d
                                                                • Instruction Fuzzy Hash: 6F01BFB5240348BFE710AB66DD4EF5B3B6CEB89B11F044411FA05DB192C6759800DB60
                                                                Function 00FBA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F9D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00F9D501
                                                                  • Part of subcall function 00F9D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00F9D50F
                                                                  • Part of subcall function 00F9D4DC: FindCloseChangeNotification.KERNEL32(00000000), ref: 00F9D5DC
                                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FBA16D
                                                                • GetLastError.KERNEL32 ref: 00FBA180
                                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FBA1B3
                                                                • TerminateProcess.KERNEL32(00000000,00000000), ref: 00FBA268
                                                                • GetLastError.KERNEL32(00000000), ref: 00FBA273
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FBA2C4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
                                                                • String ID: SeDebugPrivilege
                                                                • API String ID: 1701285019-2896544425
                                                                • Opcode ID: 69d33fee6605247dd2d3fd29db8769308134fa07fc53ee15322fc288a03d67be
                                                                • Instruction ID: b02c4c8c95f4d0adeb9e1e462024e4247f1767a7260c913005f0d4fb3ff40372
                                                                • Opcode Fuzzy Hash: 69d33fee6605247dd2d3fd29db8769308134fa07fc53ee15322fc288a03d67be
                                                                • Instruction Fuzzy Hash: 6161A131604242AFD720DF19C895F55BBE1AF44328F18849CE46A8BBA3C776EC45DF92
                                                                Function 00F9BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F9BCFD
                                                                • IsMenu.USER32(00000000), ref: 00F9BD1D
                                                                • CreatePopupMenu.USER32 ref: 00F9BD53
                                                                • GetMenuItemCount.USER32(01074928), ref: 00F9BDA4
                                                                • InsertMenuItemW.USER32(01074928,?,00000001,00000030), ref: 00F9BDCC
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                                • String ID: 0$2
                                                                • API String ID: 93392585-3793063076
                                                                • Opcode ID: cba4152e251c85fdccad1f063f6a823e8c4f63a883ce65b0e481dcce89cf3f9e
                                                                • Instruction ID: 0e61719ab0a0819842d873e2f3b089500d1b598d690836901d0e568f4a3cf600
                                                                • Opcode Fuzzy Hash: cba4152e251c85fdccad1f063f6a823e8c4f63a883ce65b0e481dcce89cf3f9e
                                                                • Instruction Fuzzy Hash: 2C51D170A00209DBFF11CFA9EA88BAEBBF4FF45324F14411AE405D7290D7749941EB91
                                                                Function 00F9C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadIconW.USER32(00000000,00007F03), ref: 00F9C913
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: IconLoad
                                                                • String ID: blank$info$question$stop$warning
                                                                • API String ID: 2457776203-404129466
                                                                • Opcode ID: d418944562558cc12c77e9038faa1a4574b3bf4dd51b8a84a5ff8c6afae70c38
                                                                • Instruction ID: 827c8d7fe599e0b04276fd26ba134b590669fcabfa8be543fef3a14bcc821457
                                                                • Opcode Fuzzy Hash: d418944562558cc12c77e9038faa1a4574b3bf4dd51b8a84a5ff8c6afae70c38
                                                                • Instruction Fuzzy Hash: 59110033A8930ABAFF056B549C83DAA7B9CDF15769B10002AF604E6192DB74AD4073E5
                                                                Function 00F9DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                • String ID: 0.0.0.0
                                                                • API String ID: 642191829-3771769585
                                                                • Opcode ID: 5d951785da9e945d2c613b210fd0f72517614505914af14dbd7ff9253e35f9f8
                                                                • Instruction ID: d34fa532e441afb71486a62143c4ec39690239e0a56ebedc6d9167006e734e9e
                                                                • Opcode Fuzzy Hash: 5d951785da9e945d2c613b210fd0f72517614505914af14dbd7ff9253e35f9f8
                                                                • Instruction Fuzzy Hash: C4113671800109ABDF24BB60DC0BEEF37ACDF10721F110169F50997091EF749A84BAA0
                                                                Function 00FC9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2
                                                                • GetSystemMetrics.USER32(0000000F), ref: 00FC9FC7
                                                                • GetSystemMetrics.USER32(0000000F), ref: 00FC9FE7
                                                                • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00FCA224
                                                                • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00FCA242
                                                                • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00FCA263
                                                                • ShowWindow.USER32(00000003,00000000), ref: 00FCA282
                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00FCA2A7
                                                                • DefDlgProcW.USER32(?,00000005,?,?), ref: 00FCA2CA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                                • String ID:
                                                                • API String ID: 1211466189-0
                                                                • Opcode ID: 2250253d1c9a48122588d45a3b68065c547de42a8309606f4f45c951ed6070d0
                                                                • Instruction ID: b95d9992a7af05c5c9bf19249d8373164f30a590ddd25711211953105fffbd25
                                                                • Opcode Fuzzy Hash: 2250253d1c9a48122588d45a3b68065c547de42a8309606f4f45c951ed6070d0
                                                                • Instruction Fuzzy Hash: 68B19E31A0021ADFDF14CF68CA86BEE7BB2FF44715F088069ED499B295D731A940EB51
                                                                Function 00F9ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$LocalTime
                                                                • String ID:
                                                                • API String ID: 952045576-0
                                                                • Opcode ID: a0f7e5e9f7d4d00d0b9771717efb8663b4049cd28b6b057da1f1a6c38c6e415c
                                                                • Instruction ID: 39171252ec8f187d48992d126f802ad34ea456cae342bf39270cdf8da945fd72
                                                                • Opcode Fuzzy Hash: a0f7e5e9f7d4d00d0b9771717efb8663b4049cd28b6b057da1f1a6c38c6e415c
                                                                • Instruction Fuzzy Hash: A941B265C1021875DF11EBF48C8A9CFB7B8EF45311F508466EA18E3122FB38E249D3A5
                                                                Function 00F4F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ShowWindow.USER32(FFFFFFFF,?,?,?,?,?,00000005,?,?,00F4F8B0,00000005,00000000), ref: 00F4F953
                                                                • ShowWindow.USER32(FFFFFFFF,00000006,?,?,?,?,00000005,?,?,00F4F8B0,00000005,00000000), ref: 00F8F3D1
                                                                • ShowWindow.USER32(FFFFFFFF,?,?,?,?,?,00000005,?,?,00F4F8B0,00000005,00000000), ref: 00F8F454
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ShowWindow
                                                                • String ID:
                                                                • API String ID: 1268545403-0
                                                                • Opcode ID: bf60cd3a61fe0f655412e55c30edb87e4501d8894395e3537eb113ebb6c109e6
                                                                • Instruction ID: ff0cd6909c41fd8ee0396dabbab53e08f7effb3d49b604922d9575ab560d859b
                                                                • Opcode Fuzzy Hash: bf60cd3a61fe0f655412e55c30edb87e4501d8894395e3537eb113ebb6c109e6
                                                                • Instruction Fuzzy Hash: 9E413B31A18640BED7399F28CD88B6A7F91AF56320F14443DE88F53660C732A888FB51
                                                                Function 00FC2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DeleteObject.GDI32(00000000), ref: 00FC2D1B
                                                                • GetDC.USER32(00000000), ref: 00FC2D23
                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FC2D2E
                                                                • ReleaseDC.USER32(00000000,00000000), ref: 00FC2D3A
                                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00FC2D76
                                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00FC2D87
                                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00FC5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00FC2DC2
                                                                • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00FC2DE1
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                • String ID:
                                                                • API String ID: 3864802216-0
                                                                • Opcode ID: 5b3de7f600d99fa2f699bbd0c12e164d7ad65a2bc6f29f56a1086ddbb73076cf
                                                                • Instruction ID: 1df263becc5009b442f24b95207ba55718f795c6955a319820b7bee4ee98c451
                                                                • Opcode Fuzzy Hash: 5b3de7f600d99fa2f699bbd0c12e164d7ad65a2bc6f29f56a1086ddbb73076cf
                                                                • Instruction Fuzzy Hash: 3B318B72201214BFEB118F548E8AFEB3BA9EF59721F084055FE099B291C6759C41DBA0
                                                                Function 00F95622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _memcmp
                                                                • String ID:
                                                                • API String ID: 2931989736-0
                                                                • Opcode ID: 0f07bcf1d6cb21f5e8eab80baf54bbc3e85b81d8f5ba53ac9ee75cfb7d3ecc93
                                                                • Instruction ID: 83d55d4e5326150de52a84ca164190786bada12305a5a498d99994093df9cc15
                                                                • Opcode Fuzzy Hash: 0f07bcf1d6cb21f5e8eab80baf54bbc3e85b81d8f5ba53ac9ee75cfb7d3ecc93
                                                                • Instruction Fuzzy Hash: 52213A62F4090A77FA159D208E93FBA734DBF51B91F400024FE049A541F724FE18B7A6
                                                                Function 00FB4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: NULL Pointer assignment$Not an Object type
                                                                • API String ID: 0-572801152
                                                                • Opcode ID: 674fc325f8e5cc883e25b5830a3b5e3f0b44ec3443e7b9095c67cfebb3086501
                                                                • Instruction ID: e67c65d8a13b8ca435ddd919b18ac7848cb12bfe9e7744cc8c47259162e6f17b
                                                                • Opcode Fuzzy Hash: 674fc325f8e5cc883e25b5830a3b5e3f0b44ec3443e7b9095c67cfebb3086501
                                                                • Instruction Fuzzy Hash: 1BD1EC71A0060AAFDF10DFA9C880BEEB7B5BF48754F148069E915AB280E774DD45DFA0
                                                                Function 00F71522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCPInfo.KERNEL32(?,?), ref: 00F715CE
                                                                • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F71651
                                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F716E4
                                                                • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F716FB
                                                                  • Part of subcall function 00F63820: RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852
                                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F71777
                                                                • __freea.LIBCMT ref: 00F717A2
                                                                • __freea.LIBCMT ref: 00F717AE
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                                • String ID:
                                                                • API String ID: 2829977744-0
                                                                • Opcode ID: 9fb93cf540668aa19f5110a743e8f913f88fe02be32ba3005e4d76b080ecde18
                                                                • Instruction ID: c355d6a0854e5fef48adfa5a83f3fd6fa7b75be8c114fd17bc4825693d8c5b1b
                                                                • Opcode Fuzzy Hash: 9fb93cf540668aa19f5110a743e8f913f88fe02be32ba3005e4d76b080ecde18
                                                                • Instruction Fuzzy Hash: 2C91E972E002165ADF288E7CCC41EEE7BB5BF45720F18865AE809E7140D735DD49E7A2
                                                                Function 00FB4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearInit
                                                                • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                • API String ID: 2610073882-625585964
                                                                • Opcode ID: 790cc05519fa8ce031bbdc8bcbb729538897233fc2d28d6a09488594f2b87858
                                                                • Instruction ID: 58adcbcaa3e07216c8e19873b7213d93130a4f85e21e5a84d83824af8c521fe0
                                                                • Opcode Fuzzy Hash: 790cc05519fa8ce031bbdc8bcbb729538897233fc2d28d6a09488594f2b87858
                                                                • Instruction Fuzzy Hash: CA918271E00219ABDF20CF66C944FEEBBB9AF45720F108559E505AB282D770A945DFA0
                                                                Function 00FA1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00FA125C
                                                                • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00FA1284
                                                                • SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00FA12A8
                                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FA12D8
                                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FA135F
                                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FA13C4
                                                                • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FA1430
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                                • String ID:
                                                                • API String ID: 2550207440-0
                                                                • Opcode ID: d906d846d29f53dbfc44234fcc6151b7aa0076132ed2a404a937cc46237abaac
                                                                • Instruction ID: fac13f3e811d0e54b938b7b9a742abac063dc05f1aec0379687a03ebeb524c2b
                                                                • Opcode Fuzzy Hash: d906d846d29f53dbfc44234fcc6151b7aa0076132ed2a404a937cc46237abaac
                                                                • Instruction Fuzzy Hash: 9691E6B1E002099FDB00DF98C885BBE77B5FF46325F164029E941EB291D778E945EB90
                                                                Function 00F4948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ObjectSelect$BeginCreatePath
                                                                • String ID:
                                                                • API String ID: 3225163088-0
                                                                • Opcode ID: 5dae07ea525b743813cd26840e974860c7ea799bac5a0f18f93977ed48b7846a
                                                                • Instruction ID: 88fa6172958918ca1419e835d425b4355d02cf37769c299c72b3d5da56e6afef
                                                                • Opcode Fuzzy Hash: 5dae07ea525b743813cd26840e974860c7ea799bac5a0f18f93977ed48b7846a
                                                                • Instruction Fuzzy Hash: 01912871E44219AFCB10DFA9CC84AEEBFB8FF49320F244159E915B7251D378A941EB60
                                                                Function 00FB3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(?), ref: 00FB396B
                                                                • CharUpperBuffW.USER32(?,?), ref: 00FB3A7A
                                                                • _wcslen.LIBCMT ref: 00FB3A8A
                                                                • VariantClear.OLEAUT32(?), ref: 00FB3C1F
                                                                  • Part of subcall function 00FA0CDF: VariantInit.OLEAUT32(00000000), ref: 00FA0D1F
                                                                  • Part of subcall function 00FA0CDF: VariantCopy.OLEAUT32(?,?), ref: 00FA0D28
                                                                  • Part of subcall function 00FA0CDF: VariantClear.OLEAUT32(?), ref: 00FA0D34
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                                • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                • API String ID: 4137639002-1221869570
                                                                • Opcode ID: 9178cc6cd57a3cf3ad13fe226685a2f6db7473b7ddfd7f4e3b9c2ce38e5fc2de
                                                                • Instruction ID: 94c5b8781c4eff2b0e30bac6a968ff606a1de6f42630eacc59e5225866a13ce3
                                                                • Opcode Fuzzy Hash: 9178cc6cd57a3cf3ad13fe226685a2f6db7473b7ddfd7f4e3b9c2ce38e5fc2de
                                                                • Instruction Fuzzy Hash: 47913675A083059FC704EF25C88196AB7E5BF88324F14892DF88997351DB34EE45EF92
                                                                Function 00FB4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F9000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?,?,00F9035E), ref: 00F9002B
                                                                  • Part of subcall function 00F9000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90046
                                                                  • Part of subcall function 00F9000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90054
                                                                  • Part of subcall function 00F9000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?), ref: 00F90064
                                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00FB4C51
                                                                • _wcslen.LIBCMT ref: 00FB4D59
                                                                • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00FB4DCF
                                                                • CoTaskMemFree.OLE32(?), ref: 00FB4DDA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                                • String ID: NULL Pointer assignment
                                                                • API String ID: 614568839-2785691316
                                                                • Opcode ID: b0e300ec7ef065fcbbc514f1caa359b92cda2067cc70a2616502c603e42cc0b0
                                                                • Instruction ID: e30c6d2a873ff69eb17a38e74bf793399945412841a283dac941502e25bc3fdf
                                                                • Opcode Fuzzy Hash: b0e300ec7ef065fcbbc514f1caa359b92cda2067cc70a2616502c603e42cc0b0
                                                                • Instruction Fuzzy Hash: AE911671D0021DAFDF14DFA5CC91AEEB7B8BF48310F108169E915A7291DB74AA44EFA0
                                                                Function 00FC20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenu.USER32(?), ref: 00FC2183
                                                                • GetMenuItemCount.USER32(00000000), ref: 00FC21B5
                                                                • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00FC21DD
                                                                • _wcslen.LIBCMT ref: 00FC2213
                                                                • GetMenuItemID.USER32(?,?), ref: 00FC224D
                                                                • GetSubMenu.USER32(?,?), ref: 00FC225B
                                                                  • Part of subcall function 00F93A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F93A57
                                                                  • Part of subcall function 00F93A3D: GetCurrentThreadId.KERNEL32 ref: 00F93A5E
                                                                  • Part of subcall function 00F93A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F925B3), ref: 00F93A65
                                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00FC22E3
                                                                  • Part of subcall function 00F9E97B: Sleep.KERNEL32 ref: 00F9E9F3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                                • String ID:
                                                                • API String ID: 4196846111-0
                                                                • Opcode ID: 8414792af8942716d0e006722037ae34f3cc57396519dc06111ba6913ae38672
                                                                • Instruction ID: fca90c13dc46fdff3ec4498fa4246aea8f6052bb9046697920af51f5db19a856
                                                                • Opcode Fuzzy Hash: 8414792af8942716d0e006722037ae34f3cc57396519dc06111ba6913ae38672
                                                                • Instruction Fuzzy Hash: 40718E75E00206AFDB54EF64C942FAEB7F1EF48320F148459E816EB341D738AD41AB90
                                                                Function 00FC7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • IsWindow.USER32(01074748), ref: 00FC7F37
                                                                • IsWindowEnabled.USER32(01074748), ref: 00FC7F43
                                                                • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00FC801E
                                                                • SendMessageW.USER32(01074748,000000B0,?,?), ref: 00FC8051
                                                                • IsDlgButtonChecked.USER32(?,?), ref: 00FC8089
                                                                • GetWindowLongW.USER32(01074748,000000EC), ref: 00FC80AB
                                                                • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00FC80C3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                                • String ID:
                                                                • API String ID: 4072528602-0
                                                                • Opcode ID: a7c9d5c89eb35499d845a01c9883ac1d155b951869c30c00dbbafd3939fd442d
                                                                • Instruction ID: bd51882eb656ea21542f2eafa2c4330420c1156ea6f0821bb3e8b6c3fda23153
                                                                • Opcode Fuzzy Hash: a7c9d5c89eb35499d845a01c9883ac1d155b951869c30c00dbbafd3939fd442d
                                                                • Instruction Fuzzy Hash: 0C71BF34A08346AFEB21AF64CEC6FAABBB5EF09360F14005DE95553251CB31A845FF90
                                                                Function 00F9AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetParent.USER32(?), ref: 00F9AEF9
                                                                • GetKeyboardState.USER32(?), ref: 00F9AF0E
                                                                • SetKeyboardState.USER32(?), ref: 00F9AF6F
                                                                • PostMessageW.USER32(?,00000101,00000010,?), ref: 00F9AF9D
                                                                • PostMessageW.USER32(?,00000101,00000011,?), ref: 00F9AFBC
                                                                • PostMessageW.USER32(?,00000101,00000012,?), ref: 00F9AFFD
                                                                • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F9B020
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                • String ID:
                                                                • API String ID: 87235514-0
                                                                • Opcode ID: 898a758c5ab2a417faf40bc7f9c8a9331b514608025077334aed0470737c4a35
                                                                • Instruction ID: 1d9dd83d8c2c3e31ea27f98fc55a4fae7bebcd8fd7e38b04e582f279ec8b4e92
                                                                • Opcode Fuzzy Hash: 898a758c5ab2a417faf40bc7f9c8a9331b514608025077334aed0470737c4a35
                                                                • Instruction Fuzzy Hash: C851D1A1A047D53DFF3743348D49BBABEA95B06318F088589E1D9458D2C3D9ACC8F791
                                                                Function 00F9ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetParent.USER32(00000000), ref: 00F9AD19
                                                                • GetKeyboardState.USER32(?), ref: 00F9AD2E
                                                                • SetKeyboardState.USER32(?), ref: 00F9AD8F
                                                                • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F9ADBB
                                                                • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F9ADD8
                                                                • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F9AE17
                                                                • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F9AE38
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                • String ID:
                                                                • API String ID: 87235514-0
                                                                • Opcode ID: 42d1c60442cb784ff7be0458aa38a04342d56bbe6c1db5310b3b2ab3c7444861
                                                                • Instruction ID: c41996d84e70317f353046b2aaca43859b5f1397a88bf9c91e99b7c4ed3d5c84
                                                                • Opcode Fuzzy Hash: 42d1c60442cb784ff7be0458aa38a04342d56bbe6c1db5310b3b2ab3c7444861
                                                                • Instruction Fuzzy Hash: CC51D5A1D047D53DFF3793358C55B7A7EA85B46310F088489E1D9468C2D294EC98F7D2
                                                                Function 00F6542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetConsoleCP.KERNEL32(00F73CD6,?,?,?,?,?,?,?,?,00F65BA3,?,?,00F73CD6,?,?), ref: 00F65470
                                                                • __fassign.LIBCMT ref: 00F654EB
                                                                • __fassign.LIBCMT ref: 00F65506
                                                                • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00F73CD6,00000005,00000000,00000000), ref: 00F6552C
                                                                • WriteFile.KERNEL32(?,00F73CD6,00000000,00F65BA3,00000000,?,?,?,?,?,?,?,?,?,00F65BA3,?), ref: 00F6554B
                                                                • WriteFile.KERNEL32(?,?,00000001,00F65BA3,00000000,?,?,?,?,?,?,?,?,?,00F65BA3,?), ref: 00F65584
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                • String ID:
                                                                • API String ID: 1324828854-0
                                                                • Opcode ID: d42a9af1b3bf286618d9fbeed2ab7ebaf2030c7a0ba37f7a5818f2655aa06e73
                                                                • Instruction ID: 4d5c1456a2f136d58c50f59d9c43b0430267d5aa722060bf6fa8a63f0cee9254
                                                                • Opcode Fuzzy Hash: d42a9af1b3bf286618d9fbeed2ab7ebaf2030c7a0ba37f7a5818f2655aa06e73
                                                                • Instruction Fuzzy Hash: B851DFB1E006499FDB10CFA8D846AEEBBF9EF08710F18411EF946F3291D6309A41DB60
                                                                Function 00F52D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _ValidateLocalCookies.LIBCMT ref: 00F52D4B
                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 00F52D53
                                                                • _ValidateLocalCookies.LIBCMT ref: 00F52DE1
                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00F52E0C
                                                                • _ValidateLocalCookies.LIBCMT ref: 00F52E61
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                • String ID: csm
                                                                • API String ID: 1170836740-1018135373
                                                                • Opcode ID: c8a663c2390f4e43e973773d04606ebb373973cc707460d5bfb0aeef2f00cc0f
                                                                • Instruction ID: aa77299c459bc567a4c195cc1a1f228f1b5d5abc269d3407529d1dcd09fce808
                                                                • Opcode Fuzzy Hash: c8a663c2390f4e43e973773d04606ebb373973cc707460d5bfb0aeef2f00cc0f
                                                                • Instruction Fuzzy Hash: 9041E834E002089BCF10DF68CC45A9EBBB5BF46326F148255EE146B352D735DA09EBD0
                                                                Function 00FB10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00FB304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FB307A
                                                                  • Part of subcall function 00FB304E: _wcslen.LIBCMT ref: 00FB309B
                                                                • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00FB1112
                                                                • WSAGetLastError.WSOCK32 ref: 00FB1121
                                                                • WSAGetLastError.WSOCK32 ref: 00FB11C9
                                                                • closesocket.WSOCK32(00000000), ref: 00FB11F9
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                                                • String ID:
                                                                • API String ID: 2675159561-0
                                                                • Opcode ID: 2a0ef10c9c87fd122812cc3daeea518ef75f3952ad7f2137a419058c82276be4
                                                                • Instruction ID: b5c976218307d2e1381e8cb5b95845b53b58bca90738b4a8aba6aaf5840bd138
                                                                • Opcode Fuzzy Hash: 2a0ef10c9c87fd122812cc3daeea518ef75f3952ad7f2137a419058c82276be4
                                                                • Instruction Fuzzy Hash: 5D41D036600208AFDB109F29CC95BEABBA9FF45364F148059F909AB291C774AD41DFE0
                                                                Function 00F9CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F9DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F9CF22,?), ref: 00F9DDFD
                                                                  • Part of subcall function 00F9DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F9CF22,?), ref: 00F9DE16
                                                                • lstrcmpiW.KERNEL32(?,?), ref: 00F9CF45
                                                                • MoveFileW.KERNEL32(?,?), ref: 00F9CF7F
                                                                • _wcslen.LIBCMT ref: 00F9D005
                                                                • _wcslen.LIBCMT ref: 00F9D01B
                                                                • SHFileOperationW.SHELL32(?), ref: 00F9D061
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                                • String ID: \*.*
                                                                • API String ID: 3164238972-1173974218
                                                                • Opcode ID: 44f0a99d364e1bc74ef17fc3219208d88c95d082609533be5bf813fa61762c59
                                                                • Instruction ID: 798038c7c8da9977500c7a0a1551f0061b0ee4cc95e207464b4c97a01ba858f4
                                                                • Opcode Fuzzy Hash: 44f0a99d364e1bc74ef17fc3219208d88c95d082609533be5bf813fa61762c59
                                                                • Instruction Fuzzy Hash: 0F415871D051185FEF12EBA4DD81EDDB7B8AF04384F1000E6E509E7141EA74A688DB50
                                                                Function 00FC2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00FC2E1C
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC2E4F
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC2E84
                                                                • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00FC2EB6
                                                                • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00FC2EE0
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC2EF1
                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FC2F0B
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: LongWindow$MessageSend
                                                                • String ID:
                                                                • API String ID: 2178440468-0
                                                                • Opcode ID: a6bac163865a9f5be888c63df0f3e06919d170a28ccf99a38b944aaf13c2a55c
                                                                • Instruction ID: 8cffeba59296894baebce81cd110e9f7d85ad5971e7da97e64dee41f5b893d1d
                                                                • Opcode Fuzzy Hash: a6bac163865a9f5be888c63df0f3e06919d170a28ccf99a38b944aaf13c2a55c
                                                                • Instruction Fuzzy Hash: 6D311931A04156AFDB61DF58DE86FA537E1FB4A720F150168F9449F2A1CB72EC40EB41
                                                                Function 00F97726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F97769
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F9778F
                                                                • SysAllocString.OLEAUT32(00000000), ref: 00F97792
                                                                • SysAllocString.OLEAUT32(?), ref: 00F977B0
                                                                • SysFreeString.OLEAUT32(?), ref: 00F977B9
                                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 00F977DE
                                                                • SysAllocString.OLEAUT32(?), ref: 00F977EC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                • String ID:
                                                                • API String ID: 3761583154-0
                                                                • Opcode ID: e3e9a554955950df7349da25d7dcee5dfface2d3589800f525f1eb3dc170591b
                                                                • Instruction ID: cc796317202ed4ff2e8db7fd06cc56a432131a937b43d5ef1d38b84e603ce071
                                                                • Opcode Fuzzy Hash: e3e9a554955950df7349da25d7dcee5dfface2d3589800f525f1eb3dc170591b
                                                                • Instruction Fuzzy Hash: 9F21C476A04319AFEF10EFE9CC89DBB77ACEB093647048025F908DB150D670DC45A7A1
                                                                Function 00F977FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F97842
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F97868
                                                                • SysAllocString.OLEAUT32(00000000), ref: 00F9786B
                                                                • SysAllocString.OLEAUT32 ref: 00F9788C
                                                                • SysFreeString.OLEAUT32 ref: 00F97895
                                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 00F978AF
                                                                • SysAllocString.OLEAUT32(?), ref: 00F978BD
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                • String ID:
                                                                • API String ID: 3761583154-0
                                                                • Opcode ID: 0b49dd91b6d6c8b58d105e4b4410f4c5d276e2501cd05cefd750f4405434278b
                                                                • Instruction ID: 897c6a86ecf36a18a5b75055c2d706635aae71ff2ecb935f3ba1f0e7d60c4c9d
                                                                • Opcode Fuzzy Hash: 0b49dd91b6d6c8b58d105e4b4410f4c5d276e2501cd05cefd750f4405434278b
                                                                • Instruction Fuzzy Hash: E4217731A14308AFEF10EFA8DC89DAA77ECFB097607148125F915CB1A1D674DC41DB64
                                                                Function 00FA04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetStdHandle.KERNEL32(0000000C), ref: 00FA04F2
                                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FA052E
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateHandlePipe
                                                                • String ID: nul
                                                                • API String ID: 1424370930-2873401336
                                                                • Opcode ID: a48ff1ec74a7bdbbc197a68f0ee333138bf94b1f32c0cb059dbcc114a097e150
                                                                • Instruction ID: f21d93a65fe0dc82b1eb36043876e90b48503e1c300d1c159a3db5e3d67f4d1e
                                                                • Opcode Fuzzy Hash: a48ff1ec74a7bdbbc197a68f0ee333138bf94b1f32c0cb059dbcc114a097e150
                                                                • Instruction Fuzzy Hash: 782191B5D003059FDB208F29EC05A9A7BB4AF46760F244A18E8A1D31E0DB709940EF60
                                                                Function 00FA05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetStdHandle.KERNEL32(000000F6), ref: 00FA05C6
                                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FA0601
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateHandlePipe
                                                                • String ID: nul
                                                                • API String ID: 1424370930-2873401336
                                                                • Opcode ID: 42503efe5c6855636095ae7789e8034aad8362f63c81a9c2e836c23228e6679d
                                                                • Instruction ID: df54424ff4cd0ed0065d456441b41f135855c0deb3ebef8f1fe7c4f48069cf96
                                                                • Opcode Fuzzy Hash: 42503efe5c6855636095ae7789e8034aad8362f63c81a9c2e836c23228e6679d
                                                                • Instruction Fuzzy Hash: FD2183B59003059FDB209F69AC05E9A77F4BF96734F200A19F9A1E73E0DB719860EB50
                                                                Function 00F6D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F6D7A3: _free.LIBCMT ref: 00F6D7CC
                                                                • _free.LIBCMT ref: 00F6D82D
                                                                  • Part of subcall function 00F629C8: HeapFree.KERNEL32(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
                                                                  • Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0
                                                                • _free.LIBCMT ref: 00F6D838
                                                                • _free.LIBCMT ref: 00F6D843
                                                                • _free.LIBCMT ref: 00F6D897
                                                                • _free.LIBCMT ref: 00F6D8A2
                                                                • _free.LIBCMT ref: 00F6D8AD
                                                                • _free.LIBCMT ref: 00F6D8B8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast
                                                                • String ID:
                                                                • API String ID: 776569668-0
                                                                • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                • Instruction ID: d650bb73ab1b75fc19b729ebf519ff975ed6d7710430088d82a6002db4b53f5d
                                                                • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                                • Instruction Fuzzy Hash: F4115B71B40B04AADA25BFB0CC47FCB7BFCAF40740F440825B299A6092DA69B505B662
                                                                Function 00F9DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F9DA74
                                                                • LoadStringW.USER32(00000000), ref: 00F9DA7B
                                                                • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F9DA91
                                                                • LoadStringW.USER32(00000000), ref: 00F9DA98
                                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F9DADC
                                                                Strings
                                                                • %s (%d) : ==> %s: %s %s, xrefs: 00F9DAB9
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: HandleLoadModuleString$Message
                                                                • String ID: %s (%d) : ==> %s: %s %s
                                                                • API String ID: 4072794657-3128320259
                                                                • Opcode ID: 23d4a50ed12875d37a6ab0c047a63d2119aab1a315a33966e0655725abe4506d
                                                                • Instruction ID: df3d85e96833a06ef0b816e6c9763479e904a114061c589aa2b3f0e94be33267
                                                                • Opcode Fuzzy Hash: 23d4a50ed12875d37a6ab0c047a63d2119aab1a315a33966e0655725abe4506d
                                                                • Instruction Fuzzy Hash: 280117F650020C7FEB11EBA49E8AEE7766CDB04701F404455F749E2041EA749E856F75
                                                                Function 00FA096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InterlockedExchange.KERNEL32(0106D270,0106D270), ref: 00FA097B
                                                                • EnterCriticalSection.KERNEL32(0106D250,00000000), ref: 00FA098D
                                                                • TerminateThread.KERNEL32(?,000001F6), ref: 00FA099B
                                                                • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00FA09A9
                                                                • CloseHandle.KERNEL32(?), ref: 00FA09B8
                                                                • InterlockedExchange.KERNEL32(0106D270,000001F6), ref: 00FA09C8
                                                                • LeaveCriticalSection.KERNEL32(0106D250), ref: 00FA09CF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                • String ID:
                                                                • API String ID: 3495660284-0
                                                                • Opcode ID: 5a2c2b89bcbfcde72cf81ccc04067a09d1a0f38b106c0385c0904bc696f4baed
                                                                • Instruction ID: b13c9852d3bcff426178ce099224bb39a5ff3944b79f181bebb6ce438f9e4f68
                                                                • Opcode Fuzzy Hash: 5a2c2b89bcbfcde72cf81ccc04067a09d1a0f38b106c0385c0904bc696f4baed
                                                                • Instruction Fuzzy Hash: 5DF01972442A06BBD7415BA4EF8AED6BA39FF06712F402025F206928A0CB759465EFD0
                                                                Function 00F35D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetClientRect.USER32(?,?), ref: 00F35D30
                                                                • GetWindowRect.USER32(?,?), ref: 00F35D71
                                                                • ScreenToClient.USER32(?,?), ref: 00F35D99
                                                                • GetClientRect.USER32(?,?), ref: 00F35ED7
                                                                • GetWindowRect.USER32(?,?), ref: 00F35EF8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Rect$Client$Window$Screen
                                                                • String ID:
                                                                • API String ID: 1296646539-0
                                                                • Opcode ID: 69886b21d9eb3343aab4e6884466c18856ac9cdef58e31bb6452c2d0665d696a
                                                                • Instruction ID: 0fcf1b24f651401454c33e10509d9f3dc5aa27d8b27c127de2a66b2f337702f8
                                                                • Opcode Fuzzy Hash: 69886b21d9eb3343aab4e6884466c18856ac9cdef58e31bb6452c2d0665d696a
                                                                • Instruction Fuzzy Hash: 0DB17A35A0074ADBDB10CFA9C5807EEB7F1FF48320F14841AE8A9D7250DB34AA91EB55
                                                                Function 00F601B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __allrem.LIBCMT ref: 00F600BA
                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F600D6
                                                                • __allrem.LIBCMT ref: 00F600ED
                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F6010B
                                                                • __allrem.LIBCMT ref: 00F60122
                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F60140
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                • String ID:
                                                                • API String ID: 1992179935-0
                                                                • Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                                • Instruction ID: 58678b1a9af3c042052dfda87c743ecbaf68b50661eb5899ee5a7509716764ac
                                                                • Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                                • Instruction Fuzzy Hash: 0581F672A00706ABE7249F78CC41B6B73E9AF42334F24463AF951D7681EB74D948B790
                                                                Function 00FB1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00FB3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00FB101C,00000000,?,?,00000000), ref: 00FB3195
                                                                • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00FB1DC0
                                                                • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00FB1DE1
                                                                • WSAGetLastError.WSOCK32 ref: 00FB1DF2
                                                                • inet_ntoa.WSOCK32(?), ref: 00FB1E8C
                                                                • htons.WSOCK32(?,?,?,?,?), ref: 00FB1EDB
                                                                • _strlen.LIBCMT ref: 00FB1F35
                                                                  • Part of subcall function 00F939E8: _strlen.LIBCMT ref: 00F939F2
                                                                  • Part of subcall function 00F36D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00F4CF58,?,?,?), ref: 00F36DBA
                                                                  • Part of subcall function 00F36D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00F4CF58,?,?,?), ref: 00F36DED
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
                                                                • String ID:
                                                                • API String ID: 1923757996-0
                                                                • Opcode ID: 96795e0cfde8e18fbc53c8d597c010dcbb8c5dbc9a3aa6db2eff1262dacfacbe
                                                                • Instruction ID: f411383df65eccaf937b0551690ec13984b6095cd45aa47dce3ac0df2f8387cd
                                                                • Opcode Fuzzy Hash: 96795e0cfde8e18fbc53c8d597c010dcbb8c5dbc9a3aa6db2eff1262dacfacbe
                                                                • Instruction Fuzzy Hash: 55A1E031604300AFC320DF21CCA5F6A7BA5BF84328F94894CF5565B2A2CB75ED46EB91
                                                                Function 00F661FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00F582D9,00F582D9,?,?,?,00F6644F,00000001,00000001,8BE85006), ref: 00F66258
                                                                • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00F6644F,00000001,00000001,8BE85006,?,?,?), ref: 00F662DE
                                                                • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F663D8
                                                                • __freea.LIBCMT ref: 00F663E5
                                                                  • Part of subcall function 00F63820: RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852
                                                                • __freea.LIBCMT ref: 00F663EE
                                                                • __freea.LIBCMT ref: 00F66413
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                • String ID:
                                                                • API String ID: 1414292761-0
                                                                • Opcode ID: f6a5a3dfacb4b755b3fbdcac2cea45d04834f8cc7e21b20d569e6b5817b809f9
                                                                • Instruction ID: 661cffd7ce330cc872c56ed4ce8c86223a28083d6fdd07e81600f501186a2267
                                                                • Opcode Fuzzy Hash: f6a5a3dfacb4b755b3fbdcac2cea45d04834f8cc7e21b20d569e6b5817b809f9
                                                                • Instruction Fuzzy Hash: AE51C372A00216ABDF258F64DD82EBF77A9EF44760F15462AFC05D7240EB34DC44E6A0
                                                                Function 00FBBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00FBC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FBB6AE,?,?), ref: 00FBC9B5
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBC9F1
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA68
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA9E
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBBCCA
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FBBD25
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00FBBD6A
                                                                • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00FBBD99
                                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00FBBDF3
                                                                • RegCloseKey.ADVAPI32(?), ref: 00FBBDFF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                • String ID:
                                                                • API String ID: 1120388591-0
                                                                • Opcode ID: 4b80e4505a4ad73e908c20f72084e0007f3cba230f8d06c092a8a168b5992322
                                                                • Instruction ID: 7d869a2b9a01da0c2bd4e7deedfe650e886c982b2a96a3cd6fa4d36ca040e6bd
                                                                • Opcode Fuzzy Hash: 4b80e4505a4ad73e908c20f72084e0007f3cba230f8d06c092a8a168b5992322
                                                                • Instruction Fuzzy Hash: E381BC71608241AFC714DF25C881E6ABBE5FF84318F14895CF4998B2A2CB75ED05EF92
                                                                Function 00F8F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(00000035), ref: 00F8F7B9
                                                                • SysAllocString.OLEAUT32(00000001), ref: 00F8F860
                                                                • VariantCopy.OLEAUT32(00F8FA64,00000000), ref: 00F8F889
                                                                • VariantClear.OLEAUT32(00F8FA64), ref: 00F8F8AD
                                                                • VariantCopy.OLEAUT32(00F8FA64,00000000), ref: 00F8F8B1
                                                                • VariantClear.OLEAUT32(?), ref: 00F8F8BB
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearCopy$AllocInitString
                                                                • String ID:
                                                                • API String ID: 3859894641-0
                                                                • Opcode ID: 337eafffe8e973b675801510044c2aeaac9c2ee85951afe8bcb784aaa056e466
                                                                • Instruction ID: db98c6b59cd22b95452b3a137c449cc956cb3b4e92d049a2c02fd263c1ece836
                                                                • Opcode Fuzzy Hash: 337eafffe8e973b675801510044c2aeaac9c2ee85951afe8bcb784aaa056e466
                                                                • Instruction Fuzzy Hash: D751D932A00310BEDF14BF65DC96BA9B3A4EF45320F249466E905DF291DB748C48E7A6
                                                                Function 00FA910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625
                                                                  • Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A
                                                                • GetOpenFileNameW.COMDLG32(00000058), ref: 00FA94E5
                                                                • _wcslen.LIBCMT ref: 00FA9506
                                                                • _wcslen.LIBCMT ref: 00FA952D
                                                                • GetSaveFileNameW.COMDLG32(00000058), ref: 00FA9585
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$FileName$OpenSave
                                                                • String ID: X
                                                                • API String ID: 83654149-3081909835
                                                                • Opcode ID: bc64f831e3d0178b8f522815c7539c694a27af3e3b6f67b476e173031fd7ecd5
                                                                • Instruction ID: fb3f2075051f50f42c67a6834994d7e0d2bb76a5c31450503cbe2922ea8c72be
                                                                • Opcode Fuzzy Hash: bc64f831e3d0178b8f522815c7539c694a27af3e3b6f67b476e173031fd7ecd5
                                                                • Instruction Fuzzy Hash: 4EE1A4719083409FC724DF24C881B6AB7E4BF85324F08856DF8899B2A2DB75ED05DB92
                                                                Function 00F4920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2
                                                                • BeginPaint.USER32(?,?,?), ref: 00F49241
                                                                • GetWindowRect.USER32(?,?), ref: 00F492A5
                                                                • ScreenToClient.USER32(?,?), ref: 00F492C2
                                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00F492D3
                                                                • EndPaint.USER32(?,?,?,?,?), ref: 00F49321
                                                                • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00F871EA
                                                                  • Part of subcall function 00F49339: BeginPath.GDI32(00000000), ref: 00F49357
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                                                • String ID:
                                                                • API String ID: 3050599898-0
                                                                • Opcode ID: 0c246fef1cc3a881da84d4e74ebeea32ddd29bca5d46d24695972a2acfcb03e3
                                                                • Instruction ID: 545b6b04968487f833eca11160505099abafa373a5eea883581d5b3943a866c9
                                                                • Opcode Fuzzy Hash: 0c246fef1cc3a881da84d4e74ebeea32ddd29bca5d46d24695972a2acfcb03e3
                                                                • Instruction Fuzzy Hash: 5B419131608301AFD721EF24CC89FBB7BA8EF46320F140269F998872E1C7759945EB61
                                                                Function 00FA07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InterlockedExchange.KERNEL32(?,000001F5), ref: 00FA080C
                                                                • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00FA0847
                                                                • EnterCriticalSection.KERNEL32(?), ref: 00FA0863
                                                                • LeaveCriticalSection.KERNEL32(?), ref: 00FA08DC
                                                                • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00FA08F3
                                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00FA0921
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                                • String ID:
                                                                • API String ID: 3368777196-0
                                                                • Opcode ID: d8f2a14e9027acb0718a1321f0ab03cba7d665afbe7d9c581bb0aada638e7374
                                                                • Instruction ID: 98d948fc84e3f77e3259e5ac559735b81e95e7d384df232913599d448724e8d6
                                                                • Opcode Fuzzy Hash: d8f2a14e9027acb0718a1321f0ab03cba7d665afbe7d9c581bb0aada638e7374
                                                                • Instruction Fuzzy Hash: B7417C71900209EFDF149F54DC85AAAB7B8FF05310F1440A9ED049B297DB34DE65EBA4
                                                                Function 00FC81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ShowWindow.USER32(?,00000000,?,?,?,?,00F86C2A), ref: 00FC824C
                                                                • EnableWindow.USER32(?,00000000), ref: 00FC8272
                                                                • ShowWindow.USER32(?,00000000,?,?,?,?,00F86C2A), ref: 00FC82D1
                                                                • ShowWindow.USER32(?,00000004,?,?,?,?,00F86C2A), ref: 00FC82E5
                                                                • EnableWindow.USER32(?,00000001), ref: 00FC830B
                                                                • SendMessageW.USER32(?,0000130C,?,00000000), ref: 00FC832F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Show$Enable$MessageSend
                                                                • String ID:
                                                                • API String ID: 642888154-0
                                                                • Opcode ID: 9f2bfdf7c161bbfc78181579a81a0680b54aad369af3a07a06f4faaf45f96cbc
                                                                • Instruction ID: ce1ed3d66f1645423ede8ba1bd3d08d3c20f4774d7f754127d66d38f2df23064
                                                                • Opcode Fuzzy Hash: 9f2bfdf7c161bbfc78181579a81a0680b54aad369af3a07a06f4faaf45f96cbc
                                                                • Instruction Fuzzy Hash: E341B934A01645EFDB22CF15CA8AFE47BE0FB06764F18516DE5484F262CB32A842EF50
                                                                Function 00F94C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • IsWindowVisible.USER32(?), ref: 00F94C95
                                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00F94CB2
                                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00F94CEA
                                                                • _wcslen.LIBCMT ref: 00F94D08
                                                                • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00F94D10
                                                                • _wcsstr.LIBVCRUNTIME ref: 00F94D1A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                                • String ID:
                                                                • API String ID: 72514467-0
                                                                • Opcode ID: dbb44bdcb84ff961c2648d0aa2065016a233f6cc218e96e5daad4832e5c998c1
                                                                • Instruction ID: ca75e8ab7f81fc78c8bc3ce2b6c9a834c93541015d93d3956fabb2b3480534a4
                                                                • Opcode Fuzzy Hash: dbb44bdcb84ff961c2648d0aa2065016a233f6cc218e96e5daad4832e5c998c1
                                                                • Instruction Fuzzy Hash: B4212936A042047BFF155B35ED0AE7B7F9CDF55760F10402AF809CB191EA65EC01B6A0
                                                                Function 00FA581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F33A97,?,?,00F32E7F,?,?,?,00000000), ref: 00F33AC2
                                                                • _wcslen.LIBCMT ref: 00FA587B
                                                                • CoInitialize.OLE32(00000000), ref: 00FA5995
                                                                • CoCreateInstance.OLE32(00FCFCF8,00000000,00000001,00FCFB68,?), ref: 00FA59AE
                                                                • CoUninitialize.OLE32 ref: 00FA59CC
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                                • String ID: .lnk
                                                                • API String ID: 3172280962-24824748
                                                                • Opcode ID: 696904c6f9f25b335417546040b45a6984a56e7b00d98044bad99af8be55b215
                                                                • Instruction ID: 398e7affa00d16a19d5dc451be9adb73797cd8db24a4da124c3b4d8a889c699c
                                                                • Opcode Fuzzy Hash: 696904c6f9f25b335417546040b45a6984a56e7b00d98044bad99af8be55b215
                                                                • Instruction Fuzzy Hash: 0FD166B5A047019FC714DF25C880A2ABBE5FF8AB20F14885DF8899B361D735EC45DB92
                                                                Function 00F9175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F90FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F90FCA
                                                                  • Part of subcall function 00F90FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F90FD6
                                                                  • Part of subcall function 00F90FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F90FE5
                                                                  • Part of subcall function 00F90FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F90FEC
                                                                  • Part of subcall function 00F90FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F91002
                                                                • GetLengthSid.ADVAPI32(?,00000000,00F91335), ref: 00F917AE
                                                                • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00F917BA
                                                                • HeapAlloc.KERNEL32(00000000), ref: 00F917C1
                                                                • CopySid.ADVAPI32(00000000,00000000,?), ref: 00F917DA
                                                                • GetProcessHeap.KERNEL32(00000000,00000000,00F91335), ref: 00F917EE
                                                                • HeapFree.KERNEL32(00000000), ref: 00F917F5
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                                • String ID:
                                                                • API String ID: 3008561057-0
                                                                • Opcode ID: df23123833eaaf32221ddbd2587828e9b75b719c07658df5561bf436fab36b5e
                                                                • Instruction ID: 2d5236ad9d3c61401fbf0c4ffd48a6434aeefe81b675b53bc36e4f5c3c6a62e0
                                                                • Opcode Fuzzy Hash: df23123833eaaf32221ddbd2587828e9b75b719c07658df5561bf436fab36b5e
                                                                • Instruction Fuzzy Hash: 7911AC3290020AFFEF119FA5CD4AFAF7BA9FB41365F144028F44597221C739A940EBA0
                                                                Function 00F914CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00F914FF
                                                                • OpenProcessToken.ADVAPI32(00000000), ref: 00F91506
                                                                • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00F91515
                                                                • CloseHandle.KERNEL32(00000004), ref: 00F91520
                                                                • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F9154F
                                                                • DestroyEnvironmentBlock.USERENV(00000000), ref: 00F91563
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                • String ID:
                                                                • API String ID: 1413079979-0
                                                                • Opcode ID: fa42eaaf1faaeb196f894ccd1dafbe2b027d180b4e63cc8b23bd98b57a74b9d6
                                                                • Instruction ID: b9444e9c2cc4f2321ac5cd28b7d10830b69c4d2d6b8b850e792eac43d4afa2b1
                                                                • Opcode Fuzzy Hash: fa42eaaf1faaeb196f894ccd1dafbe2b027d180b4e63cc8b23bd98b57a74b9d6
                                                                • Instruction Fuzzy Hash: C5111A7250024EABEF12CF98DE49FDA7BA9FF49754F054025FA05A2060C3768E61AB60
                                                                Function 00F53382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLastError.KERNEL32(?,?,00F53379,00F52FE5), ref: 00F53390
                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F5339E
                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F533B7
                                                                • SetLastError.KERNEL32(00000000,?,00F53379,00F52FE5), ref: 00F53409
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLastValue___vcrt_
                                                                • String ID:
                                                                • API String ID: 3852720340-0
                                                                • Opcode ID: a175758009a3e1fd59792d130facd9f9cec609ef305f0739054c67d7c1d832a8
                                                                • Instruction ID: 8bfb04a77b69eb68bb435842096da64f7d912c9ac7fbddf3628a0db9fb5e17e4
                                                                • Opcode Fuzzy Hash: a175758009a3e1fd59792d130facd9f9cec609ef305f0739054c67d7c1d832a8
                                                                • Instruction Fuzzy Hash: B301B533A09329AEE615277C7D86A663E58DF053FB720022DFE10851F1EF554D0AB588
                                                                Function 00F62D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLastError.KERNEL32(?,?,00F65686,00F73CD6,?,00000000,?,00F65B6A,?,?,?,?,?,00F5E6D1,?,00FF8A48), ref: 00F62D78
                                                                • _free.LIBCMT ref: 00F62DAB
                                                                • _free.LIBCMT ref: 00F62DD3
                                                                • SetLastError.KERNEL32(00000000,?,?,?,?,00F5E6D1,?,00FF8A48,00000010,00F34F4A,?,?,00000000,00F73CD6), ref: 00F62DE0
                                                                • SetLastError.KERNEL32(00000000,?,?,?,?,00F5E6D1,?,00FF8A48,00000010,00F34F4A,?,?,00000000,00F73CD6), ref: 00F62DEC
                                                                • _abort.LIBCMT ref: 00F62DF2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$_free$_abort
                                                                • String ID:
                                                                • API String ID: 3160817290-0
                                                                • Opcode ID: 29c14df24efc6988d67913e1412dc27dbce23d842f88620da8bffbf7be993608
                                                                • Instruction ID: 0450a4dc0566e9defa97b2e03db9d944f721e227956adf8889668de538f9fe6b
                                                                • Opcode Fuzzy Hash: 29c14df24efc6988d67913e1412dc27dbce23d842f88620da8bffbf7be993608
                                                                • Instruction Fuzzy Hash: 43F0C832E05E1527C3923739BD16F6E356DAFC27B1F250519F828931D6EF28880272A0
                                                                Function 00FC8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F49693
                                                                  • Part of subcall function 00F49639: SelectObject.GDI32(?,00000000), ref: 00F496A2
                                                                  • Part of subcall function 00F49639: BeginPath.GDI32(?), ref: 00F496B9
                                                                  • Part of subcall function 00F49639: SelectObject.GDI32(?,00000000), ref: 00F496E2
                                                                • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00FC8A4E
                                                                • LineTo.GDI32(?,00000003,00000000), ref: 00FC8A62
                                                                • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00FC8A70
                                                                • LineTo.GDI32(?,00000000,00000003), ref: 00FC8A80
                                                                • EndPath.GDI32(?), ref: 00FC8A90
                                                                • StrokePath.GDI32(?), ref: 00FC8AA0
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                • String ID:
                                                                • API String ID: 43455801-0
                                                                • Opcode ID: 859806fb41bc43775542a447cae9e32963f06a0985b1308590483ff211a33c39
                                                                • Instruction ID: f850df26a5e1e46ad96711fc6d2467278d67d361d4d15f59cba1a0654929e3b9
                                                                • Opcode Fuzzy Hash: 859806fb41bc43775542a447cae9e32963f06a0985b1308590483ff211a33c39
                                                                • Instruction Fuzzy Hash: AE11097644010DFFDB129F90DD89EAA7F6CEB08390F048016FA599A1A1C7729D55EFA0
                                                                Function 00F951FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDC.USER32(00000000), ref: 00F95218
                                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 00F95229
                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F95230
                                                                • ReleaseDC.USER32(00000000,00000000), ref: 00F95238
                                                                • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00F9524F
                                                                • MulDiv.KERNEL32(000009EC,00000001,?), ref: 00F95261
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CapsDevice$Release
                                                                • String ID:
                                                                • API String ID: 1035833867-0
                                                                • Opcode ID: 10969ddb90bba011222401d2698ee146da33a389b64b186db9b49753af71e373
                                                                • Instruction ID: ca30bc7bf841b3472f23890a763e62255cb6f0aff9eff6ab1ce47ef195f88b6d
                                                                • Opcode Fuzzy Hash: 10969ddb90bba011222401d2698ee146da33a389b64b186db9b49753af71e373
                                                                • Instruction Fuzzy Hash: BB018475E01708BBEF105BA59D4AE4EBF78EB44751F044065FA08A7280D6709800DBA0
                                                                Function 00F31BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F31BF4
                                                                • MapVirtualKeyW.USER32(00000010,00000000), ref: 00F31BFC
                                                                • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F31C07
                                                                • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F31C12
                                                                • MapVirtualKeyW.USER32(00000011,00000000), ref: 00F31C1A
                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00F31C22
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Virtual
                                                                • String ID:
                                                                • API String ID: 4278518827-0
                                                                • Opcode ID: 8557dd3bb649fae0f15c8831364d3896f253883c04ae49aedb72e8a983dba543
                                                                • Instruction ID: 37f0e19f2c8846bbb16a2589e9272c1a2b61fb8f43e42a892d8f83bb0facc490
                                                                • Opcode Fuzzy Hash: 8557dd3bb649fae0f15c8831364d3896f253883c04ae49aedb72e8a983dba543
                                                                • Instruction Fuzzy Hash: A50167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BE15C4BA42C7F5A864CBE5
                                                                Function 00F9EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F9EB30
                                                                • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F9EB46
                                                                • GetWindowThreadProcessId.USER32(?,?), ref: 00F9EB55
                                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F9EB64
                                                                • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F9EB6E
                                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F9EB75
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                • String ID:
                                                                • API String ID: 839392675-0
                                                                • Opcode ID: b277e2c5883c5243653607a608f67d736f93fe945957a66b9aacd779d35e36f8
                                                                • Instruction ID: faf9e1b729c313b92347992b1ae5ad31732b55c6b5687c1153e93032cd32690c
                                                                • Opcode Fuzzy Hash: b277e2c5883c5243653607a608f67d736f93fe945957a66b9aacd779d35e36f8
                                                                • Instruction Fuzzy Hash: 29F03A72A4015CBBE7215B639E0EEEF3A7CEFCAB15F000158F609D2091D7A15A01EAF5
                                                                Function 00F91874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F9187F
                                                                • UnloadUserProfile.USERENV(?,?), ref: 00F9188B
                                                                • CloseHandle.KERNEL32(?), ref: 00F91894
                                                                • CloseHandle.KERNEL32(?), ref: 00F9189C
                                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 00F918A5
                                                                • HeapFree.KERNEL32(00000000), ref: 00F918AC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                • String ID:
                                                                • API String ID: 146765662-0
                                                                • Opcode ID: 3386af84c6987b7fcaf6d9dcdab1511a72c274ea4820873ca94364af8a9bf220
                                                                • Instruction ID: ef155633d59e276a5af5091e68882571fa7643a5aa355976980335e276226bd7
                                                                • Opcode Fuzzy Hash: 3386af84c6987b7fcaf6d9dcdab1511a72c274ea4820873ca94364af8a9bf220
                                                                • Instruction Fuzzy Hash: 87E0ED36404509BBDB015FA2EE0DD05BF39FF497217108220F22982471CB335420EF90
                                                                Function 00F9C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625
                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F9C6EE
                                                                • _wcslen.LIBCMT ref: 00F9C735
                                                                • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F9C79C
                                                                • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F9C7CA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ItemMenu$Info_wcslen$Default
                                                                • String ID: 0
                                                                • API String ID: 1227352736-4108050209
                                                                • Opcode ID: 5376eb12bc8e4eadc4b714741cb74867512c0b78fec783f66376d344340731fe
                                                                • Instruction ID: f92fb6b11d25ac4061ab42134f943a575ac20d3e6ea1e49fd1e1279f7d25fc3e
                                                                • Opcode Fuzzy Hash: 5376eb12bc8e4eadc4b714741cb74867512c0b78fec783f66376d344340731fe
                                                                • Instruction Fuzzy Hash: D551AF71A043009BEB159F68C985B6B77E4AF89320F040A2DF999D31D1DB74D908EBD3
                                                                Function 00F9719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F97206
                                                                • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00F9723C
                                                                • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00F9724D
                                                                • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00F972CF
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$AddressCreateInstanceProc
                                                                • String ID: DllGetClassObject
                                                                • API String ID: 753597075-1075368562
                                                                • Opcode ID: c25a12262ec1d93283289550d1a49275569e08ecbbe2edb180d77107b3c7426e
                                                                • Instruction ID: 4665484bdf1e05574b8ed9f8ddc36e3201d0f12831aaae9a7737fbd19665e359
                                                                • Opcode Fuzzy Hash: c25a12262ec1d93283289550d1a49275569e08ecbbe2edb180d77107b3c7426e
                                                                • Instruction Fuzzy Hash: C4418D71A24304EFEF15DF54C885B9A7BA9EF44710F2480A9BD099F24AD7B0D944EFA0
                                                                Function 00FC3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FC3E35
                                                                • IsMenu.USER32(?), ref: 00FC3E4A
                                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FC3E92
                                                                • DrawMenuBar.USER32 ref: 00FC3EA5
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$Item$DrawInfoInsert
                                                                • String ID: 0
                                                                • API String ID: 3076010158-4108050209
                                                                • Opcode ID: 05cf3527c98872804c4296126f5d708a012feff35e43a020f6f12784f058ea2f
                                                                • Instruction ID: 65ad72ca42df5c3d2570dcd54e174e692ee7b4189882b3e354946ebd2cd6a204
                                                                • Opcode Fuzzy Hash: 05cf3527c98872804c4296126f5d708a012feff35e43a020f6f12784f058ea2f
                                                                • Instruction Fuzzy Hash: 63414A75A0020AAFDB10DF50D985EAABBB5FF493A4F04812DF90597250D734EE49EFA0
                                                                Function 00F91DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA
                                                                • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00F91E66
                                                                • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00F91E79
                                                                • SendMessageW.USER32(?,00000189,?,00000000), ref: 00F91EA9
                                                                  • Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$_wcslen$ClassName
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 2081771294-1403004172
                                                                • Opcode ID: 245785c81cfc9c7048c875170664406eb8fcb5be5839075720e4c64cf791e786
                                                                • Instruction ID: 681a47ab4e912ac555ece12a0ece61b1a8561f213f8148c9a79e6d1e87b69cf1
                                                                • Opcode Fuzzy Hash: 245785c81cfc9c7048c875170664406eb8fcb5be5839075720e4c64cf791e786
                                                                • Instruction Fuzzy Hash: 4C213B75A00109BFEF14AB64DD46CFFB7B8EF45360F104129F919A71E1DB785909B620
                                                                Function 00F54D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00F54D1E,00F628E9,?,00F54CBE,00F628E9,00FF88B8,0000000C,00F54E15,00F628E9,00000002), ref: 00F54D8D
                                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F54DA0
                                                                • FreeLibrary.KERNEL32(00000000,?,?,?,00F54D1E,00F628E9,?,00F54CBE,00F628E9,00FF88B8,0000000C,00F54E15,00F628E9,00000002,00000000), ref: 00F54DC3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                • String ID: CorExitProcess$mscoree.dll
                                                                • API String ID: 4061214504-1276376045
                                                                • Opcode ID: e51c13866f658861d9d2873d5f43be678a4299c399d35df78ead9835ba72d9f5
                                                                • Instruction ID: 12350ae1fd9e3c98157d1d052510587eafdf9d2dd3ca097311f0c99613e7c113
                                                                • Opcode Fuzzy Hash: e51c13866f658861d9d2873d5f43be678a4299c399d35df78ead9835ba72d9f5
                                                                • Instruction Fuzzy Hash: 7BF0813090020CABDB109B90DD0AFADBBB5EF04716F040155ED09A3250CF349984EAD1
                                                                Function 00F34E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F34EDD,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E9C
                                                                • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F34EAE
                                                                • FreeLibrary.KERNEL32(00000000,?,?,00F34EDD,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34EC0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Library$AddressFreeLoadProc
                                                                • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                • API String ID: 145871493-3689287502
                                                                • Opcode ID: 09484a0c0c73b445ebc1331bc67daf69b3493894139f3d7dc65df07184c2418c
                                                                • Instruction ID: b215839a817e5f5c46ce1eb0e0df179e8000a55ac2bb1b41372e909a1b840b8f
                                                                • Opcode Fuzzy Hash: 09484a0c0c73b445ebc1331bc67daf69b3493894139f3d7dc65df07184c2418c
                                                                • Instruction Fuzzy Hash: 98E08635E015225BD22117266C1AF6B7554AFC1B72B0D0115FD08D3120DB60ED4260E1
                                                                Function 00F34E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F73CDE,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E62
                                                                • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F34E74
                                                                • FreeLibrary.KERNEL32(00000000,?,?,00F73CDE,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E87
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Library$AddressFreeLoadProc
                                                                • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                • API String ID: 145871493-1355242751
                                                                • Opcode ID: f45ff7c2d87c046ac400204faae754e08b896d94e639111b7c70538ed378b6ae
                                                                • Instruction ID: 8728d81927d4be91d1e1972a42dc781d1ec228600e57f7cdcfc1caa6b9e10817
                                                                • Opcode Fuzzy Hash: f45ff7c2d87c046ac400204faae754e08b896d94e639111b7c70538ed378b6ae
                                                                • Instruction Fuzzy Hash: C0D0C232D026225786221B26AC0AE8B3A18AF81F3530D0115F908A3114CF20ED42B1D0
                                                                Function 00FA2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FA2C05
                                                                • DeleteFileW.KERNEL32(?), ref: 00FA2C87
                                                                • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00FA2C9D
                                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FA2CAE
                                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FA2CC0
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: File$Delete$Copy
                                                                • String ID:
                                                                • API String ID: 3226157194-0
                                                                • Opcode ID: b3f2a1d668ef16389e5dabf06813ba3f01045c57ba4e35a8dbc21e47ac1d9b1a
                                                                • Instruction ID: fe7839791b44103da15b4b153938eea9cc7893b71495bcd9b1093cebd4b19357
                                                                • Opcode Fuzzy Hash: b3f2a1d668ef16389e5dabf06813ba3f01045c57ba4e35a8dbc21e47ac1d9b1a
                                                                • Instruction Fuzzy Hash: AFB170B2E00119ABDF24DFA8CC85EDEB77DEF49350F0040A6FA09E7151EA349A449F61
                                                                Function 00FBA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentProcessId.KERNEL32 ref: 00FBA427
                                                                • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00FBA435
                                                                • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00FBA468
                                                                • CloseHandle.KERNEL32(?), ref: 00FBA63D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$CloseCountersCurrentHandleOpen
                                                                • String ID:
                                                                • API String ID: 3488606520-0
                                                                • Opcode ID: ea486416fbdad2b46f374eec08bf5848d1542ae76db1c3ecec7ddd8fc44a0bae
                                                                • Instruction ID: 44cda2fed4d5aa9d6418713f416045908ba8535090108cd479edfeb33c9e1bde
                                                                • Opcode Fuzzy Hash: ea486416fbdad2b46f374eec08bf5848d1542ae76db1c3ecec7ddd8fc44a0bae
                                                                • Instruction Fuzzy Hash: 4CA1A271604300AFD720DF25C886F2AB7E5AF44724F14881DFA9A9B392DB74EC419F92
                                                                Function 00F9E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F9DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F9CF22,?), ref: 00F9DDFD
                                                                  • Part of subcall function 00F9DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F9CF22,?), ref: 00F9DE16
                                                                  • Part of subcall function 00F9E199: GetFileAttributesW.KERNEL32(?,00F9CF95), ref: 00F9E19A
                                                                • lstrcmpiW.KERNEL32(?,?), ref: 00F9E473
                                                                • MoveFileW.KERNEL32(?,?), ref: 00F9E4AC
                                                                • _wcslen.LIBCMT ref: 00F9E5EB
                                                                • _wcslen.LIBCMT ref: 00F9E603
                                                                • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00F9E650
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                                • String ID:
                                                                • API String ID: 3183298772-0
                                                                • Opcode ID: ce8a98f9d61d7508ecd2e7261a222bde4605937f2eb7413e9f0ecb4a19a7a268
                                                                • Instruction ID: 309144dd3c8ce6b9aa4ac0b8fab9c391aa56b027abedbcf6f232142fd57ce621
                                                                • Opcode Fuzzy Hash: ce8a98f9d61d7508ecd2e7261a222bde4605937f2eb7413e9f0ecb4a19a7a268
                                                                • Instruction Fuzzy Hash: 9D5192B24083459BDB24DBA4DC819DF73ECAF84350F00491EF689D3191EF79A588D766
                                                                Function 00FBB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00FBC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FBB6AE,?,?), ref: 00FBC9B5
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBC9F1
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA68
                                                                  • Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA9E
                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBBAA5
                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FBBB00
                                                                • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00FBBB63
                                                                • RegCloseKey.ADVAPI32(?,?), ref: 00FBBBA6
                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00FBBBB3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                                • String ID:
                                                                • API String ID: 826366716-0
                                                                • Opcode ID: 8803b01100614447e3c23928a40a54c009a41ff2509bc314cc81f8a55ff01e59
                                                                • Instruction ID: d34bfbb8ca028ca833a4bc876bb5b18a722eacdc8eb755b9afc87e43a2bf7cff
                                                                • Opcode Fuzzy Hash: 8803b01100614447e3c23928a40a54c009a41ff2509bc314cc81f8a55ff01e59
                                                                • Instruction Fuzzy Hash: D961C031608201AFC314DF15C891E6ABBE9FF84318F14855CF4998B2A2CB75ED45EF92
                                                                Function 00F98BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • VariantInit.OLEAUT32(?), ref: 00F98BCD
                                                                • VariantClear.OLEAUT32 ref: 00F98C3E
                                                                • VariantClear.OLEAUT32 ref: 00F98C9D
                                                                • VariantClear.OLEAUT32(?), ref: 00F98D10
                                                                • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00F98D3B
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$Clear$ChangeInitType
                                                                • String ID:
                                                                • API String ID: 4136290138-0
                                                                • Opcode ID: 291cb3f6aecedb64109d19e0e41055d8679fbc140f1cd58d27088411cf332c3c
                                                                • Instruction ID: 632c99ed75b9ae2abd439d1b1f1db4e73cf0c7803dc2e67ab8c909231fbeac65
                                                                • Opcode Fuzzy Hash: 291cb3f6aecedb64109d19e0e41055d8679fbc140f1cd58d27088411cf332c3c
                                                                • Instruction Fuzzy Hash: AE515AB5A00219EFDB14CF68C894EAAB7F8FF89350B158559E909DB350E730E912CF90
                                                                Function 00FA8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00FA8BAE
                                                                • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00FA8BDA
                                                                • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00FA8C32
                                                                • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00FA8C57
                                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00FA8C5F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: PrivateProfile$SectionWrite$String
                                                                • String ID:
                                                                • API String ID: 2832842796-0
                                                                • Opcode ID: e3a2e27125163772b99c854d875d93bced24150582ae909aa20b894c3b2df9d9
                                                                • Instruction ID: 4caab79c85e38ea0b0c85e20ee5f7ac28c0ef68540cbf162fd9db3403921b898
                                                                • Opcode Fuzzy Hash: e3a2e27125163772b99c854d875d93bced24150582ae909aa20b894c3b2df9d9
                                                                • Instruction Fuzzy Hash: 46515C75A002189FCB14DF65C881E69BBF5FF49364F088058E849AB362CB35ED51EFA0
                                                                Function 00FB8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00FB8F40
                                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00FB8FD0
                                                                • GetProcAddress.KERNEL32(00000000,00000000), ref: 00FB8FEC
                                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00FB9032
                                                                • FreeLibrary.KERNEL32(00000000), ref: 00FB9052
                                                                  • Part of subcall function 00F4F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00FA1043,?,753CE610), ref: 00F4F6E6
                                                                  • Part of subcall function 00F4F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00F8FA64,00000000,00000000,?,?,00FA1043,?,753CE610,?,00F8FA64), ref: 00F4F70D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                                • String ID:
                                                                • API String ID: 666041331-0
                                                                • Opcode ID: 3d4fa56d8c05933ea2d8d3fca2d224b6fe95fa51da0125bfa52f429a7cfd8ec3
                                                                • Instruction ID: 00bb09037e7ba97529a196c3ebb94a5494ebce70c968f45d73665df09d9dc711
                                                                • Opcode Fuzzy Hash: 3d4fa56d8c05933ea2d8d3fca2d224b6fe95fa51da0125bfa52f429a7cfd8ec3
                                                                • Instruction Fuzzy Hash: 27515C35A04205DFCB10EF65C4949ADBBB1FF49364F088098E9099B362DB75ED86EF90
                                                                Function 00FC6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00FC6C33
                                                                • SetWindowLongW.USER32(?,000000EC,?), ref: 00FC6C4A
                                                                • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00FC6C73
                                                                • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00FAAB79,00000000,00000000), ref: 00FC6C98
                                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00FC6CC7
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Long$MessageSendShow
                                                                • String ID:
                                                                • API String ID: 3688381893-0
                                                                • Opcode ID: 312eada402ed8e009ee223a034f6da86f9da9a4dc7c01ee9cb50a097e028ece0
                                                                • Instruction ID: b1af642546ff78b5c768931054fd3d0dde7bff86df1ca3f81b2be8168dad400f
                                                                • Opcode Fuzzy Hash: 312eada402ed8e009ee223a034f6da86f9da9a4dc7c01ee9cb50a097e028ece0
                                                                • Instruction Fuzzy Hash: EC41D635A08105AFD724CF28CE56FA57BA5EB49361F15022CF899E73E1C371ED41EA90
                                                                Function 00F62051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _free
                                                                • String ID:
                                                                • API String ID: 269201875-0
                                                                • Opcode ID: 8fc6d05bf3c004f0ac263b6d92f9ae5c5b69f05f0e4fd748d9b62e99f74c0aa8
                                                                • Instruction ID: 1252ad06e9ae2c6491d5981706a9e4941cca49a26b06d9f260bf5a2816d51164
                                                                • Opcode Fuzzy Hash: 8fc6d05bf3c004f0ac263b6d92f9ae5c5b69f05f0e4fd748d9b62e99f74c0aa8
                                                                • Instruction Fuzzy Hash: A741D232E00604AFCB24DF78CD81A6DB7B5EF89724F154569EA15EB351DB31AD01EB80
                                                                Function 00F4912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCursorPos.USER32(?), ref: 00F49141
                                                                • ScreenToClient.USER32(00000000,?), ref: 00F4915E
                                                                • GetAsyncKeyState.USER32(00000001), ref: 00F49183
                                                                • GetAsyncKeyState.USER32(00000002), ref: 00F4919D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: AsyncState$ClientCursorScreen
                                                                • String ID:
                                                                • API String ID: 4210589936-0
                                                                • Opcode ID: c6dcd07f1e1abe0ab576f625aa98e7fb1a7a0f484a3a94a1f829852331aceb8c
                                                                • Instruction ID: dd7ffb77db66b8080dd88197b2aca3585f64e64ebf479c2d68b8cb13329303fb
                                                                • Opcode Fuzzy Hash: c6dcd07f1e1abe0ab576f625aa98e7fb1a7a0f484a3a94a1f829852331aceb8c
                                                                • Instruction Fuzzy Hash: 21414131A0861AABDF15AF64C848BEEBB74FB45334F244219E829A7290C7746950EB91
                                                                Function 00FA3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetInputState.USER32 ref: 00FA38CB
                                                                • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00FA3922
                                                                • TranslateMessage.USER32(?), ref: 00FA394B
                                                                • DispatchMessageW.USER32(?), ref: 00FA3955
                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FA3966
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                                • String ID:
                                                                • API String ID: 2256411358-0
                                                                • Opcode ID: b4976348c6d576d258c91ed9e9b385b00c209ad7212622d5b3d777b492cdc689
                                                                • Instruction ID: a8222961002ed6795e81dc3d54faa6a617179952d8b0aef25fde84b9affabc81
                                                                • Opcode Fuzzy Hash: b4976348c6d576d258c91ed9e9b385b00c209ad7212622d5b3d777b492cdc689
                                                                • Instruction Fuzzy Hash: ED31C6B1D04345AFEB36CB34D849BB737A9EB0B314F04455DF49682190E3B9D684EB11
                                                                Function 00FACF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00FACF38
                                                                • InternetReadFile.WININET(?,00000000,?,?), ref: 00FACF6F
                                                                • GetLastError.KERNEL32(?,00000000,?,?,?,00FAC21E,00000000), ref: 00FACFB4
                                                                • SetEvent.KERNEL32(?,?,00000000,?,?,?,00FAC21E,00000000), ref: 00FACFC8
                                                                • SetEvent.KERNEL32(?,?,00000000,?,?,?,00FAC21E,00000000), ref: 00FACFF2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                                • String ID:
                                                                • API String ID: 3191363074-0
                                                                • Opcode ID: c070b2065cbf8db8bed92027d261b6a8c1277500de0b081ca26dc1ab9cd44aba
                                                                • Instruction ID: 8134017e5519e02cd549d593034839d111ea2229e5cc164e51dd44a44b78faff
                                                                • Opcode Fuzzy Hash: c070b2065cbf8db8bed92027d261b6a8c1277500de0b081ca26dc1ab9cd44aba
                                                                • Instruction Fuzzy Hash: 3A314DB1904209AFDB24DFA5D985AAABBF9EB15351B10442EF51AD3140DB30AD41EBB0
                                                                Function 00F91901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowRect.USER32(?,?), ref: 00F91915
                                                                • PostMessageW.USER32(00000001,00000201,00000001), ref: 00F919C1
                                                                • Sleep.KERNEL32(00000000,?,?,?), ref: 00F919C9
                                                                • PostMessageW.USER32(00000001,00000202,00000000), ref: 00F919DA
                                                                • Sleep.KERNEL32(00000000,?,?,?,?), ref: 00F919E2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessagePostSleep$RectWindow
                                                                • String ID:
                                                                • API String ID: 3382505437-0
                                                                • Opcode ID: 4ff9ce3a2849a7a1dfb40212bba2fa2d6c0afd8a787cebe00d6c54a6c396d95c
                                                                • Instruction ID: 91777e01488a4ab13e1da44ec4d3b05c9850647347eb4d46697cdd28d6c6d234
                                                                • Opcode Fuzzy Hash: 4ff9ce3a2849a7a1dfb40212bba2fa2d6c0afd8a787cebe00d6c54a6c396d95c
                                                                • Instruction Fuzzy Hash: 0331AF72A0021AEFDF14CFA8CE99ADE3BB5FB44325F104225F925A72D1C7709954EB90
                                                                Function 00FB0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • IsWindow.USER32(00000000), ref: 00FB0951
                                                                • GetForegroundWindow.USER32 ref: 00FB0968
                                                                • GetDC.USER32(00000000), ref: 00FB09A4
                                                                • GetPixel.GDI32(00000000,?,00000003), ref: 00FB09B0
                                                                • ReleaseDC.USER32(00000000,00000003), ref: 00FB09E8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ForegroundPixelRelease
                                                                • String ID:
                                                                • API String ID: 4156661090-0
                                                                • Opcode ID: 778064abd396831a90d5bb23594929d17f62b04e904192e692c5fb30a87477b9
                                                                • Instruction ID: 816d347705af43968114199f8e6272177f19166a4d5e35d52153a97914687180
                                                                • Opcode Fuzzy Hash: 778064abd396831a90d5bb23594929d17f62b04e904192e692c5fb30a87477b9
                                                                • Instruction Fuzzy Hash: 35218175A00204AFD714EF65CD85EAEBBE9EF49750F048068F84A97752CB34AC04EF90
                                                                Function 00F6CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetEnvironmentStringsW.KERNEL32 ref: 00F6CDC6
                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F6CDE9
                                                                  • Part of subcall function 00F63820: RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852
                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F6CE0F
                                                                • _free.LIBCMT ref: 00F6CE22
                                                                • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F6CE31
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                • String ID:
                                                                • API String ID: 336800556-0
                                                                • Opcode ID: ff0a92cf47cfbbb1118f4563c237212df8d3b7fb0ce512589ad8e7aa4685c9b4
                                                                • Instruction ID: d07f85d726826827cc7ff66ebb54f9dfb4592d89d96b0c917592762a49e07802
                                                                • Opcode Fuzzy Hash: ff0a92cf47cfbbb1118f4563c237212df8d3b7fb0ce512589ad8e7aa4685c9b4
                                                                • Instruction Fuzzy Hash: 4A01D472A022157F232116BA6D89D7B797DDED6FA13150129F989C7200EA6A8D01B1F0
                                                                Function 00F49639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F49693
                                                                • SelectObject.GDI32(?,00000000), ref: 00F496A2
                                                                • BeginPath.GDI32(?), ref: 00F496B9
                                                                • SelectObject.GDI32(?,00000000), ref: 00F496E2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ObjectSelect$BeginCreatePath
                                                                • String ID:
                                                                • API String ID: 3225163088-0
                                                                • Opcode ID: bd08838dc90f2fa06c25a3eef665e6de7be1b2ae4b266160afe7e0b28ecdf777
                                                                • Instruction ID: 1f833d71c485e68d8f4dbe77b5684db6c0cf6727c30a0e4627474b3d0ea8b4bd
                                                                • Opcode Fuzzy Hash: bd08838dc90f2fa06c25a3eef665e6de7be1b2ae4b266160afe7e0b28ecdf777
                                                                • Instruction Fuzzy Hash: 8721A73191A305EFDB229F25ED09BAA3F74BB50325F110215F854971E4D3B5D851EF90
                                                                Function 00F95711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _memcmp
                                                                • String ID:
                                                                • API String ID: 2931989736-0
                                                                • Opcode ID: a46967d6594a2b53ddfaa819e23b872cc96cb6ad52fc3c68fcc150d61baf5191
                                                                • Instruction ID: c94f58478b8800250e259a2f2f448be6de9798ea3be1f5ed481c9ad06dc2d624
                                                                • Opcode Fuzzy Hash: a46967d6594a2b53ddfaa819e23b872cc96cb6ad52fc3c68fcc150d61baf5191
                                                                • Instruction Fuzzy Hash: 1B01DB6264160EBAFA0955509E92FBA735D9B617A5B004024FE045A141F730FF14B3A3
                                                                Function 00F62DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • GetLastError.KERNEL32(?,?,?,00F5F2DE,00F63863,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6), ref: 00F62DFD
                                                                • _free.LIBCMT ref: 00F62E32
                                                                • _free.LIBCMT ref: 00F62E59
                                                                • SetLastError.KERNEL32(00000000,00F31129), ref: 00F62E66
                                                                • SetLastError.KERNEL32(00000000,00F31129), ref: 00F62E6F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$_free
                                                                • String ID:
                                                                • API String ID: 3170660625-0
                                                                • Opcode ID: f212210b54cb498d265755cfcf7719f25ab6602eac00c18d018b83102d325f66
                                                                • Instruction ID: b5a1cd081173df500862646f7ca9595da4dcd0538bc4ef0a106afd0f69a09613
                                                                • Opcode Fuzzy Hash: f212210b54cb498d265755cfcf7719f25ab6602eac00c18d018b83102d325f66
                                                                • Instruction Fuzzy Hash: 8E012836A45E0467C75227357D86E2B366DEFE17B1B250038F425A32D2EF3A8C01B160
                                                                Function 00F9000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?,?,00F9035E), ref: 00F9002B
                                                                • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90046
                                                                • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90054
                                                                • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?), ref: 00F90064
                                                                • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90070
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                • String ID:
                                                                • API String ID: 3897988419-0
                                                                • Opcode ID: 8df11c1cdb20887e1529adc35e68a1c4fafd0a3c6bc93f4ea60481277f11266b
                                                                • Instruction ID: 1ba4f4742c68d84245f5e6c315cd007b862d43f3d75a33e801c4c8ba48c819f7
                                                                • Opcode Fuzzy Hash: 8df11c1cdb20887e1529adc35e68a1c4fafd0a3c6bc93f4ea60481277f11266b
                                                                • Instruction Fuzzy Hash: 2B018F72A00208BFEF108F68DD05FAA7AEDEB44761F144124F909D3260DB71DD40ABA0
                                                                Function 00F9E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • QueryPerformanceCounter.KERNEL32(?), ref: 00F9E997
                                                                • QueryPerformanceFrequency.KERNEL32(?), ref: 00F9E9A5
                                                                • Sleep.KERNEL32(00000000), ref: 00F9E9AD
                                                                • QueryPerformanceCounter.KERNEL32(?), ref: 00F9E9B7
                                                                • Sleep.KERNEL32 ref: 00F9E9F3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                • String ID:
                                                                • API String ID: 2833360925-0
                                                                • Opcode ID: 3379186f8ff7d9c7e46b555e0c5617e71f1af2e083b339d5e5f754311263474e
                                                                • Instruction ID: 2641d4df9c4d97a53ed404f92dc43e34f3308e9198874dc92532920ec800d6bb
                                                                • Opcode Fuzzy Hash: 3379186f8ff7d9c7e46b555e0c5617e71f1af2e083b339d5e5f754311263474e
                                                                • Instruction Fuzzy Hash: E0015731C0162DDBDF40EBE6DD5AAEDBB78FB08310F050946E502B2241CB309950ABA1
                                                                Function 00F910F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F91114
                                                                • GetLastError.KERNEL32(?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91120
                                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F9112F
                                                                • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91136
                                                                • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F9114D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                • String ID:
                                                                • API String ID: 842720411-0
                                                                • Opcode ID: c5592ab2a98ba22b2df340d2582a6c2f2775da9b13c23f9375efa234c3561d0b
                                                                • Instruction ID: e7d7f97926d6eb8be0a351c720680409d9906bbc47a077e5f8cf1f53e15e5490
                                                                • Opcode Fuzzy Hash: c5592ab2a98ba22b2df340d2582a6c2f2775da9b13c23f9375efa234c3561d0b
                                                                • Instruction Fuzzy Hash: 3C016D75500209BFDB114F65DD4EE6A3B6EFF85360B150424FA49C3360DB31DC41AAA0
                                                                Function 00F90FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F90FCA
                                                                • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F90FD6
                                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F90FE5
                                                                • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F90FEC
                                                                • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F91002
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                • String ID:
                                                                • API String ID: 44706859-0
                                                                • Opcode ID: 400786bf12b0b6318772ca0ff069f850d3e347a8b572b9418a274bea4645dab5
                                                                • Instruction ID: f0cf8b190df2e7fd07a609ea1ba6fd70d881e3ae1f76b1278bac349ab3bf2d3f
                                                                • Opcode Fuzzy Hash: 400786bf12b0b6318772ca0ff069f850d3e347a8b572b9418a274bea4645dab5
                                                                • Instruction Fuzzy Hash: 2EF06235540305EBDB214FA5DD4EF563B6DFF89761F144424F949C7261CA71DC40DAA0
                                                                Function 00F91014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F9102A
                                                                • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F91036
                                                                • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F91045
                                                                • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F9104C
                                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F91062
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                • String ID:
                                                                • API String ID: 44706859-0
                                                                • Opcode ID: bb8e2d5f7e0b857f47de851a227f1b86b7c3ab85965eadb9510881d66aa13e4a
                                                                • Instruction ID: b7070b0cbbfcab6e9c0f0112e945abd31922c6ebb920551d9e97fa2ff4f56800
                                                                • Opcode Fuzzy Hash: bb8e2d5f7e0b857f47de851a227f1b86b7c3ab85965eadb9510881d66aa13e4a
                                                                • Instruction Fuzzy Hash: D5F06235540305EBDB215FA5ED4AF563B6DFF89761F140424F949C7261CA72D8409AA0
                                                                Function 00FA030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA0324
                                                                • CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA0331
                                                                • CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA033E
                                                                • CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA034B
                                                                • CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA0358
                                                                • CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA0365
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseHandle
                                                                • String ID:
                                                                • API String ID: 2962429428-0
                                                                • Opcode ID: c3ad3fcc27041ec3c8cdd1eff83dc02a0b95e8cdeb02210087b47c7ee1f1b6fc
                                                                • Instruction ID: 0aeb2e48c00258c130073634ea7236a5d4cf56cd13b74875ad27b74a8072f579
                                                                • Opcode Fuzzy Hash: c3ad3fcc27041ec3c8cdd1eff83dc02a0b95e8cdeb02210087b47c7ee1f1b6fc
                                                                • Instruction Fuzzy Hash: 3901A2B2800B159FCB309F66E880812F7F9BF613253158A3FD19652931C771A954EF80
                                                                Function 00F6D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • _free.LIBCMT ref: 00F6D752
                                                                  • Part of subcall function 00F629C8: HeapFree.KERNEL32(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
                                                                  • Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0
                                                                • _free.LIBCMT ref: 00F6D764
                                                                • _free.LIBCMT ref: 00F6D776
                                                                • _free.LIBCMT ref: 00F6D788
                                                                • _free.LIBCMT ref: 00F6D79A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast
                                                                • String ID:
                                                                • API String ID: 776569668-0
                                                                • Opcode ID: 6b16d924ea5049960f3fec5e180d636768039d3bbca1a704d226523bad88477d
                                                                • Instruction ID: eb0b73c048461cc04f4a29c0db57788a319b222139c097f566e2c5e39e875839
                                                                • Opcode Fuzzy Hash: 6b16d924ea5049960f3fec5e180d636768039d3bbca1a704d226523bad88477d
                                                                • Instruction Fuzzy Hash: EEF0FF32F4461CAB8669EB68FAC5C267BFDBF44760B940805F048D7501CB24FC80F6A5
                                                                Function 00F95C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDlgItem.USER32(?,000003E9), ref: 00F95C58
                                                                • GetWindowTextW.USER32(00000000,?,00000100), ref: 00F95C6F
                                                                • MessageBeep.USER32(00000000), ref: 00F95C87
                                                                • KillTimer.USER32(?,0000040A), ref: 00F95CA3
                                                                • EndDialog.USER32(?,00000001), ref: 00F95CBD
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                • String ID:
                                                                • API String ID: 3741023627-0
                                                                • Opcode ID: c8e3826e29ff6584c379f69feebbe46623a4e50bc539cede09a22386945fcbb2
                                                                • Instruction ID: b95e44192bcd50cf9ea1a4ee57d697b2df386b197944adf3b6e465246d4473a1
                                                                • Opcode Fuzzy Hash: c8e3826e29ff6584c379f69feebbe46623a4e50bc539cede09a22386945fcbb2
                                                                • Instruction Fuzzy Hash: 93016770500704ABFF255B20DF4FF9577B8BB00F05F000559E646A15E1D7F45944AB90
                                                                Function 00F622A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _free.LIBCMT ref: 00F622BE
                                                                  • Part of subcall function 00F629C8: HeapFree.KERNEL32(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
                                                                  • Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0
                                                                • _free.LIBCMT ref: 00F622D0
                                                                • _free.LIBCMT ref: 00F622E3
                                                                • _free.LIBCMT ref: 00F622F4
                                                                • _free.LIBCMT ref: 00F62305
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$ErrorFreeHeapLast
                                                                • String ID:
                                                                • API String ID: 776569668-0
                                                                • Opcode ID: cc6843ed631d07c22d3fad7460ac43cf1fbf492cd29d226e112c0598228b45c2
                                                                • Instruction ID: aa2bbad4af0e0cb53714d3c12d2c0ca7e376937310798e4d4d601d83c32f7215
                                                                • Opcode Fuzzy Hash: cc6843ed631d07c22d3fad7460ac43cf1fbf492cd29d226e112c0598228b45c2
                                                                • Instruction Fuzzy Hash: 2EF030B09009248B8767AF58FC019283BB4BB187E1F00051AF450D2269C73E4411FBE5
                                                                Function 00F495C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • EndPath.GDI32(?), ref: 00F495D4
                                                                • StrokeAndFillPath.GDI32(?,?,00F871F7,00000000,?,?,?), ref: 00F495F0
                                                                • SelectObject.GDI32(?,00000000), ref: 00F49603
                                                                • DeleteObject.GDI32 ref: 00F49616
                                                                • StrokePath.GDI32(?), ref: 00F49631
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                • String ID:
                                                                • API String ID: 2625713937-0
                                                                • Opcode ID: 1ec6558f40112519879b1ba33c22776beb45c59ed82277d4679148dc12c2ad04
                                                                • Instruction ID: eb9a115fe45329663b6298e43f8977f86d12dd524ffa7f819700acd6cff3f37d
                                                                • Opcode Fuzzy Hash: 1ec6558f40112519879b1ba33c22776beb45c59ed82277d4679148dc12c2ad04
                                                                • Instruction Fuzzy Hash: 9AF03C31509208EBDB275F65EE0DB653F61BB00332F148214F9A9960F4CB7A8991EF60
                                                                Function 00F60F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: __freea$_free
                                                                • String ID: a/p$am/pm
                                                                • API String ID: 3432400110-3206640213
                                                                • Opcode ID: a9bd80f194cdf2b3e74ff5058b8fd7d63cf37508d7549c21de56218fbab196b8
                                                                • Instruction ID: d204e4756f066e60072195444a80b3e5e6d37ab56c804836dc9940ecab1d33d3
                                                                • Opcode Fuzzy Hash: a9bd80f194cdf2b3e74ff5058b8fd7d63cf37508d7549c21de56218fbab196b8
                                                                • Instruction Fuzzy Hash: E0D10132D00206DADB289F68C856BFEB7B5FF06320F2C4159E906AB751D7359D80EB91
                                                                Function 00FB7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F50242: EnterCriticalSection.KERNEL32(0100070C,01001884,?,?,00F4198B,01002518,?,?,?,00F312F9,00000000), ref: 00F5024D
                                                                  • Part of subcall function 00F50242: LeaveCriticalSection.KERNEL32(0100070C,?,00F4198B,01002518,?,?,?,00F312F9,00000000), ref: 00F5028A
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00F500A3: __onexit.LIBCMT ref: 00F500A9
                                                                • __Init_thread_footer.LIBCMT ref: 00FB7BFB
                                                                  • Part of subcall function 00F501F8: EnterCriticalSection.KERNEL32(0100070C,?,?,00F48747,01002514), ref: 00F50202
                                                                  • Part of subcall function 00F501F8: LeaveCriticalSection.KERNEL32(0100070C,?,00F48747,01002514), ref: 00F50235
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                                                                • String ID: 5$G$Variable must be of type 'Object'.
                                                                • API String ID: 535116098-3733170431
                                                                • Opcode ID: cbb3188b0553e0fdf50de000f4ad45c836a2d3df0cbb8671d553d60e427c785e
                                                                • Instruction ID: e73325fed7b5483a56d0b0da1bdcd043bbe22ac84a628c038eafd21bdc741555
                                                                • Opcode Fuzzy Hash: cbb3188b0553e0fdf50de000f4ad45c836a2d3df0cbb8671d553d60e427c785e
                                                                • Instruction Fuzzy Hash: 70919A70A04209AFCB14EF56D891DEDBBB1BF88350F148049F846AB292DB75AE41EF51
                                                                Function 00F92716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F9B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F921D0,?,?,00000034,00000800,?,00000034), ref: 00F9B42D
                                                                • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00F92760
                                                                  • Part of subcall function 00F9B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F921FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00F9B3F8
                                                                  • Part of subcall function 00F9B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00F9B355
                                                                  • Part of subcall function 00F9B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00F92194,00000034,?,?,00001004,00000000,00000000), ref: 00F9B365
                                                                  • Part of subcall function 00F9B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00F92194,00000034,?,?,00001004,00000000,00000000), ref: 00F9B37B
                                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F927CD
                                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F9281A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                • String ID: @
                                                                • API String ID: 4150878124-2766056989
                                                                • Opcode ID: 471358b870f5b91ec497d7d39208cd6a4eac61b849f9089f32b277c66bd99a40
                                                                • Instruction ID: d6cb8534c5b52ab299347c7e4ae2775eb6a40896fa800300e7069d01af4bdd28
                                                                • Opcode Fuzzy Hash: 471358b870f5b91ec497d7d39208cd6a4eac61b849f9089f32b277c66bd99a40
                                                                • Instruction Fuzzy Hash: 1A412A72900218BEEF10DFA4DD46EEEBBB8AF09310F004095EA55B7181DA716E45EBA1
                                                                Function 00F6172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00F61769
                                                                • _free.LIBCMT ref: 00F61834
                                                                • _free.LIBCMT ref: 00F6183E
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _free$FileModuleName
                                                                • String ID: C:\Users\user\Desktop\file.exe
                                                                • API String ID: 2506810119-1957095476
                                                                • Opcode ID: fcc38755f7fd9b6d9e25132d88d093264a89839740ed0bfdd77be7e4793b9189
                                                                • Instruction ID: 2ababf98555e20861330bff6d60c9abdf0ad3c89aefdc6c4f64c2c242e78ecd5
                                                                • Opcode Fuzzy Hash: fcc38755f7fd9b6d9e25132d88d093264a89839740ed0bfdd77be7e4793b9189
                                                                • Instruction Fuzzy Hash: 3D3161B1E00218ABDB22DFA99C85D9EBBFCFB85360F184166F844D7201D6748E41EB90
                                                                Function 00F9C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00F9C306
                                                                • DeleteMenu.USER32(?,00000007,00000000), ref: 00F9C34C
                                                                • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01001990,01074928), ref: 00F9C395
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Menu$Delete$InfoItem
                                                                • String ID: 0
                                                                • API String ID: 135850232-4108050209
                                                                • Opcode ID: 0111b8111ad49048d5168acf27f0eec5cd3a84b4b2dc97f05815a2f8b041e251
                                                                • Instruction ID: 98856ed0535e1aedee5d71d9d1d3a9417583b43fa1ab72c7d6088b911a5b2fe2
                                                                • Opcode Fuzzy Hash: 0111b8111ad49048d5168acf27f0eec5cd3a84b4b2dc97f05815a2f8b041e251
                                                                • Instruction Fuzzy Hash: F041C2716043019FEB24DF29DC85F1ABBE8AF85320F048A1DF9A5972D1D774E904EB92
                                                                Function 00FB304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00FB335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00FB3077,?,?), ref: 00FB3378
                                                                • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FB307A
                                                                • _wcslen.LIBCMT ref: 00FB309B
                                                                • htons.WSOCK32(00000000,?,?,00000000), ref: 00FB3106
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                                • String ID: 255.255.255.255
                                                                • API String ID: 946324512-2422070025
                                                                • Opcode ID: b23d50ddf5c4c8cdfcbfd5a5d8f9064b7b49653351afdb0dfff87beb7df71f92
                                                                • Instruction ID: 9ece32de23d5a81e73eb6c4c169683459d7e9b15d8c8b0a07fbf64f13db7eb73
                                                                • Opcode Fuzzy Hash: b23d50ddf5c4c8cdfcbfd5a5d8f9064b7b49653351afdb0dfff87beb7df71f92
                                                                • Instruction Fuzzy Hash: BF313739A042059FCB10DF2EC881EEA77E0EF14368F248059E8158B392DB71EE41EF60
                                                                Function 00FC4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00FC4705
                                                                • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00FC4713
                                                                • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00FC471A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend$DestroyWindow
                                                                • String ID: msctls_updown32
                                                                • API String ID: 4014797782-2298589950
                                                                • Opcode ID: 7e8dbee1562d04f99203d0fafdbfacae28cc0133b424c25ff92261d75f59a344
                                                                • Instruction ID: ae979b70d3dedf99ecba5009ce0ce6dc257f40f0041dcf2e904e49806b5dcff0
                                                                • Opcode Fuzzy Hash: 7e8dbee1562d04f99203d0fafdbfacae28cc0133b424c25ff92261d75f59a344
                                                                • Instruction Fuzzy Hash: 2D215CB5600209AFDB11DF64DD92EA737ADEF4A3A4B040059FA049B391CB35FC51EBA0
                                                                Function 00F995AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen
                                                                • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                • API String ID: 176396367-2734436370
                                                                • Opcode ID: 16979358c757e3f0ba55100b71a43dcf01146cf3e3f82d5a7611e69283dfdc54
                                                                • Instruction ID: c2b1b17625fdeac2479356f4cd9e8bcfbc23544161a30db31a5ea0e90bb62fb9
                                                                • Opcode Fuzzy Hash: 16979358c757e3f0ba55100b71a43dcf01146cf3e3f82d5a7611e69283dfdc54
                                                                • Instruction Fuzzy Hash: C321387250861166EB31AA2CDC03FB7B7E89F91320F16402EF94997041EBD6AD49F2D6
                                                                Function 00FA49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SetErrorMode.KERNEL32(00000001), ref: 00FA4A08
                                                                • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00FA4A5C
                                                                • SetErrorMode.KERNEL32(00000000,?,?,00FCCC08), ref: 00FA4AD0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorMode$InformationVolume
                                                                • String ID: %lu
                                                                • API String ID: 2507767853-685833217
                                                                • Opcode ID: 84558129202e02ab0e26badab146f832dcef51c96398ccdf932705a516cd1dd1
                                                                • Instruction ID: 4844c1a13d1e979ef8e6185e9c9014be76801a3aa8b03f8289a150f1e822ca1d
                                                                • Opcode Fuzzy Hash: 84558129202e02ab0e26badab146f832dcef51c96398ccdf932705a516cd1dd1
                                                                • Instruction Fuzzy Hash: 5831D271A00109AFDB10DF54C981EAA7BF8EF49318F1480A9F908DB352DBB5ED45DBA1
                                                                Function 00F92F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A
                                                                  • Part of subcall function 00F92DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00F92DC5
                                                                  • Part of subcall function 00F92DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F92DD6
                                                                  • Part of subcall function 00F92DA7: GetCurrentThreadId.KERNEL32 ref: 00F92DDD
                                                                  • Part of subcall function 00F92DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00F92DE4
                                                                • GetFocus.USER32 ref: 00F92F78
                                                                  • Part of subcall function 00F92DEE: GetParent.USER32(00000000), ref: 00F92DF9
                                                                • GetClassNameW.USER32(?,?,00000100), ref: 00F92FC3
                                                                • EnumChildWindows.USER32(?,00F9303B), ref: 00F92FEB
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                                • String ID: %s%d
                                                                • API String ID: 1272988791-1110647743
                                                                • Opcode ID: 6a68c89fbe8085b73ebcd8546853e00f036716ad7b9169833f39c134f5de0ce7
                                                                • Instruction ID: 200ea05bc1e4f80ba94e9b98c556b933312176d9683331a85250cf9e566f82d0
                                                                • Opcode Fuzzy Hash: 6a68c89fbe8085b73ebcd8546853e00f036716ad7b9169833f39c134f5de0ce7
                                                                • Instruction Fuzzy Hash: A311E4716002096BDF407F708D8AEED776AAF84314F048075FA0DDB252DE349909BB60
                                                                Function 00F8D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00F8D3BF
                                                                • FreeLibrary.KERNEL32 ref: 00F8D3E5
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: AddressFreeLibraryProc
                                                                • String ID: GetSystemWow64DirectoryW$X64
                                                                • API String ID: 3013587201-2590602151
                                                                • Opcode ID: d27686f5e2e605ed7376e409a77e64eabd7294ef8a0285a6022128f787e478d3
                                                                • Instruction ID: 172dc952ed4a04bd7e07173994fe51fc9cdf407a610ba4be07aa4342d8d01dc6
                                                                • Opcode Fuzzy Hash: d27686f5e2e605ed7376e409a77e64eabd7294ef8a0285a6022128f787e478d3
                                                                • Instruction Fuzzy Hash: D6F0AB33C02622EBD33232118C59FE9B310AF00701F598119F80AE30C5DB20CD40B3C2
                                                                Function 00F82CEE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • TranslateMessage.USER32(?), ref: 00F82CF3
                                                                • DispatchMessageW.USER32(?), ref: 00F82D01
                                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F82D15
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Message$DispatchTranslate
                                                                • String ID: jjj
                                                                • API String ID: 1706434739-2289343631
                                                                • Opcode ID: 8efbbe3766a8cde9b8d31db7945e8b27c6e8c3fcf162ab0cd92091492f028903
                                                                • Instruction ID: 39622f0f1bcd7ecfd1d5fcc3440ccbe5c3344b89fe160779fd22cde1b7011932
                                                                • Opcode Fuzzy Hash: 8efbbe3766a8cde9b8d31db7945e8b27c6e8c3fcf162ab0cd92091492f028903
                                                                • Instruction Fuzzy Hash: 56E0C2B3A493486AD720A7B4AD0AFEA3B9CFF55311F000423FA08C7080E6709214EBA1
                                                                Function 00F9007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 91c007c858b434a6ad71b7f3f90c97feccc5e6965d9e7f80df4d1452e8f26b85
                                                                • Instruction ID: 37154d77f25197aa91f4d7bfe25a4a65b797ddb586c17450675e663f5d632791
                                                                • Opcode Fuzzy Hash: 91c007c858b434a6ad71b7f3f90c97feccc5e6965d9e7f80df4d1452e8f26b85
                                                                • Instruction Fuzzy Hash: 2FC11B75A0021AEFEB14CF94C894EAEB7B5FF48714F208598E505EB251DB31DD81EB90
                                                                Function 00F63E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: __alldvrm$_strrchr
                                                                • String ID:
                                                                • API String ID: 1036877536-0
                                                                • Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                • Instruction ID: 3ed389782f5bb65d5dc2de8273a291c3a6ba9efb038f9df5db23cccda3cf183f
                                                                • Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                                • Instruction Fuzzy Hash: 69A18E72E00356AFDB26DF18CC917AEBBF4EF62360F14416DE5559B282C238AD81E750
                                                                Function 00FB342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Variant$ClearInitInitializeUninitialize
                                                                • String ID:
                                                                • API String ID: 1998397398-0
                                                                • Opcode ID: c335a1eb7459a300141b77ba537fac270589e995cd7a3faf4680db86eed4106d
                                                                • Instruction ID: b39d47d2208e0af4756d68bfe410d5ffb296b27c51d78dcfbf7e9ea675f45a70
                                                                • Opcode Fuzzy Hash: c335a1eb7459a300141b77ba537fac270589e995cd7a3faf4680db86eed4106d
                                                                • Instruction Fuzzy Hash: 94A16D756043009FCB14EF29C985A5AB7E5FF88720F088859F9499B362DB34ED01EF91
                                                                Function 00F90436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00FCFC08,?), ref: 00F905F0
                                                                • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00FCFC08,?), ref: 00F90608
                                                                • CLSIDFromProgID.OLE32(?,?,00000000,00FCCC40,000000FF,?,00000000,00000800,00000000,?,00FCFC08,?), ref: 00F9062D
                                                                • _memcmp.LIBVCRUNTIME ref: 00F9064E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FromProg$FreeTask_memcmp
                                                                • String ID:
                                                                • API String ID: 314563124-0
                                                                • Opcode ID: 92ae87863a495b29ef2d9bcff8561358fd805c13720f4551e46a7b9b59f57a4f
                                                                • Instruction ID: 3be96a316969fd47948b5f153b0480f2a9617160e179b2de2673cb55748e5ac8
                                                                • Opcode Fuzzy Hash: 92ae87863a495b29ef2d9bcff8561358fd805c13720f4551e46a7b9b59f57a4f
                                                                • Instruction Fuzzy Hash: 2B810671A00109EFDF04DF94C984EEEB7B9FF89315F244598E506AB250DB71AE06DB60
                                                                Function 00FBA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 00FBA6AC
                                                                • Process32FirstW.KERNEL32(00000000,?), ref: 00FBA6BA
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • Process32NextW.KERNEL32(00000000,?), ref: 00FBA79C
                                                                • CloseHandle.KERNEL32(00000000), ref: 00FBA7AB
                                                                  • Part of subcall function 00F4CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00F73303,?), ref: 00F4CE8A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                                • String ID:
                                                                • API String ID: 1991900642-0
                                                                • Opcode ID: 49ae371e25f898ce007b0d3759d814f94281cf949d693d600b6fcd77d93bcc72
                                                                • Instruction ID: e952985726c4c6164ac70ecce323637fe16b94d1d9661649b42a205d0cfb413f
                                                                • Opcode Fuzzy Hash: 49ae371e25f898ce007b0d3759d814f94281cf949d693d600b6fcd77d93bcc72
                                                                • Instruction Fuzzy Hash: 55514A71508300AFD710EF25CC86A6BBBE8FF89764F40891DF98997261EB74D904DB92
                                                                Function 00F71391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _free
                                                                • String ID:
                                                                • API String ID: 269201875-0
                                                                • Opcode ID: b7d885d74576e7c87532c5bfee6d449198df4f164778031b69f85ba567ab9996
                                                                • Instruction ID: 05494fe114e7ecd7b13d5a6bf4f518c400be1d326ba01e6b5c6a21c075082c78
                                                                • Opcode Fuzzy Hash: b7d885d74576e7c87532c5bfee6d449198df4f164778031b69f85ba567ab9996
                                                                • Instruction Fuzzy Hash: A3414B72A001006BDB25EFBC9C46AAE3AA5FF42770F14C267F91DD3191E678484D7263
                                                                Function 00FC6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowRect.USER32(?,?), ref: 00FC62E2
                                                                • ScreenToClient.USER32(?,?), ref: 00FC6315
                                                                • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00FC6382
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$ClientMoveRectScreen
                                                                • String ID:
                                                                • API String ID: 3880355969-0
                                                                • Opcode ID: 1b5d700d0dfe11628755d150dddcad2f4e95233dacf4b28a84ffc6fe2c5469d2
                                                                • Instruction ID: bf83720ceec6ca5109f84a9acb3aaa16d93d31e14db46e4f098114a5e3102ec3
                                                                • Opcode Fuzzy Hash: 1b5d700d0dfe11628755d150dddcad2f4e95233dacf4b28a84ffc6fe2c5469d2
                                                                • Instruction Fuzzy Hash: 35512974A0424AAFCF24DF54DA82EAE7BB5EB85360F10815DF855D7290D730ED41EB90
                                                                Function 00FB1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • socket.WSOCK32(00000002,00000002,00000011), ref: 00FB1AFD
                                                                • WSAGetLastError.WSOCK32 ref: 00FB1B0B
                                                                • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00FB1B8A
                                                                • WSAGetLastError.WSOCK32 ref: 00FB1B94
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorLast$socket
                                                                • String ID:
                                                                • API String ID: 1881357543-0
                                                                • Opcode ID: e88621152209e5ef7fa380af039d79caa9ebe4d1dc63a2c984a63505037064aa
                                                                • Instruction ID: f063d57c0ef76b605c32fc25a43d85fd37c5de1175585ab9d38cb90267ea0ecc
                                                                • Opcode Fuzzy Hash: e88621152209e5ef7fa380af039d79caa9ebe4d1dc63a2c984a63505037064aa
                                                                • Instruction Fuzzy Hash: 7B41D175600200AFE720AF20CC86F6A7BE5AB84728F54C44CFA1A9F7D2D776DD419B90
                                                                Function 00F6B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 5de933fc2a69f588e7fa42309e840968b18bd5b12c63ab7d53002d7bd5fb337b
                                                                • Instruction ID: 6c3c73fe338719740ba25122972b498e1e4f57cf0753cbb5d6e54ddd09d620c5
                                                                • Opcode Fuzzy Hash: 5de933fc2a69f588e7fa42309e840968b18bd5b12c63ab7d53002d7bd5fb337b
                                                                • Instruction Fuzzy Hash: AD415C71A00314BFD724EF38CC41BAA7BE9EB84720F10852EF546DB282D775A941A790
                                                                Function 00FA56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00FA5783
                                                                • GetLastError.KERNEL32(?,00000000), ref: 00FA57A9
                                                                • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00FA57CE
                                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00FA57FA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateHardLink$DeleteErrorFileLast
                                                                • String ID:
                                                                • API String ID: 3321077145-0
                                                                • Opcode ID: 988a562bf4042f3a6119665eaa9470cb38901522df2337f4ac197d54f6682959
                                                                • Instruction ID: c4d1088c09934395c5e1108c997bcbc14161476c46c18b3feec1b7880874e4b1
                                                                • Opcode Fuzzy Hash: 988a562bf4042f3a6119665eaa9470cb38901522df2337f4ac197d54f6682959
                                                                • Instruction Fuzzy Hash: FA415079600614DFCF14EF15C545A5DBBE1EF49720F188488E94AAB365CB38FD00EB91
                                                                Function 00F6D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00F56D71,00000000,00000000,00F582D9,?,00F582D9,?,00000001,00F56D71,8BE85006,00000001,00F582D9,00F582D9), ref: 00F6D910
                                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F6D999
                                                                • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00F6D9AB
                                                                • __freea.LIBCMT ref: 00F6D9B4
                                                                  • Part of subcall function 00F63820: RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                • String ID:
                                                                • API String ID: 2652629310-0
                                                                • Opcode ID: 610af1e008eadf5144d6936ea13cbe5f498beccbecf8cccf8deb520ec823ef2e
                                                                • Instruction ID: 343bbbc2808ad964d4fa05fa913f449d35f20d184cc2418da1e1659ab40003a4
                                                                • Opcode Fuzzy Hash: 610af1e008eadf5144d6936ea13cbe5f498beccbecf8cccf8deb520ec823ef2e
                                                                • Instruction Fuzzy Hash: DF31AD72E0020AABDB249F65DC45EAF7BA5EB41760B054168FC08D7250EB39DD54EBA0
                                                                Function 00FC52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,00001024,00000000,?), ref: 00FC5352
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC5375
                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FC5382
                                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FC53A8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: LongWindow$InvalidateMessageRectSend
                                                                • String ID:
                                                                • API String ID: 3340791633-0
                                                                • Opcode ID: f330c96ec31f7fac195330eb1ec34079432ea5c990695ea256f4224f2cfc17e2
                                                                • Instruction ID: 2f15c45d5230e1203f65f9ccce4913eeb304e6964b833b42361a5eee89fab928
                                                                • Opcode Fuzzy Hash: f330c96ec31f7fac195330eb1ec34079432ea5c990695ea256f4224f2cfc17e2
                                                                • Instruction Fuzzy Hash: 4831F431F55A4AAFEB349A54CE07FE83763AB04BA0F584109FA54861D1C7B5B9C0BB41
                                                                Function 00F9AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00F9ABF1
                                                                • SetKeyboardState.USER32(00000080,?,00008000), ref: 00F9AC0D
                                                                • PostMessageW.USER32(00000000,00000101,00000000), ref: 00F9AC74
                                                                • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00F9ACC6
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: KeyboardState$InputMessagePostSend
                                                                • String ID:
                                                                • API String ID: 432972143-0
                                                                • Opcode ID: ac7fb27e375aa883a92a70b4d75d9b030f516400b4c1bf5d635df5d49db35795
                                                                • Instruction ID: 705542e6f9446113ed645ee0f96bda573398a2957e515c6cd753d3285f1a216b
                                                                • Opcode Fuzzy Hash: ac7fb27e375aa883a92a70b4d75d9b030f516400b4c1bf5d635df5d49db35795
                                                                • Instruction Fuzzy Hash: FE310530E04718AFFF35CB658C05BFA7BA5AB89321F04471AE4859A1D1C379C985B7E2
                                                                Function 00FC7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • ClientToScreen.USER32(?,?), ref: 00FC769A
                                                                • GetWindowRect.USER32(?,?), ref: 00FC7710
                                                                • PtInRect.USER32(?,?,00FC8B89), ref: 00FC7720
                                                                • MessageBeep.USER32(00000000), ref: 00FC778C
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Rect$BeepClientMessageScreenWindow
                                                                • String ID:
                                                                • API String ID: 1352109105-0
                                                                • Opcode ID: 57f80ab76b4b377d76344c180b6a67b8dfdbd0873dc88378e98086c01b204c0e
                                                                • Instruction ID: 2706c54389c97afd460ffaaf5805b87cd334c78682ba863188766b506fab85a8
                                                                • Opcode Fuzzy Hash: 57f80ab76b4b377d76344c180b6a67b8dfdbd0873dc88378e98086c01b204c0e
                                                                • Instruction Fuzzy Hash: 53419F34A0531AAFCB11EF68CA86FA9BBF4BF48310F1440ACE4549B251C335E941EF90
                                                                Function 00FC16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetForegroundWindow.USER32 ref: 00FC16EB
                                                                  • Part of subcall function 00F93A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F93A57
                                                                  • Part of subcall function 00F93A3D: GetCurrentThreadId.KERNEL32 ref: 00F93A5E
                                                                  • Part of subcall function 00F93A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F925B3), ref: 00F93A65
                                                                • GetCaretPos.USER32(?), ref: 00FC16FF
                                                                • ClientToScreen.USER32(00000000,?), ref: 00FC174C
                                                                • GetForegroundWindow.USER32 ref: 00FC1752
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                • String ID:
                                                                • API String ID: 2759813231-0
                                                                • Opcode ID: eaac3cd5f3c66db447d64c0b11e089de4fce33e396c2a38ec1774a330176d5e2
                                                                • Instruction ID: c81cc2dbdc9121c65e2ef24a6afc1ade7a166ade41c80ec209fe53d5728002a5
                                                                • Opcode Fuzzy Hash: eaac3cd5f3c66db447d64c0b11e089de4fce33e396c2a38ec1774a330176d5e2
                                                                • Instruction Fuzzy Hash: B9316FB5D00209AFCB04EFA9C981DAEBBF9EF49314B5080A9E415E7212D735DE45DFA0
                                                                Function 00F9DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625
                                                                • _wcslen.LIBCMT ref: 00F9DFCB
                                                                • _wcslen.LIBCMT ref: 00F9DFE2
                                                                • _wcslen.LIBCMT ref: 00F9E00D
                                                                • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00F9E018
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$ExtentPoint32Text
                                                                • String ID:
                                                                • API String ID: 3763101759-0
                                                                • Opcode ID: bd3810c524ad59ebd9cfe2612d2f8b080efeabe3405ec71a774e892958f45910
                                                                • Instruction ID: f4baf9ce8b74a74d5755c9aa9d13bdbced03fed78760c7b16fd475423d02ae74
                                                                • Opcode Fuzzy Hash: bd3810c524ad59ebd9cfe2612d2f8b080efeabe3405ec71a774e892958f45910
                                                                • Instruction Fuzzy Hash: 0521E571D00214AFDF20DFA8CD82B6EB7F8EF85720F144065E905BB245D6749E45EBA1
                                                                Function 00FC8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2
                                                                • GetCursorPos.USER32(?), ref: 00FC9001
                                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00F87711,?,?,?,?,?), ref: 00FC9016
                                                                • GetCursorPos.USER32(?), ref: 00FC905E
                                                                • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00F87711,?,?,?), ref: 00FC9094
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                • String ID:
                                                                • API String ID: 2864067406-0
                                                                • Opcode ID: 6ec8b9c1d8a60871e04ae01a5d36c1ceff41918a6dbb61b24890c8a92ddd5717
                                                                • Instruction ID: da46561950884c40e9e33c2e754a0a8d6e17880cfdd9a247b78716adc36e45a0
                                                                • Opcode Fuzzy Hash: 6ec8b9c1d8a60871e04ae01a5d36c1ceff41918a6dbb61b24890c8a92ddd5717
                                                                • Instruction Fuzzy Hash: 4321A135A04018FFDB268FA4C95AFFA7BB9EF89360F044059F90547261C3759990FBA0
                                                                Function 00F9D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetFileAttributesW.KERNEL32(?,00FCCB68), ref: 00F9D2FB
                                                                • GetLastError.KERNEL32 ref: 00F9D30A
                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00F9D319
                                                                • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00FCCB68), ref: 00F9D376
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateDirectory$AttributesErrorFileLast
                                                                • String ID:
                                                                • API String ID: 2267087916-0
                                                                • Opcode ID: 97040ad723ebd0b6d1df70264071991255904af57961bbcc0e5cf465db70b37a
                                                                • Instruction ID: df3759248d71d8651e3de0c0996159e0b962174c1ad243e89a264bb905beadce
                                                                • Opcode Fuzzy Hash: 97040ad723ebd0b6d1df70264071991255904af57961bbcc0e5cf465db70b37a
                                                                • Instruction Fuzzy Hash: 8F21A370908201DF9B00DF24C981CAA77E4EF95375F604A1DF499C32A1D731D946EB93
                                                                Function 00F91571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F91014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F9102A
                                                                  • Part of subcall function 00F91014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F91036
                                                                  • Part of subcall function 00F91014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F91045
                                                                  • Part of subcall function 00F91014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F9104C
                                                                  • Part of subcall function 00F91014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F91062
                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00F915BE
                                                                • _memcmp.LIBVCRUNTIME ref: 00F915E1
                                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F91617
                                                                • HeapFree.KERNEL32(00000000), ref: 00F9161E
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                                • String ID:
                                                                • API String ID: 1592001646-0
                                                                • Opcode ID: d1903b948c66c0b1005c146cb2111eef9e686bca703b2126e95ed651a1df688e
                                                                • Instruction ID: bc1e9651343886d12b2cced1c69e201e80e31b4ea2c2869d1f33eb5c388694b6
                                                                • Opcode Fuzzy Hash: d1903b948c66c0b1005c146cb2111eef9e686bca703b2126e95ed651a1df688e
                                                                • Instruction Fuzzy Hash: 6D219D31E4010AEFEF10DFA5C945BEEB7B8FF44354F094469E445AB241E730AA05EBA0
                                                                Function 00FC2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowLongW.USER32(?,000000EC), ref: 00FC280A
                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00FC2824
                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00FC2832
                                                                • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00FC2840
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Long$AttributesLayered
                                                                • String ID:
                                                                • API String ID: 2169480361-0
                                                                • Opcode ID: d3b228249a4b88d41e4896d7682ac21cdca9a57f2610573b3e37a5ab61f1aae2
                                                                • Instruction ID: 90ae92ab2bbb8444204a605236d93b3d63febed4131398b61940ba9cb78cca3c
                                                                • Opcode Fuzzy Hash: d3b228249a4b88d41e4896d7682ac21cdca9a57f2610573b3e37a5ab61f1aae2
                                                                • Instruction Fuzzy Hash: 04212131204112AFD7549B24CD82FAA7B95EF85324F18810CF42A8B6E2CB75FC42DBD0
                                                                Function 00F978F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F98D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00F9790A,?,000000FF,?,00F98754,00000000,?,0000001C,?,?), ref: 00F98D8C
                                                                  • Part of subcall function 00F98D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00F98DB2
                                                                  • Part of subcall function 00F98D7D: lstrcmpiW.KERNEL32(00000000,?,00F9790A,?,000000FF,?,00F98754,00000000,?,0000001C,?,?), ref: 00F98DE3
                                                                • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00F98754,00000000,?,0000001C,?,?,00000000), ref: 00F97923
                                                                • lstrcpyW.KERNEL32(00000000,?), ref: 00F97949
                                                                • lstrcmpiW.KERNEL32(00000002,cdecl,?,00F98754,00000000,?,0000001C,?,?,00000000), ref: 00F97984
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: lstrcmpilstrcpylstrlen
                                                                • String ID: cdecl
                                                                • API String ID: 4031866154-3896280584
                                                                • Opcode ID: 9b618a4198559dddece548d39cc884744039edb8c99d4eb98ce79ad4ffc92b4b
                                                                • Instruction ID: e13d125cff2f83cdf12a088fd1d69fa4a3122f83991e28a52f1150d143969185
                                                                • Opcode Fuzzy Hash: 9b618a4198559dddece548d39cc884744039edb8c99d4eb98ce79ad4ffc92b4b
                                                                • Instruction Fuzzy Hash: 8911E43A600305ABDF156F35DC45E7A77A5EF85390B10402AE906C7264EB319801E791
                                                                Function 00FC7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00FC7D0B
                                                                • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00FC7D2A
                                                                • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00FC7D42
                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00FAB7AD,00000000), ref: 00FC7D6B
                                                                  • Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Window$Long
                                                                • String ID:
                                                                • API String ID: 847901565-0
                                                                • Opcode ID: 295fcb37e195882e8fa669e50a33072c1c41f015a857531f4bb5b80e677a9ed1
                                                                • Instruction ID: a53be2344b31aa2d7f78641576fc39fdd5d3c63e610d7c18ee23b33130be92a0
                                                                • Opcode Fuzzy Hash: 295fcb37e195882e8fa669e50a33072c1c41f015a857531f4bb5b80e677a9ed1
                                                                • Instruction Fuzzy Hash: 03118C32A0461AAFCB11AF28DD05FA63BA5AF45370F154728F83AD72E0D7319950EF90
                                                                Function 00F61D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                Download Yara Rule
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d6cda25d0104a94fe3750387de599d6a9e3fa222c81141eafd3dbba266dc7dc8
                                                                • Instruction ID: 9c926f2455beb7f684b1754dfe9e0aa6b6c3b1a63d7bb371e58c5cf6df541965
                                                                • Opcode Fuzzy Hash: d6cda25d0104a94fe3750387de599d6a9e3fa222c81141eafd3dbba266dc7dc8
                                                                • Instruction Fuzzy Hash: 4201D6B2A05A1A3EF62126786CC1F27762CEF817B8F380326F521522D2DB658C007170
                                                                Function 00F91A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00F91A47
                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F91A59
                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F91A6F
                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F91A8A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend
                                                                • String ID:
                                                                • API String ID: 3850602802-0
                                                                • Opcode ID: c95f1ae0b62abc97e428861f6881a217368176324097ae8309ec52497de6acfe
                                                                • Instruction ID: 5b26874d3c5382e2365daeaecf66708e7217bf2de0668d02d439aedbe5874252
                                                                • Opcode Fuzzy Hash: c95f1ae0b62abc97e428861f6881a217368176324097ae8309ec52497de6acfe
                                                                • Instruction Fuzzy Hash: DF11F73AD01219FFEF119BA5CD85FADBB78FB08750F2000A1EA04B7290D6756E50EB94
                                                                Function 00F9E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentThreadId.KERNEL32 ref: 00F9E1FD
                                                                • MessageBoxW.USER32(?,?,?,?), ref: 00F9E230
                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F9E246
                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F9E24D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                • String ID:
                                                                • API String ID: 2880819207-0
                                                                • Opcode ID: 37d9a2322d1752aa4faca06535714c8d71d04dbca4bf3bf6fe426e3b1a74a177
                                                                • Instruction ID: 1921e3bad3547f460dbda3462876c3ce3b452763af2d3c0434ef616eea5ba6e2
                                                                • Opcode Fuzzy Hash: 37d9a2322d1752aa4faca06535714c8d71d04dbca4bf3bf6fe426e3b1a74a177
                                                                • Instruction Fuzzy Hash: 08112672D04258BFDB11DFA8AC0AE9E7FACEB45320F148215F928E3281D6B5CD0497A0
                                                                Function 00F5D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateThread.KERNEL32(00000000,?,00F5CFF9,00000000,00000004,00000000), ref: 00F5D218
                                                                • GetLastError.KERNEL32 ref: 00F5D224
                                                                • __dosmaperr.LIBCMT ref: 00F5D22B
                                                                • ResumeThread.KERNEL32(00000000), ref: 00F5D249
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                                • String ID:
                                                                • API String ID: 173952441-0
                                                                • Opcode ID: e543ae07f896ad487517e44655f8596fc7cd91413d29793d6ba16a916d5713fd
                                                                • Instruction ID: e88086efaff1f943ff6face9ff8ae7ec90e14cbe71837f784065366db93005c4
                                                                • Opcode Fuzzy Hash: e543ae07f896ad487517e44655f8596fc7cd91413d29793d6ba16a916d5713fd
                                                                • Instruction Fuzzy Hash: A201F9768066087BD7315BA5DC05FAE7A69DF81332F100259FE25921D0DB75C909F7E0
                                                                Function 00FC9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2
                                                                • GetClientRect.USER32(?,?), ref: 00FC9F31
                                                                • GetCursorPos.USER32(?), ref: 00FC9F3B
                                                                • ScreenToClient.USER32(?,?), ref: 00FC9F46
                                                                • DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00FC9F7A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Client$CursorLongProcRectScreenWindow
                                                                • String ID:
                                                                • API String ID: 4127811313-0
                                                                • Opcode ID: 807a31659244b3d523127e8e04aafbda2f249ef1444096f0afa1c2d3614a3ff9
                                                                • Instruction ID: 8b8e8524542221f470c02f9840c8587ae4f7304e5a95da9b74b65fa5a59deff6
                                                                • Opcode Fuzzy Hash: 807a31659244b3d523127e8e04aafbda2f249ef1444096f0afa1c2d3614a3ff9
                                                                • Instruction Fuzzy Hash: D711183290411AEBDB11DF68DA8AEEE77B9FB45311F000459F911E3140D775BA81EBA1
                                                                Function 00F3600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F3604C
                                                                • GetStockObject.GDI32(00000011), ref: 00F36060
                                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 00F3606A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CreateMessageObjectSendStockWindow
                                                                • String ID:
                                                                • API String ID: 3970641297-0
                                                                • Opcode ID: 02f35ae8e1257679a0184536f9dff1ab0e26630b06375459997c9135c8245870
                                                                • Instruction ID: 3d0c240a2a2bfcd2c35ad5f9558606803bbad6230347ea99749be680023897f3
                                                                • Opcode Fuzzy Hash: 02f35ae8e1257679a0184536f9dff1ab0e26630b06375459997c9135c8245870
                                                                • Instruction Fuzzy Hash: 4C116DB2501508BFEF164FA49D46EEABB69EF093B4F044216FA1892110D736DC60FBA0
                                                                Function 00F53B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • ___BuildCatchObject.LIBVCRUNTIME ref: 00F53B56
                                                                  • Part of subcall function 00F53AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00F53AD2
                                                                  • Part of subcall function 00F53AA3: ___AdjustPointer.LIBCMT ref: 00F53AED
                                                                • _UnwindNestedFrames.LIBCMT ref: 00F53B6B
                                                                • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00F53B7C
                                                                • CallCatchBlock.LIBVCRUNTIME ref: 00F53BA4
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                                • String ID:
                                                                • API String ID: 737400349-0
                                                                • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                • Instruction ID: 0c88a69af704ad1c8f587265d49967e995174b32f1cfcedfa479e9d3c69af7bc
                                                                • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                                • Instruction Fuzzy Hash: A6012932500148BBDF125E99CC42EEB3B69EF887A9F044014FF4896121C736E965EBA0
                                                                Function 00F63073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00F313C6,00000000,00000000,?,00F6301A,00F313C6,00000000,00000000,00000000,?,00F6328B,00000006,FlsSetValue), ref: 00F630A5
                                                                • GetLastError.KERNEL32(?,00F6301A,00F313C6,00000000,00000000,00000000,?,00F6328B,00000006,FlsSetValue,00FD2290,FlsSetValue,00000000,00000364,?,00F62E46), ref: 00F630B1
                                                                • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F6301A,00F313C6,00000000,00000000,00000000,?,00F6328B,00000006,FlsSetValue,00FD2290,FlsSetValue,00000000), ref: 00F630BF
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: LibraryLoad$ErrorLast
                                                                • String ID:
                                                                • API String ID: 3177248105-0
                                                                • Opcode ID: 14e61367aea5ce794db5bc23aff2e5a84b8ebd65705f29ca6036771b69a4475f
                                                                • Instruction ID: bf14876d1139bb4fa61cf9e37d8b4c7e771b245d9707dfa6b38a28994ea76be0
                                                                • Opcode Fuzzy Hash: 14e61367aea5ce794db5bc23aff2e5a84b8ebd65705f29ca6036771b69a4475f
                                                                • Instruction Fuzzy Hash: 3101F732701226BBCB314B79AC45E677B98EF45BB9B100720F909E3140C721D909E6E0
                                                                Function 00F97464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00F9747F
                                                                • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00F97497
                                                                • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00F974AC
                                                                • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00F974CA
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Type$Register$FileLoadModuleNameUser
                                                                • String ID:
                                                                • API String ID: 1352324309-0
                                                                • Opcode ID: 120ac3b9d499ae46067795d1c0a6b4050c884f0d13dfc1d7a682a2dd8fd85c23
                                                                • Instruction ID: 218c2d95ff1a4f2a4597e9fcdf24f7476090667effa338d39bdc6cb4327dbbf3
                                                                • Opcode Fuzzy Hash: 120ac3b9d499ae46067795d1c0a6b4050c884f0d13dfc1d7a682a2dd8fd85c23
                                                                • Instruction Fuzzy Hash: BE117CB1615314DBFB20DF19DD09F927BB8EB00B00F108569E61AD7192D770E904AB90
                                                                Function 00F9B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00F9ACD3,?,00008000), ref: 00F9B0C4
                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F9ACD3,?,00008000), ref: 00F9B0E9
                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00F9ACD3,?,00008000), ref: 00F9B0F3
                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F9ACD3,?,00008000), ref: 00F9B126
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CounterPerformanceQuerySleep
                                                                • String ID:
                                                                • API String ID: 2875609808-0
                                                                • Opcode ID: bb53a9da0ab159c19e107a50e9bf73054b1c5af7597a3e5445d04957fa461273
                                                                • Instruction ID: 9fe8d4fdb16d49c5076d3f6a9e7d471c27c3a49995ee0732e7db330947261856
                                                                • Opcode Fuzzy Hash: bb53a9da0ab159c19e107a50e9bf73054b1c5af7597a3e5445d04957fa461273
                                                                • Instruction Fuzzy Hash: C0115B31C0162CE7DF00AFE5EA69AEEBF78FF49711F114095D941B3181CB305690AB91
                                                                Function 00FC7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetWindowRect.USER32(?,?), ref: 00FC7E33
                                                                • ScreenToClient.USER32(?,?), ref: 00FC7E4B
                                                                • ScreenToClient.USER32(?,?), ref: 00FC7E6F
                                                                • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FC7E8A
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ClientRectScreen$InvalidateWindow
                                                                • String ID:
                                                                • API String ID: 357397906-0
                                                                • Opcode ID: f4b712aacbdd29a9b24b8243c8c37e898a9bfc144ea35193784846a031a42314
                                                                • Instruction ID: c0d0f4b62357bcf0236d9d663ba72efadd93a437388e007cdc9d813510399999
                                                                • Opcode Fuzzy Hash: f4b712aacbdd29a9b24b8243c8c37e898a9bfc144ea35193784846a031a42314
                                                                • Instruction Fuzzy Hash: 9A1143B9D0020AAFDB41DF98C985AEEBBF5FF08310F505056E915E3210D735AA55DF90
                                                                Function 00F92DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00F92DC5
                                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00F92DD6
                                                                • GetCurrentThreadId.KERNEL32 ref: 00F92DDD
                                                                • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00F92DE4
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                • String ID:
                                                                • API String ID: 2710830443-0
                                                                • Opcode ID: 44e4dbd15b1b616dd9f7fb305a2cb2d33b23498a9e6252eeb57a4e60a5161bc9
                                                                • Instruction ID: 144dee92e64faa8a6624549b5f151be75f179b1a7d99048983155b2a260a818c
                                                                • Opcode Fuzzy Hash: 44e4dbd15b1b616dd9f7fb305a2cb2d33b23498a9e6252eeb57a4e60a5161bc9
                                                                • Instruction Fuzzy Hash: 2CE065715012287AEB2017639D0EFE73E5CEF42B61F000015F109D20409AA18445F6F0
                                                                Function 00FC8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F49639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F49693
                                                                  • Part of subcall function 00F49639: SelectObject.GDI32(?,00000000), ref: 00F496A2
                                                                  • Part of subcall function 00F49639: BeginPath.GDI32(?), ref: 00F496B9
                                                                  • Part of subcall function 00F49639: SelectObject.GDI32(?,00000000), ref: 00F496E2
                                                                • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00FC8887
                                                                • LineTo.GDI32(?,?,?), ref: 00FC8894
                                                                • EndPath.GDI32(?), ref: 00FC88A4
                                                                • StrokePath.GDI32(?), ref: 00FC88B2
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                • String ID:
                                                                • API String ID: 1539411459-0
                                                                • Opcode ID: 95405e36052e4e5ad9e37b7c1c0df9d0fc9e25b668cc719f878a003f69f3baf9
                                                                • Instruction ID: 9b63ccc69464b041c584f1f44f85084b2d9998bae0e21f412e6f42e7b647afa8
                                                                • Opcode Fuzzy Hash: 95405e36052e4e5ad9e37b7c1c0df9d0fc9e25b668cc719f878a003f69f3baf9
                                                                • Instruction Fuzzy Hash: 0AF05E36045259FADB225F94AD0AFDE3F59AF06310F048004FA55A60E1C7B95511EFE5
                                                                Function 00F498B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetSysColor.USER32(00000008), ref: 00F498CC
                                                                • SetTextColor.GDI32(?,?), ref: 00F498D6
                                                                • SetBkMode.GDI32(?,00000001), ref: 00F498E9
                                                                • GetStockObject.GDI32(00000005), ref: 00F498F1
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Color$ModeObjectStockText
                                                                • String ID:
                                                                • API String ID: 4037423528-0
                                                                • Opcode ID: 96552f8f42157becf96a02fbaa393c25dfad74ce8a45c905fd37aa6f158082d6
                                                                • Instruction ID: 5c1c4ceddffb8e5fd02ad80ee2e231ab27fad2f1d231e62b30bd7e67d193f91e
                                                                • Opcode Fuzzy Hash: 96552f8f42157becf96a02fbaa393c25dfad74ce8a45c905fd37aa6f158082d6
                                                                • Instruction Fuzzy Hash: B0E06531644284AEDB216B75BD0AFD93F10AB51735F188219F6FD590E1C3718640BB10
                                                                Function 00F9162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetCurrentThread.KERNEL32 ref: 00F91634
                                                                • OpenThreadToken.ADVAPI32(00000000,?,?,?,00F911D9), ref: 00F9163B
                                                                • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00F911D9), ref: 00F91648
                                                                • OpenProcessToken.ADVAPI32(00000000,?,?,?,00F911D9), ref: 00F9164F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CurrentOpenProcessThreadToken
                                                                • String ID:
                                                                • API String ID: 3974789173-0
                                                                • Opcode ID: bca393a582915906600dd5a68e5298d5218136badb4826c3382f8c126f5301ba
                                                                • Instruction ID: fe12c3bd0f2ca3a3df0fe1b138b698db01c2aa7ecb957ea13cd944e2b6fa2322
                                                                • Opcode Fuzzy Hash: bca393a582915906600dd5a68e5298d5218136badb4826c3382f8c126f5301ba
                                                                • Instruction Fuzzy Hash: FBE08671E41215DBEB201FA0AF0EF863B7CBF847A1F184818F249CA080D6358441E790
                                                                Function 00F8D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDesktopWindow.USER32 ref: 00F8D858
                                                                • GetDC.USER32(00000000), ref: 00F8D862
                                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F8D882
                                                                • ReleaseDC.USER32(?), ref: 00F8D8A3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                • String ID:
                                                                • API String ID: 2889604237-0
                                                                • Opcode ID: 674cf15e36a41e750dc82351f9c6450270ee939679fdbaa66f429d474ec3ba35
                                                                • Instruction ID: 76a214a5b8b12438c8e0a5f1706fcfd5792bfbbde9d2bf25199ea6c5332c53dd
                                                                • Opcode Fuzzy Hash: 674cf15e36a41e750dc82351f9c6450270ee939679fdbaa66f429d474ec3ba35
                                                                • Instruction Fuzzy Hash: 1EE09AB5840209DFCB41AFA4DA0DA6DBBB5FB48311F148459E84EE7250C7399942BF90
                                                                Function 00F8D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetDesktopWindow.USER32 ref: 00F8D86C
                                                                • GetDC.USER32(00000000), ref: 00F8D876
                                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F8D882
                                                                • ReleaseDC.USER32(?), ref: 00F8D8A3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                • String ID:
                                                                • API String ID: 2889604237-0
                                                                • Opcode ID: a7a1b9e512ac22d0ca4b0a8023fe0e2fc676f5e90cf111d13c9f0095ab054513
                                                                • Instruction ID: 1162f6728b65c86691595b0d65a79818ae836713465b2b0507efc878af7135cc
                                                                • Opcode Fuzzy Hash: a7a1b9e512ac22d0ca4b0a8023fe0e2fc676f5e90cf111d13c9f0095ab054513
                                                                • Instruction Fuzzy Hash: CCE092B5C00208EFCB51AFA4DA0DA6DBBB5BB48311F148449E94EE7250CB399902BF90
                                                                Function 00F3BBE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 232COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __Init_thread_footer.LIBCMT ref: 00F3BEB3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Init_thread_footer
                                                                • String ID: D%$D%
                                                                • API String ID: 1385522511-485025506
                                                                • Opcode ID: 3738c92ba9d45e618168756cf39bff34c91476b95b40f9e89446452b06fb443b
                                                                • Instruction ID: 2e8cdb7c856792cddef04331c4262e98887227b240044b8142f20c7b13a7833d
                                                                • Opcode Fuzzy Hash: 3738c92ba9d45e618168756cf39bff34c91476b95b40f9e89446452b06fb443b
                                                                • Instruction Fuzzy Hash: A1911B75E00206DFCB28CF59C0A16A9B7F1FF58325F24416EDA85AB351D731E981EB90
                                                                Function 00FA4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625
                                                                • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00FA4ED4
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Connection_wcslen
                                                                • String ID: *$LPT
                                                                • API String ID: 1725874428-3443410124
                                                                • Opcode ID: 7d059b9218b6b2828ee26413ae2b59708fc7b2e4b65e02b4a684006e5f319b03
                                                                • Instruction ID: 11a1675128611ebb7451a58e27779045c30c2c71d7ce061ed7b57ee7681c0533
                                                                • Opcode Fuzzy Hash: 7d059b9218b6b2828ee26413ae2b59708fc7b2e4b65e02b4a684006e5f319b03
                                                                • Instruction Fuzzy Hash: 409161B5A00204DFCB14DF58C485EAABBF1BF85314F198099E80A9F3A2C775ED85DB91
                                                                Function 00F5E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • __startOneArgErrorHandling.LIBCMT ref: 00F5E30D
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ErrorHandling__start
                                                                • String ID: pow
                                                                • API String ID: 3213639722-2276729525
                                                                • Opcode ID: 023a1bf50456337be355d760fd0149bb4c13f172e2e70535d91bca03659d9005
                                                                • Instruction ID: 0d9bc7823350ded7b9a10e338e7994d098e8451abdb5872f95de85bef107a9db
                                                                • Opcode Fuzzy Hash: 023a1bf50456337be355d760fd0149bb4c13f172e2e70535d91bca03659d9005
                                                                • Instruction Fuzzy Hash: F3518E61E0C30196CB197724CD0137A7F94AB60766F304D99E8D5422EDEB358DCDBB86
                                                                Function 00F4E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                                Download Yara Rule
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID:
                                                                • String ID: #
                                                                • API String ID: 0-1885708031
                                                                • Opcode ID: f3e5af226cf4744c9ab6cd4a4d3835e92b1ac4f052f4ae7ea07c1a292d5f91e9
                                                                • Instruction ID: b01389cc9061adf678ca0a7a0d2c8c4b74af5ce210c5fa4434a6d370a628fe42
                                                                • Opcode Fuzzy Hash: f3e5af226cf4744c9ab6cd4a4d3835e92b1ac4f052f4ae7ea07c1a292d5f91e9
                                                                • Instruction Fuzzy Hash: 2C51F235E04246DFDB15EF28C8816FE7BA8FF55320F244055ECA19B290D7789E42EB90
                                                                Function 00F4F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • Sleep.KERNEL32(00000000), ref: 00F4F2A2
                                                                • GlobalMemoryStatusEx.KERNEL32(?), ref: 00F4F2BB
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: GlobalMemorySleepStatus
                                                                • String ID: @
                                                                • API String ID: 2783356886-2766056989
                                                                • Opcode ID: 9bc0238f8b4b1e576644f9e1fb9be883e4f1d92a634d6e1db54c38277f40d65d
                                                                • Instruction ID: 9d882b8d41fcdfa7a3181e5d1932858686253ff690acd0059ad2a47548e15605
                                                                • Opcode Fuzzy Hash: 9bc0238f8b4b1e576644f9e1fb9be883e4f1d92a634d6e1db54c38277f40d65d
                                                                • Instruction Fuzzy Hash: B95137B140C7489BD320AF11DC86BAFBBF8FB84310F81885DF2D952195EB748529DB66
                                                                Function 00FB5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00FB57E0
                                                                • _wcslen.LIBCMT ref: 00FB57EC
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: BuffCharUpper_wcslen
                                                                • String ID: CALLARGARRAY
                                                                • API String ID: 157775604-1150593374
                                                                • Opcode ID: eb7963c0d8d822eb4a5f9bbb43f35146e48251c90f0c454a802ef1d44ef1416a
                                                                • Instruction ID: 3dc8b9b62c3fb12eed21150cdf7ad36c66e92bbe5f23d8a3675c98f87961abe0
                                                                • Opcode Fuzzy Hash: eb7963c0d8d822eb4a5f9bbb43f35146e48251c90f0c454a802ef1d44ef1416a
                                                                • Instruction Fuzzy Hash: A3419F31E002099FCB14DFAAC882AEEBBB5EF59724F144029E505A7251E778DD81EF90
                                                                Function 00FAD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • _wcslen.LIBCMT ref: 00FAD130
                                                                • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00FAD13A
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CrackInternet_wcslen
                                                                • String ID: |
                                                                • API String ID: 596671847-2343686810
                                                                • Opcode ID: f0b2c2aea5d41ad610cb2ebcc6b8f947a6f40f55f3303617beefbfe8ba816bab
                                                                • Instruction ID: 3c3e24b0e313a9c1e000d4691af83ae882838879d596ca375fcbaa8b9e5a803f
                                                                • Opcode Fuzzy Hash: f0b2c2aea5d41ad610cb2ebcc6b8f947a6f40f55f3303617beefbfe8ba816bab
                                                                • Instruction Fuzzy Hash: 97313E71D00109EBDF15EFA4CC85AEE7FB9FF05310F104019F815A6161D735AA46EB64
                                                                Function 00FC4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00FC461F
                                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FC4634
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend
                                                                • String ID: '
                                                                • API String ID: 3850602802-1997036262
                                                                • Opcode ID: 324617a1965e0b82d2be3681b3fc854bdd4fd450c0dda0cc8d465c66b9bf87fe
                                                                • Instruction ID: 04f453ed61a9012287b9bdcc55f16a289f42a13e948bd65ad1ac080fcd153758
                                                                • Opcode Fuzzy Hash: 324617a1965e0b82d2be3681b3fc854bdd4fd450c0dda0cc8d465c66b9bf87fe
                                                                • Instruction Fuzzy Hash: FF313975A0020A9FDB14CF69CA91FDABBB5FF49310F14446AE904AB385D770A941EF90
                                                                Function 00FC31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00FC327C
                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FC3287
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: MessageSend
                                                                • String ID: Combobox
                                                                • API String ID: 3850602802-2096851135
                                                                • Opcode ID: dc7d7178ff97b112af1062aa60839d8961a44e29976a54a82e3781722ab77d2e
                                                                • Instruction ID: 4bb80e7008905cd6f0f185c6a15de268f17b467753a9be9f46b4d57226114778
                                                                • Opcode Fuzzy Hash: dc7d7178ff97b112af1062aa60839d8961a44e29976a54a82e3781722ab77d2e
                                                                • Instruction Fuzzy Hash: A811E27170020A7FEF219E54DD82FFB376AEB943B4F108128F91897290D631DD51A760
                                                                Function 00FACD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00FACD7D
                                                                • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00FACDA6
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Internet$OpenOption
                                                                • String ID: <local>
                                                                • API String ID: 942729171-4266983199
                                                                • Opcode ID: 1efb0971847ed22c4c3ef3e778e2f9957dd375969a73a2059a4a0a5b2b057621
                                                                • Instruction ID: d9033af4d6d3a068badd62f66f0eda61cdae57e31349da8564ea043a804d582b
                                                                • Opcode Fuzzy Hash: 1efb0971847ed22c4c3ef3e778e2f9957dd375969a73a2059a4a0a5b2b057621
                                                                • Instruction Fuzzy Hash: 8411A3B26156367AD7244B668C45FE7BE6CEF137B4F004226F12983180D7609840E6F0
                                                                Function 00F96C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                • CharUpperBuffW.USER32(?,?,?), ref: 00F96CB6
                                                                • _wcslen.LIBCMT ref: 00F96CC2
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen$BuffCharUpper
                                                                • String ID: STOP
                                                                • API String ID: 1256254125-2411985666
                                                                • Opcode ID: 7037d3262c2765224f4b3c141a971d56b61d883d949c79d045520ee352b5c99c
                                                                • Instruction ID: 40d850fc4dd9e01afce3b2102aa4ac832e267dab023be549c44c86cd99108c35
                                                                • Opcode Fuzzy Hash: 7037d3262c2765224f4b3c141a971d56b61d883d949c79d045520ee352b5c99c
                                                                • Instruction Fuzzy Hash: 95010432A045278ADF219FBDDC819BF37A4EE60720B000525F862D3190EA75E840E650
                                                                Function 00F91CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA
                                                                • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00F91D4C
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameSend_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 624084870-1403004172
                                                                • Opcode ID: ace332fe397bd5fc68e2fcc80f3b7d09884bf3a1cfce263f8df272968cf13764
                                                                • Instruction ID: b3a8068ee0d18b4b04a8bb5850bda1e2aefa452bcf7da58f7c97388acd5997b4
                                                                • Opcode Fuzzy Hash: ace332fe397bd5fc68e2fcc80f3b7d09884bf3a1cfce263f8df272968cf13764
                                                                • Instruction Fuzzy Hash: FB012831E04219AB9F08EBA0CD11DFE73A8FF423A0F00051AF922573D1EAB45908F660
                                                                Function 00F91BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA
                                                                • SendMessageW.USER32(?,00000180,00000000,?), ref: 00F91C46
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameSend_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 624084870-1403004172
                                                                • Opcode ID: d22880e4433ba87f5eab090a903db8bd02279c2b7da883cd020772b1280a807e
                                                                • Instruction ID: 455b3196ffa1e9e4dda661e818fbe137dfd2925e5240b3dc813e3d95be3543c8
                                                                • Opcode Fuzzy Hash: d22880e4433ba87f5eab090a903db8bd02279c2b7da883cd020772b1280a807e
                                                                • Instruction Fuzzy Hash: 0701F771A8810966EF04EB90CE52EFF77A8AF51350F100029B90663281EAA59E08F6B1
                                                                Function 00F91C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA
                                                                • SendMessageW.USER32(?,00000182,?,00000000), ref: 00F91CC8
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameSend_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 624084870-1403004172
                                                                • Opcode ID: a546058634786fc42cd2f0f6d160e090df38f67543e6b43c2d1a330d3b465847
                                                                • Instruction ID: efd387868d3981526ff41e826e1f807a56a92cf20bcde10fc1b08d2af3da6922
                                                                • Opcode Fuzzy Hash: a546058634786fc42cd2f0f6d160e090df38f67543e6b43c2d1a330d3b465847
                                                                • Instruction Fuzzy Hash: B601A775B4411966DF04E790CE01AFE77A8AF11350F540025B90573281EAA49F08F671
                                                                Function 00F91D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD
                                                                  • Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA
                                                                • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00F91DD3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ClassMessageNameSend_wcslen
                                                                • String ID: ComboBox$ListBox
                                                                • API String ID: 624084870-1403004172
                                                                • Opcode ID: f4b579fabfa515b30d32df19aef31b0cab2f032b20b8ef0c2b72c2a1a47c28ba
                                                                • Instruction ID: 965e39a0fb02353086f94202bf488538f1ce6cb4876726f328dcf4cc98abb5dd
                                                                • Opcode Fuzzy Hash: f4b579fabfa515b30d32df19aef31b0cab2f032b20b8ef0c2b72c2a1a47c28ba
                                                                • Instruction Fuzzy Hash: 1FF0F471A4421966EF04E7A4CD52FFE77A8BF41360F040926B922A32C1DAE4990CA2A0
                                                                Function 00FB747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: _wcslen
                                                                • String ID: 3, 3, 16, 1
                                                                • API String ID: 176396367-3042988571
                                                                • Opcode ID: 2371fb37b72f348a23aceaa28538e4b891f1b6702e596a54f3188ea55ef53470
                                                                • Instruction ID: a88b14117881bc444a12f04ff2ceaedf2d26917dce0a07c57a68b0c9a7af1d1c
                                                                • Opcode Fuzzy Hash: 2371fb37b72f348a23aceaa28538e4b891f1b6702e596a54f3188ea55ef53470
                                                                • Instruction Fuzzy Hash: 3EE02B06A04320E09331327BDCC29BF7689CFC5762710182BFE81C2266EA98DDD1B3A1
                                                                Function 00F90B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00F90B23
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Message
                                                                • String ID: AutoIt$Error allocating memory.
                                                                • API String ID: 2030045667-4017498283
                                                                • Opcode ID: 30fb6949e7a4d8b51af2d068c94a8e1e28b54db00b03e0a3285093dd1fba63b2
                                                                • Instruction ID: 3bffe48aaabe928ba1d8c17a70365d6a4517bac35ffc52aa5ede24b31d18bf3f
                                                                • Opcode Fuzzy Hash: 30fb6949e7a4d8b51af2d068c94a8e1e28b54db00b03e0a3285093dd1fba63b2
                                                                • Instruction Fuzzy Hash: DEE0D8312443083AD21437547D03FC97E848F05F21F10042AFB9C959C38EE6649036E9
                                                                Function 00F50D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                  • Part of subcall function 00F4F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00F50D71,?,?,?,00F3100A), ref: 00F4F7CE
                                                                • IsDebuggerPresent.KERNEL32(?,?,?,00F3100A), ref: 00F50D75
                                                                • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F3100A), ref: 00F50D84
                                                                Strings
                                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F50D7F
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                • API String ID: 55579361-631824599
                                                                • Opcode ID: 8e258f0e16443c7adc37d65c1d7d48f0d40a7357dd90576b763490de58492a6a
                                                                • Instruction ID: d8f19f91606a04279657718a7caebcbbbb70cdfd4c7b74361df04726444c09b9
                                                                • Opcode Fuzzy Hash: 8e258f0e16443c7adc37d65c1d7d48f0d40a7357dd90576b763490de58492a6a
                                                                • Instruction Fuzzy Hash: 42E06D702003418BD3309FB8DA05B82BBF0AF00741F00892DE986C7656DFB9E44CAB91
                                                                Function 00FA3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00FA302F
                                                                • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00FA3044
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: Temp$FileNamePath
                                                                • String ID: aut
                                                                • API String ID: 3285503233-3010740371
                                                                • Opcode ID: 86ab9fcdbfd95065f24c0c177adc42a6765273236df75a6d7e307cc73427dc52
                                                                • Instruction ID: 5fd49ccb54fad145c54ea93e5c068728c20152ae94c8e4b4b43d6195310f80f3
                                                                • Opcode Fuzzy Hash: 86ab9fcdbfd95065f24c0c177adc42a6765273236df75a6d7e307cc73427dc52
                                                                • Instruction Fuzzy Hash: FDD05E7250032C67DA20E7A4AD0EFDB3A6CDB04750F0002A1B659E30A1DAB4D984CAD0
                                                                Function 00F8D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: LocalTime
                                                                • String ID: %.3d$X64
                                                                • API String ID: 481472006-1077770165
                                                                • Opcode ID: d40b073e54bc2aa37d24d9c43ed005dfb1834f2e07e27fff0907c3f6b23d0bac
                                                                • Instruction ID: 31203d498f5cfe12c2427302e164e10b8d4915e3da72cbf3302a72d895cd4282
                                                                • Opcode Fuzzy Hash: d40b073e54bc2aa37d24d9c43ed005dfb1834f2e07e27fff0907c3f6b23d0bac
                                                                • Instruction Fuzzy Hash: 80D06262C49119F9CB50BAD4DD4AEF9B77CEF59341F508452FD0AD2080D628D5487761
                                                                Function 00FC2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FC236C
                                                                • PostMessageW.USER32(00000000), ref: 00FC2373
                                                                  • Part of subcall function 00F9E97B: Sleep.KERNEL32 ref: 00F9E9F3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FindMessagePostSleepWindow
                                                                • String ID: Shell_TrayWnd
                                                                • API String ID: 529655941-2988720461
                                                                • Opcode ID: d36e5f4308706b78bd04952f7c117eb85cb11b37e714b41edef8bf9b1f795c7d
                                                                • Instruction ID: c2a51021c431737ce0207b6e84e449734411e9f03029dcceb887d7b07198b14b
                                                                • Opcode Fuzzy Hash: d36e5f4308706b78bd04952f7c117eb85cb11b37e714b41edef8bf9b1f795c7d
                                                                • Instruction Fuzzy Hash: 43D0C9327813147AE664B7719E0FFC676149B04B14F004916B74AEA1E0C9A4A801AA94
                                                                Function 00FC2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FC232C
                                                                • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00FC233F
                                                                  • Part of subcall function 00F9E97B: Sleep.KERNEL32 ref: 00F9E9F3
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: FindMessagePostSleepWindow
                                                                • String ID: Shell_TrayWnd
                                                                • API String ID: 529655941-2988720461
                                                                • Opcode ID: a554b6024434706ca2263bc42d792f5577a182be18f556ab2016d4484aeff892
                                                                • Instruction ID: f9bbeba68b68980550c66e8ee35171ead03d99d67503762cc617969e5b009a5e
                                                                • Opcode Fuzzy Hash: a554b6024434706ca2263bc42d792f5577a182be18f556ab2016d4484aeff892
                                                                • Instruction Fuzzy Hash: BDD0C936794314B6E664B7719E0FFD67A149B00B14F004916B74AEA1E0C9A4A801AA94
                                                                Function 00F6BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                Download Yara Rule
                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00F6BE93
                                                                • GetLastError.KERNEL32 ref: 00F6BEA1
                                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F6BEFC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.1648151443.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true
                                                                • Associated: 00000000.00000002.1648131287.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FCC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648197485.0000000000FF2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648233282.0000000000FFC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                • Associated: 00000000.00000002.1648248612.0000000001004000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_0_2_f30000_file.jbxd
                                                                Similarity
                                                                • API ID: ByteCharMultiWide$ErrorLast
                                                                • String ID:
                                                                • API String ID: 1717984340-0
                                                                • Opcode ID: aa605880860a04613c2cb0492c8aa5807a3ea2aa1d593daab5a73f34587878ed
                                                                • Instruction ID: c61bfd96316b9ab7ee47d7bccf754ee254a42abc415ce1a205446e4adc5a56ad
                                                                • Opcode Fuzzy Hash: aa605880860a04613c2cb0492c8aa5807a3ea2aa1d593daab5a73f34587878ed
                                                                • Instruction Fuzzy Hash: 17410635A04206AFCF218FA5CC44BBA7BA5EF51320F144169F959DB1B1DB318C85FB60

                                                                Execution Graph

                                                                Execution Coverage:1%
                                                                Dynamic/Decrypted Code Coverage:0%
                                                                Signature Coverage:100%
                                                                Total number of Nodes:6
                                                                Total number of Limit Nodes:0
                                                                execution_graph 5110 1bdeb859732 5111 1bdeb859789 NtQuerySystemInformation 5110->5111 5112 1bdeb857b04 5110->5112 5111->5112 5107 1bdeb8531b7 5108 1bdeb8531c7 NtQuerySystemInformation 5107->5108 5109 1bdeb853164 5108->5109

                                                                Callgraph

                                                                Executed Functions

                                                                Function 000001BDEB859732 Relevance: 26.1, APIs: 1, Strings: 10, Instructions: 6826nativeCOMMON
                                                                Download Yara Rule
                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000010.00000002.2887002886.000001BDEB850000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001BDEB850000, based on PE: false
                                                                Joe Sandbox IDA Plugin
                                                                • Snapshot File: hcaresult_16_2_1bdeb850000_firefox.jbxd
                                                                Similarity
                                                                • API ID: InformationQuerySystem
                                                                • String ID: #$#$#$4$>$>$>$A$z$z
                                                                • API String ID: 3562636166-3072146587
                                                                • Opcode ID: a7beeb6ed6d4bd1c13836e24e4a4bf8602c8d7752103ee20adf8d6ea9f6b849f
                                                                • Instruction ID: f6668cb6315ddb6a0d87c364c225ae077e70a5a22c4061d51f00720e8f708f6b
                                                                • Opcode Fuzzy Hash: a7beeb6ed6d4bd1c13836e24e4a4bf8602c8d7752103ee20adf8d6ea9f6b849f
                                                                • Instruction Fuzzy Hash: E6A3A131618A498BDB2EDF18DCD56E977E5FB98700F14422ED84AC7255EF34EA028BC1